mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 13:47:23 +00:00
Merge pull request #1491 from MicrosoftDocs/repo_sync_working_branch
Confirm merge from repo_sync_working_branch to master to sync with https://github.com/MicrosoftDocs/windows-itpro-docs (branch public)
This commit is contained in:
Dani Halfin
GitHub
commit
5b2c62c724
@ -243,7 +243,7 @@ In the following table, we show you the features available in both Microsoft Edg
|
||||
|-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:|
|
||||
| Print support |  |  |
|
||||
| Multi-tab support |  |  |
|
||||
| Allow/Block URL support |  <p>*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall<em>. Microsoft kiosk browser has custom policy support.</em> |  |
|
||||
| Allow/Block URL support |   |
|
||||
| Configure Home Button |  |  |
|
||||
| Set Start page(s) URL |  |  <p>*Same as Home button URL* |
|
||||
| Set New Tab page URL |  |  |
|
||||
@ -255,7 +255,7 @@ In the following table, we show you the features available in both Microsoft Edg
|
||||
| SKU availability | Windows 10 October 2018 Update<br>Professional, Enterprise, and Education | Windows 10 April 2018 Update<br>Professional, Enterprise, and Education |
|
||||
|
||||
**\*Windows Defender Firewall**<p>
|
||||
To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both. For more details, see [Windows Defender Firewall with Advanced Security Deployment](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide).
|
||||
To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both, using IP addresses. For more details, see [Windows Defender Firewall with Advanced Security Deployment Guide](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide).
|
||||
|
||||
---
|
||||
|
||||
|
||||
@ -15,7 +15,7 @@ appliesto:
|
||||
- HoloLens (1st gen)
|
||||
---
|
||||
|
||||
# HoloLens (1st Gen) hardware
|
||||
# HoloLens (1st gen) hardware
|
||||
|
||||
|
||||
|
||||
|
||||
@ -102,6 +102,7 @@ Not sure what the indicator lights on your HoloLens mean? Want to know how HoloL
|
||||
| - | - | - |
|
||||
| You press the Power button. | One light flashes five times, then turns off. | The HoloLens battery is critically low. Charge your HoloLens. |
|
||||
| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. [Reinstall the operating system](hololens-recovery.md) to recover your device. |
|
||||
| You press the Power button. | The 1st, 3rd, and 5th lights flash together continually. | HoloLens may have a hardware failure. To be sure, [reinstall the OS](hololens-recovery.md#hololens-2), and try again. After reinstalling the OS, if the light-flash pattern persists, contact [support](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb). |
|
||||
|
||||
## Safety and comfort
|
||||
|
||||
|
||||
@ -47,8 +47,14 @@ You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firm
|
||||
|
||||
- **Msiexec.exe /i <name of msi> /quiet /norestart**
|
||||
|
||||
> [!NOTE]
|
||||
> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]"
|
||||
|
||||
For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you want to keep your Surface Dock updated using any other method, refer to [Update your Surface Dock](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) for details.
|
||||
|
||||
## Intune deployment
|
||||
You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management).
|
||||
|
||||
@ -84,8 +90,8 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
|
||||
|
||||
| Log | Location | Notes |
|
||||
| -------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Surface Dock Firmware Update log | /l*v %windir%\logs\Applications\SurfaceDockFWI.log | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
|
||||
| Windows Device Install log | %windir%\inf\ setupapi.dev.log | For more information about using Device Install Log, refer [to SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. |
|
||||
| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
|
||||
| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-). |
|
||||
|
||||
|
||||
**Table 2. Event log IDs for Surface Dock Firmware Update**
|
||||
@ -97,6 +103,10 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
|
||||
| 2003 | Dock firmware update failed to get firmware version. |
|
||||
| 2004 | Querying the firmware version. |
|
||||
| 2005 | Dock firmware failed to start update. |
|
||||
| 2006 | Failed to send offer/payload pairs. |
|
||||
| 2007 | Firmware update finished. |
|
||||
| 2008 | BEGIN dock telemetry. |
|
||||
| 2011 | END dock telemetry. |
|
||||
|
||||
## Troubleshooting tips
|
||||
|
||||
|
||||
@ -82,7 +82,8 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC
|
||||
- Password
|
||||
- Windows Hello for Business, with or without an MDM subscription.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure Active Directory-joined PCs, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -25,7 +25,13 @@ manager: dansimp
|
||||
|
||||
## <a href="" id="overview"></a>Overview
|
||||
|
||||
Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies.
|
||||
Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies.
|
||||
|
||||
NOTE: Starting from the following Windows 10 version Replace command is supported
|
||||
- Windows 10, version 1903 with KB4512941 and KB4517211 installed
|
||||
- Windows 10, version 1809 with KB4512534 and KB installed
|
||||
- Windows 10, version 1803 with KB4512509 and KB installed
|
||||
- Windows 10, version 1709 with KB4516071 and KB installed
|
||||
|
||||
When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations:
|
||||
|
||||
@ -48,6 +54,8 @@ When the ADMX policies are imported, the registry keys to which each policy is w
|
||||
- software\microsoft\exchange\
|
||||
- software\policies\microsoft\vba\security\
|
||||
- software\microsoft\onedrive
|
||||
- software\Microsoft\Edge
|
||||
- Software\Microsoft\EdgeUpdate\
|
||||
|
||||
> [!Warning]
|
||||
> Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined.
|
||||
|
||||
@ -36,7 +36,7 @@ It is intended that shared PCs are joined to an Active Directory or Azure Active
|
||||
When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Guest** and **Kiosk** options. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low. In Windows 10, version 1703, an inactive option is added which deletes accounts if they haven't signed in after a specified number of days.
|
||||
|
||||
### Maintenance and sleep
|
||||
Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not is use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods.
|
||||
Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not in use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods.
|
||||
|
||||
While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates.
|
||||
|
||||
|
||||
@ -9,7 +9,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
author: greg-lindsay
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
---
|
||||
@ -159,6 +160,93 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
|
||||
27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
|
||||
</pre>
|
||||
|
||||
<br><B>setupapi.dev.log</B> content:
|
||||
|
||||
<pre style="font-size: 10px; overflow-y: visible">
|
||||
>>> [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
|
||||
>>> Section start 2019/09/26 20:13:01.623
|
||||
cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
|
||||
ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
|
||||
ndv: Install flags: 0x00000000
|
||||
ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
|
||||
ndv: Search options: 0x00000081
|
||||
ndv: Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
|
||||
dvi: {Build Driver List} 20:13:01.643
|
||||
dvi: Searching for hardware ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_060100
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_0601
|
||||
dvi: Searching for compatible ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f
|
||||
dvi: pci\ven_8086&cc_060100
|
||||
dvi: pci\ven_8086&cc_0601
|
||||
dvi: pci\ven_8086
|
||||
dvi: pci\cc_060100
|
||||
dvi: pci\cc_0601
|
||||
sig: {_VERIFY_FILE_SIGNATURE} 20:13:01.667
|
||||
sig: Key = lynxpointsystem.inf
|
||||
sig: FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
|
||||
sig: Catalog = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
|
||||
sig: Success: File is signed in catalog.
|
||||
sig: {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
|
||||
dvi: Created Driver Node:
|
||||
dvi: HardwareID - PCI\VEN_8086&DEV_8C4F
|
||||
dvi: InfName - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
|
||||
dvi: DevDesc - Intel(R) QM87 LPC Controller - 8C4F
|
||||
dvi: Section - Needs_ISAPNP_DRV
|
||||
dvi: Rank - 0x00ff2001
|
||||
dvi: Signer Score - WHQL
|
||||
dvi: DrvDate - 04/04/2016
|
||||
dvi: Version - 10.1.1.18
|
||||
dvi: {Build Driver List - exit(0x00000000)} 20:13:01.699
|
||||
ndv: Searching currently installed INF
|
||||
dvi: {Build Driver List} 20:13:01.699
|
||||
dvi: Searching for hardware ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_060100
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_0601
|
||||
dvi: Searching for compatible ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f
|
||||
dvi: pci\ven_8086&cc_060100
|
||||
dvi: pci\ven_8086&cc_0601
|
||||
dvi: pci\ven_8086
|
||||
dvi: pci\cc_060100
|
||||
dvi: pci\cc_0601
|
||||
dvi: Created Driver Node:
|
||||
dvi: HardwareID - PCI\VEN_8086&DEV_8C4F
|
||||
dvi: InfName - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
|
||||
dvi: DevDesc - Intel(R) QM87 LPC Controller - 8C4F
|
||||
dvi: Section - Needs_ISAPNP_DRV
|
||||
dvi: Rank - 0x00ff2001
|
||||
dvi: Signer Score - WHQL
|
||||
dvi: DrvDate - 10/03/2016
|
||||
dvi: Version - 10.1.1.38
|
||||
dvi: {Build Driver List - exit(0x00000000)} 20:13:01.731
|
||||
dvi: {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
|
||||
dvi: Default installer: Enter 20:13:01.735
|
||||
dvi: {Select Best Driver}
|
||||
dvi: Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
|
||||
dvi: Selected Driver:
|
||||
dvi: Description - Intel(R) QM87 LPC Controller - 8C4F
|
||||
dvi: InfFile - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
|
||||
dvi: Section - Needs_ISAPNP_DRV
|
||||
dvi: {Select Best Driver - exit(0x00000000)}
|
||||
dvi: Default installer: Exit
|
||||
dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
|
||||
ndv: Currently Installed Driver:
|
||||
ndv: Inf Name - oem1.inf
|
||||
ndv: Driver Date - 10/03/2016
|
||||
ndv: Driver Version - 10.1.1.38
|
||||
ndv: {Update Device Driver - exit(00000103)}
|
||||
! ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
|
||||
! ndv: No devices were updated.
|
||||
<<< Section end 2019/09/26 20:13:01.759
|
||||
<<< [Exit status: FAILURE(0xC1900101)]
|
||||
</pre>
|
||||
|
||||
<br>This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f.
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ Before deploying a device using Windows Autopilot, the device must be registered
|
||||
|
||||
## OEM registration
|
||||
|
||||
When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot).
|
||||
When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers and resellers" section of the [Windows Autopilot information page](https://aka.ms/windowsautopilot).
|
||||
|
||||
Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization).
|
||||
|
||||
|
||||
@ -398,7 +398,7 @@ The following endpoint is used to retrieve Skype configuration values. To turn o
|
||||
## Windows Defender
|
||||
|
||||
The following endpoint is used for Windows Defender when Cloud-based Protection is enabled.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Windows Defender Antivirus cloud service connections, see [Allow connections to the Windows Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus#allow-connections-to-the-windows-defender-antivirus-cloud-service).
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|
||||
@ -112,7 +112,7 @@ The following table lists the three group scopes and more information about each
|
||||
<p>Global groups from any domain in the same forest</p>
|
||||
<p>Other Universal groups from any domain in the same forest</p></td>
|
||||
<td><p>Can be converted to Domain Local scope</p>
|
||||
<p>Can be converted to Global scope if the group does not contain any other Universal groups</p></td>
|
||||
<p>Can be converted to Global scope if the group is not a member of any other Universal groups</p></td>
|
||||
<td><p>On any domain in the same forest or trusting forests</p></td>
|
||||
<td><p>Other Universal groups in the same forest</p>
|
||||
<p>Domain Local groups in the same forest or trusting forests</p>
|
||||
|
||||
@ -77,8 +77,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi
|
||||
|
||||
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
|
||||
|
||||
>[!NOTE]
|
||||
>The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
|
||||
> [!NOTE]
|
||||
> The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
|
||||
|
||||
### Enrollment Agent certificate template
|
||||
|
||||
@ -150,10 +150,10 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq
|
||||
|
||||
Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials.
|
||||
1. Open an elevated command prompt.
|
||||
2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`
|
||||
2. Run `certutil -dsTemplate WHFBAuthentication,msPKI-Private-Key-Flag,+CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`
|
||||
|
||||
>[!NOTE]
|
||||
>If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
|
||||
> [!NOTE]
|
||||
> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
|
||||
|
||||
## Publish Templates
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.reviewer:
|
||||
> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
|
||||
Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users.
|
||||
Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. See [FIDO2 security keys features and providers](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys).
|
||||
|
||||
The [FIDO2 CTAP specification](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html) contains a few optional features and extensions which are crucial to provide that seamless and secure experience.
|
||||
|
||||
|
||||
@ -196,7 +196,7 @@ Typical **Primary Group** values for user accounts:
|
||||
|
||||
- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. If the value of **userAccountControl** attribute of user object was changed, you will see the new value here.
|
||||
|
||||
To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag.
|
||||
To decode this value, you can go through the property value definitions in the [User’s or Computer’s account UAC flags.](https://support.microsoft.com/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties) from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag.
|
||||
|
||||
Here's an example: Flags value from event: 0x15
|
||||
|
||||
@ -226,7 +226,7 @@ Decoding:
|
||||
|
||||
So this UAC flags value decodes to: LOCKOUT and SCRIPT
|
||||
|
||||
- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: “Table 7. User’s or Computer’s account UAC flags.”. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event.
|
||||
- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: [User’s or Computer’s account UAC flags](https://support.microsoft.com/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties). In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event.
|
||||
|
||||
- **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see **<value changed, but not displayed>** in this field. For local accounts, this field is not applicable and always has “<value not set>“ value.
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -111,7 +111,7 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
|
||||
-|-
|
||||
Common URLs for all locations | ```crl.microsoft.com```<br> ```ctldl.windowsupdate.com``` <br>```events.data.microsoft.com```<br>```notify.windows.com```<br> ```settings-win.data.microsoft.com```
|
||||
European Union | ```eu.vortex-win.data.microsoft.com``` <br> ```eu-v20.events.data.microsoft.com``` <br> ```usseu1northprod.blob.core.windows.net``` <br>```usseu1westprod.blob.core.windows.net``` <br> ```winatp-gw-neu.microsoft.com``` <br> ```winatp-gw-weu.microsoft.com``` <br>```wseu1northprod.blob.core.windows.net``` <br>```wseu1westprod.blob.core.windows.net```
|
||||
United Kingdom | ```uk.vortex-win.data.microsoft.com``` <br>```uk-v20.events.data.microsoft.com``` <br>```ussuk1southprod. blob.core.windows.net``` <br>```ussuk1westprod. blob.core.windows.net``` <br>```winatp-gw-uks.microsoft.com``` <br>```winatp-gw-ukw.microsoft.com``` <br>```wsuk1southprod. blob.core.windows.net``` <br>```wsuk1westprod. blob.core.windows.net```
|
||||
United Kingdom | ```uk.vortex-win.data.microsoft.com``` <br>```uk-v20.events.data.microsoft.com``` <br>```ussuk1southprod.blob.core.windows.net``` <br>```ussuk1westprod.blob.core.windows.net``` <br>```winatp-gw-uks.microsoft.com``` <br>```winatp-gw-ukw.microsoft.com``` <br>```wsuk1southprod.blob.core.windows.net``` <br>```wsuk1westprod.blob.core.windows.net```
|
||||
United States | ```us.vortex-win.data.microsoft.com``` <br> ```ussus1eastprod.blob.core.windows.net``` <br> ```ussus1westprod.blob.core.windows.net``` <br> ```ussus2eastprod.blob.core.windows.net``` <br> ```ussus2westprod.blob.core.windows.net``` <br> ```ussus3eastprod.blob.core.windows.net``` <br> ```ussus3westprod.blob.core.windows.net``` <br> ```ussus4eastprod.blob.core.windows.net``` <br> ```ussus4westprod.blob.core.windows.net``` <br> ```us-v20.events.data.microsoft.com``` <br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com``` <br> ```wsus1eastprod.blob.core.windows.net``` <br> ```wsus1westprod.blob.core.windows.net``` <br> ```wsus2eastprod.blob.core.windows.net``` <br> ```wsus2westprod.blob.core.windows.net```
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
|
||||
@ -28,7 +28,7 @@ ms.topic: article
|
||||
- Windows Server, 2019
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Microsoft Defender Security Center console.
|
||||
@ -43,6 +43,9 @@ The service supports the onboarding of the following servers:
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
> [!NOTE]
|
||||
> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services)
|
||||
|
||||
## Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP:
|
||||
@ -70,19 +73,19 @@ You'll need to take the following steps if you choose to onboard servers through
|
||||
|
||||
- For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
>[!NOTE]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
|
||||
> [!NOTE]
|
||||
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Microsoft Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> [!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
>[!IMPORTANT]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
> [!IMPORTANT]
|
||||
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
@ -138,8 +141,8 @@ Agent Resource | Ports
|
||||
## Windows Server, version 1803 and Windows Server 2019
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, please refer to the supported methods and versions below.
|
||||
|
||||
>[!NOTE]
|
||||
>The Onboarding package for Windows Server 2019 through System Center Configuration Manager currently ships a script. For more information on how to deploy scripts in System Center Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs).
|
||||
> [!NOTE]
|
||||
> The Onboarding package for Windows Server 2019 through System Center Configuration Manager currently ships a script. For more information on how to deploy scripts in System Center Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs).
|
||||
|
||||
Supported tools include:
|
||||
- Local script
|
||||
@ -178,21 +181,18 @@ Support for Windows Server, version 1803 and Windows 2019 provides deeper insigh
|
||||
## Integration with Azure Security Center
|
||||
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
>[!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
> [!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
>- If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
> [!IMPORTANT]
|
||||
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
> - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
|
||||
|
||||
|
||||
@ -203,8 +203,8 @@ For other server versions, you have two options to offboard servers from the ser
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Microsoft Defender ATP workspace configuration
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
> [!NOTE]
|
||||
> Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
### Uninstall servers by uninstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP.
|
||||
|
||||
@ -53,6 +53,9 @@ When you have configured exploit protection to your desired state (including bot
|
||||
|
||||
3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file.
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -46,7 +46,7 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender
|
||||
|
||||
After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints.
|
||||
|
||||
As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net").
|
||||
As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). Below mention URLs are using port 443 for communication.
|
||||
|
||||
|
||||
| **Service**| **Description** |**URL** |
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user