diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index e0350406c9..18cb4f40c8 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -43,7 +43,6 @@ #### [Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) ## [Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md) ### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md) -#### [Recommended Group Policy and mobile device management (MDM) settings for Windows Defender SmartScreen in your organization](windows-defender-smartscreen-recommended-settings.md) ### [Use Windows Defender Security Center to set Windows Defender SmartScreen for individual devices](windows-defender-smartscreen-set-individual-device.md) ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) ## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 3d6424c9fd..f54d6d030f 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -20,7 +20,6 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| |[Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md)|New | |[Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md)|New | -|[Recommended Group Policy and mobile device management (MDM) settings for Windows Defender SmartScreen in your organization](windows-defender-smartscreen-recommended-settings.md)|New | |[Use Windows Defender Security Center to set Windows Defender SmartScreen for individual devices](windows-defender-smartscreen-set-individual-device.md)|New | diff --git a/windows/keep-secure/windows-defender-smartscreen-available-settings.md b/windows/keep-secure/windows-defender-smartscreen-available-settings.md index b3c127d6c2..1200aa02ce 100644 --- a/windows/keep-secure/windows-defender-smartscreen-available-settings.md +++ b/windows/keep-secure/windows-defender-smartscreen-available-settings.md @@ -153,7 +153,69 @@ If you manage your policies using Microsoft Intune, you'll want to use these MDM
  • 1. Employees can't ignore SmartScreen warnings for files.
  • - +
    + +## Recommended Group Policy and mobile device management (MDM) settings for Windows Defender SmartScreen in your organization +By default, Windows Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Windows Defender SmartScreen to block high-risk interactions instead of providing just a warning. + +To better help you protect your organization, we recommend turning on and using these specific Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings. + +
    + + + + + + + + + + + + + + + + + + + + +
    Group Policy settingRecommendation
    Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreenEnable.
    Turns on Windows Defender SmartScreen.
    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sitesEnable.
    Stops employees from ignoring warning messages and continuing on to a potentially malicious website.
    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for filesEnable.
    Stops employees from ingnoring warning messages and continuing to download potentially malicious files.
    Administrative Templates\Windows Components\File Explorer\Configure Windows Defender SmartScreenEnable with the Warn and prevent bypass option.
    Stops employees from ignoring warning messages about malicious files downloaded from the Internet.
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    MDM settingRecommendation
    Browser/AllowSmartScreen1.
    Turns on Windows Defender SmartScreen.
    Browser/PreventSmartScreenPromptOverride1.
    Stops employees from ignoring warning messages and continuing on to a potentially malicious website.
    Browser/PreventSmartScreenPromptOverrideForFiles1.
    Stops employees from ingnoring warning messages and continuing to download potentially malicious files.
    SmartScreen/EnableSmartScreenInShell1. Turns on Windows Defender SmartScreen in Windows.

    Requires at least Windows 10, Version 1703.

    SmartScreen/PreventOverrideForFilesInShell1.
    Stops employees from ignoring warning messages about malicious files downloaded from the Internet.

    Requires at least Windows 10, Version 1703.

    + +## Related topics +- [Keep Windows 10 secure](https://technet.microsoft.com/itpro/windows/keep-secure/index) + +- [Security technologies in Windows 10](https://technet.microsoft.com/itpro/windows/keep-secure/security-technologies) + +- [Available Group Policy and Mobile Data Management (MDM) settings for Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge/available-policies) >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file diff --git a/windows/keep-secure/windows-defender-smartscreen-recommended-settings.md b/windows/keep-secure/windows-defender-smartscreen-recommended-settings.md deleted file mode 100644 index 80d75f10a2..0000000000 --- a/windows/keep-secure/windows-defender-smartscreen-recommended-settings.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Recommended Group Policy and mobile device management (MDM) settings for Windows Defender SmartScreen in your organization (Windows 10) -description: A list of the specific Windows Defender SmartScreen settings we recommend using within your organization. -keywords: SmartScreen Filter, Windows SmartScreen -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -author: eross-msft -localizationpriority: high ---- - -# Recommended Group Policy and mobile device management (MDM) settings for Windows Defender SmartScreen in your organization - -**Applies to:** -- Windows 10, Version 1703 -- Windows 10 Mobile - -By default, Windows Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Windows Defender SmartScreen to block high-risk interactions instead of providing just a warning. - -To better help you protect your organization, we recommend turning on and using these specific Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings. - ->[!Note] ->For a complete list of available Group Policy and MDM settings, see [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md) topic. - - - - - - - - - - - - - - - - - - - - - - -
    Group Policy settingRecommendation
    Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreenEnable.
    Turns on Windows Defender SmartScreen.
    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sitesEnable.
    Stops employees from ignoring warning messages and continuing on to a potentially malicious website.
    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for filesEnable.
    Stops employees from ingnoring warning messages and continuing to download potentially malicious files.
    Administrative Templates\Windows Components\File Explorer\Configure Windows Defender SmartScreenEnable with the Warn and prevent bypass option.
    Stops employees from ignoring warning messages about malicious files downloaded from the Internet.
    - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MDM settingRecommendation
    Browser/AllowSmartScreen1.
    Turns on Windows Defender SmartScreen.
    Browser/PreventSmartScreenPromptOverride1.
    Stops employees from ignoring warning messages and continuing on to a potentially malicious website.
    Browser/PreventSmartScreenPromptOverrideForFiles1.
    Stops employees from ingnoring warning messages and continuing to download potentially malicious files.
    SmartScreen/EnableSmartScreenInShell1. Turns on Windows Defender SmartScreen in Windows.

    Requires at least Windows 10, Version 1703.

    SmartScreen/PreventOverrideForFilesInShell1.
    Stops employees from ignoring warning messages about malicious files downloaded from the Internet.

    Requires at least Windows 10, Version 1703.

    - -## Related topics -- [Keep Windows 10 secure](https://technet.microsoft.com/itpro/windows/keep-secure/index) - -- [Security technologies in Windows 10](https://technet.microsoft.com/itpro/windows/keep-secure/security-technologies) - -- [Available Group Policy and Mobile Data Management (MDM) settings for Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge/available-policies) - ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file