diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md index 101b9976ad..bc6a097de4 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/05/2019 +ms.date: 04/22/2019 --- # Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager @@ -462,15 +462,6 @@ After you've decided where your protected apps can access enterprise data on you **To set your optional settings** 1. Choose to set any or all of the optional settings: - - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: - - - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. - - - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. - - >[!IMPORTANT] - >The **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box** option is only available for Configuration Manager versions 1610 and below. - - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - **Yes (recommended).** Turns on the feature and provides the additional protection. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index 73bc1915d3..e8c1a0661d 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -60,7 +60,7 @@ Each ASR rule contains three settings: For further details on how audit mode works and when to use it, see [Audit Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md). -### Enable ASR rules in Intune +### Intune 1. In Intune, select *Device configuration* > *Profiles*. Choose an existing endpoint protection profile or create a new one. To create a new one, select *Create profile* and enter information for this profile. For *Profile type*, select *Endpoint protection*. If you've chosen an existing profile, select *Properties* and then select *Settings*. @@ -72,11 +72,20 @@ For further details on how audit mode works and when to use it, see [Audit Windo 4. Select *OK* on the three configuration panes and then select *Create* if you're creating a new endpoint protection file or *Save* if you're editing an existing one. -### Enable ASR rules in SCCM +### SCCM -For information about enabling ASR rules and setting exclusions in SCCM, see [Create and deploy an Exploit Guard policy](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/create-deploy-exploit-guard-policy). +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. + ![Windows Defender Exploit Guard](images/wdeg.png) +1. Click **Home** > **Create Exploit Guard Policy**. + ![Create Exploit Guard Policy](images/create-exploit-guard-policy.md) +1. Enter a name and a description, click **Attack Surface Reduction**, and click **Next**. + ![ASR rules](images/sccm-asr-rules.png) +1. Choose which rules will block or audit actions and click **Next**. + ![ASR blocks](images/sccm-asr-blocks.png) +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. -### Enable ASR rules with Group Policy +### Group Policy >[!WARNING] >If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting Group Policy settings on startup. @@ -97,7 +106,7 @@ For information about enabling ASR rules and setting exclusions in SCCM, see [Cr 5. To exclude files and folders from ASR rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. -### Enable ASR rules with PowerShell +### PowerShell >[!WARNING] >If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting PowerShell settings on startup. @@ -148,7 +157,7 @@ For information about enabling ASR rules and setting exclusions in SCCM, see [Cr >[!IMPORTANT] >Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. -### Enable ASR rules with MDM CSPs +### MDM Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductionrules) configuration service provider (CSP) to individually enable and set the mode for each rule. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md index 4cc8d86d0a..6748846943 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 03/29/2019 +ms.date: 04/22/2019 --- # Enable controlled folder access @@ -24,11 +24,12 @@ ms.date: 03/29/2019 You can enable controlled folder access by using any of the these methods: -- Windows Security app -- Intune -- MDM -- Group Policy -- PowerShell cmdlets +- [Windows Security app](#windows-security-app) +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. @@ -67,6 +68,19 @@ You can enable controlled folder access by using any of the these methods: Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders. +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. + ![Windows Defender Exploit Guard](images/wdeg.png) +1. Click **Home** > **Create Exploit Guard Policy**. + ![Create Exploit Guard Policy](images/create-exploit-guard-policy.md) +1. Enter a name and a description, click **Controlled folder access**, and click **Next**. + ![CFA](images/sccm-cfa.png) +1. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**. + ![CFA block](images/sccm-cfa-block.png) +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + ## Group Policy 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md index 86f640ad6f..ee3c8a1d90 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 03/29/2019 +ms.date: 04/22/2019 --- # Enable exploit protection @@ -28,11 +28,12 @@ You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Au You can enable each mitigation separately by using any of the these methods: -- Windows Security app -- Intune -- MDM -- Group Policy -- PowerShell cmdlets +- [Windows Security app](#windows-security-app) +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) They are configured by default in Windows 10. @@ -124,6 +125,19 @@ CFG will be enabled for *miles.exe*. Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode. +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. + ![Windows Defender Exploit Guard](images/wdeg.png) +1. Click **Home** > **Create Exploit Guard Policy**. + ![Create Exploit Guard Policy](images/create-exploit-guard-policy.md) +1. Enter a name and a description, click **Exploit protection**, and click **Next**. + ![EP](images/sccm-ep.png) +1. Browse to the location of the exploit protection XML file and click **Next**. + ![ASR blocks](images/sccm-ep-xml.png) +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + ## Group Policy 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -231,15 +245,6 @@ Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlu See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. - - - - - - - - - ## Related topics - [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md index b1e858ebcb..6e0ea74a8c 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 04/01/2019 +ms.date: 04/22/2019 --- # Enable network protection @@ -24,11 +24,11 @@ ms.date: 04/01/2019 You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it. You can enable network protection by using any of the these methods: -- Intune -- MDM -- Group Policy -- PowerShell cmdlets -- Registry +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) ## Intune @@ -45,9 +45,22 @@ You can enable network protection by using any of the these methods: Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode. +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. + ![Windows Defender Exploit Guard](images/wdeg.png) +1. Click **Home** > **Create Exploit Guard Policy**. + ![Create Exploit Guard Policy](images/create-exploit-guard-policy.md) +1. Enter a name and a description, click **Network protection**, and click **Next**. + ![ASR rules](images/sccm-np.png) +1. Choose whether to block or audit access to suspicious domains and click **Next**. + ![ASR blocks](images/sccm-np-block.png) +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + ## Group Policy -You can use the following procedure to enable network protection on a standalone computer or for domain-joined computers. +You can use the following procedure to enable network protection on domain-joined computers or on a standalone computer. 1. On a standalone computer, click **Start**, type and then click **Edit group policy**. @@ -93,9 +106,6 @@ Set-MpPreference -EnableNetworkProtection AuditMode Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off. -## - -Network protection can't be turned on using the Windows Security app, but you can enable it by ## Related topics diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png new file mode 100644 index 0000000000..1253d68613 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png new file mode 100644 index 0000000000..00225ec18c Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png new file mode 100644 index 0000000000..dfb1cb201b Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png new file mode 100644 index 0000000000..2868712541 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png new file mode 100644 index 0000000000..bd2e57d73f Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png new file mode 100644 index 0000000000..d7a896332a Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png new file mode 100644 index 0000000000..1d16250401 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png new file mode 100644 index 0000000000..0655fdad69 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png new file mode 100644 index 0000000000..a9f11a2e95 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png new file mode 100644 index 0000000000..312167da41 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png differ