From 8e9bd5cbf138c9eae82480c9c5c132ec970ba1ea Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 1 Jun 2023 14:23:13 -0400 Subject: [PATCH 01/30] Move appropriate articles under OS system security --- windows/security/index.yml | 6 +- .../bitlocker/bitlocker-countermeasures.md | 18 +- windows/security/introduction/index.md | 4 +- .../vpn/vpn-conditional-access.md | 11 +- .../operating-system.md | 29 +- .../cryptography-certificate-mgmt.md | 13 +- .../dn168167.boot_process(en-us,MSDN.10).png | Bin .../dn168167.measure_boot(en-us,MSDN.10).png | Bin .../images/hva-fig1-endtoend1.png | Bin .../hva-fig10-conditionalaccesscontrol.png | Bin .../images/hva-fig11-office365.png | Bin .../images/hva-fig12-conditionalaccess12.png | Bin .../images/hva-fig2-assessfromcloud2.png | Bin .../images/hva-fig3-endtoendoverview3.png | Bin .../images/hva-fig4-hardware.png | Bin .../images/hva-fig5-virtualbasedsecurity.png | Bin .../system-security}/images/hva-fig6-logs.png | Bin .../images/hva-fig7-measurement.png | Bin .../images/hva-fig8-evaldevicehealth8.png | Bin .../images/hva-fig8a-healthattest8a.png | Bin .../images/hva-fig9-intune.png | Bin ...-the-health-of-windows-10-based-devices.md | 283 +++++++++--------- .../secure-the-windows-10-boot-process.md | 31 +- .../system-security/toc.yml | 26 +- .../system-security}/trusted-boot.md | 6 +- .../images/security-center-custom-flyout.png | Bin .../images/security-center-home.png | Bin .../images/security-center-start-menu.png | Bin .../images/security-center-taskbar.png | Bin ...windows-defender-security-center-areas.PNG | Bin .../images/wdsc-all-hide.png | Bin .../wdsc-account-protection.md | 44 +++ .../wdsc-app-browser-control.md | 15 +- .../wdsc-customize-contact-information.md | 12 +- .../wdsc-device-performance-health.md | 41 +-- .../wdsc-device-security.md | 61 ++++ .../wdsc-family-options.md | 42 +++ .../wdsc-firewall-network-protection.md | 38 +++ .../wdsc-hide-notifications.md | 54 ++-- .../wdsc-virus-threat-protection.md | 69 ++--- .../windows-defender-security-center.md | 24 +- .../wdsc-account-protection.md | 51 ---- .../wdsc-device-security.md | 73 ----- .../wdsc-family-options.md | 50 ---- .../wdsc-firewall-network-protection.md | 49 --- .../zero-trust-windows-device-health.md | 10 +- 46 files changed, 478 insertions(+), 582 deletions(-) rename windows/security/{ => operating-system-security}/operating-system.md (89%) rename windows/security/{ => operating-system-security/system-security}/cryptography-certificate-mgmt.md (95%) rename windows/security/{information-protection => operating-system-security/system-security}/images/dn168167.boot_process(en-us,MSDN.10).png (100%) rename windows/security/{information-protection => operating-system-security/system-security}/images/dn168167.measure_boot(en-us,MSDN.10).png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig1-endtoend1.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig10-conditionalaccesscontrol.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig11-office365.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig12-conditionalaccess12.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig2-assessfromcloud2.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig3-endtoendoverview3.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig4-hardware.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig5-virtualbasedsecurity.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig6-logs.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig7-measurement.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig8-evaldevicehealth8.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig8a-healthattest8a.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/images/hva-fig9-intune.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md (80%) rename windows/security/{information-protection => operating-system-security/system-security}/secure-the-windows-10-boot-process.md (93%) rename windows/security/{ => operating-system-security/system-security}/trusted-boot.md (92%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/images/security-center-custom-flyout.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/images/security-center-home.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/images/security-center-start-menu.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/images/security-center-taskbar.png (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG (100%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/images/wdsc-all-hide.png (100%) create mode 100644 windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/wdsc-app-browser-control.md (93%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/wdsc-customize-contact-information.md (94%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/wdsc-device-performance-health.md (58%) create mode 100644 windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md create mode 100644 windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md create mode 100644 windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/wdsc-hide-notifications.md (81%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/wdsc-virus-threat-protection.md (53%) rename windows/security/{threat-protection => operating-system-security/system-security}/windows-defender-security-center/windows-defender-security-center.md (92%) delete mode 100644 windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md delete mode 100644 windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md delete mode 100644 windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md delete mode 100644 windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md diff --git a/windows/security/index.yml b/windows/security/index.yml index 8cf4624659..b21e641eed 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -60,8 +60,8 @@ landingContent: url: operating-system.md - linkListType: concept links: - - text: System security - url: trusted-boot.md + - text: Trusted boot + url: operating-system-security\system-security\trusted-boot.md - text: Encryption and data protection url: encryption-data-protection.md - text: Windows security baselines @@ -136,7 +136,7 @@ landingContent: - text: OneDrive url: /onedrive/onedrive - text: Family safety - url: threat-protection/windows-defender-security-center/wdsc-family-options.md + url: operating-system-security\system-security\windows-defender-security-center\wdsc-family-options.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index df0af1d002..060ee58614 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -1,7 +1,7 @@ --- -title: BitLocker Countermeasures +title: BitLocker Countermeasures description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Anti-malware (ELAM) to protect against attacks on the BitLocker encryption key. -ms.reviewer: +ms.reviewer: ms.prod: windows-client ms.localizationpriority: medium author: frankroj @@ -45,7 +45,7 @@ A trusted platform module (TPM) is a microchip designed to provide basic securit Unified Extensible Firmware Interface (UEFI) is a programmable boot environment that initializes devices and starts the operating system's bootloader. -The UEFI specification defines a firmware execution authentication process called [Secure Boot](../secure-the-windows-10-boot-process.md). Secure Boot blocks untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system. +The UEFI specification defines a firmware execution authentication process called [Secure Boot](/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md). Secure Boot blocks untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system. By default, BitLocker provides integrity protection for Secure Boot by utilizing the TPM PCR[7] measurement. An unauthorized EFI firmware, EFI boot application, or bootloader can't run and acquire the BitLocker key. @@ -70,11 +70,11 @@ Pre-boot authentication is designed to prevent the encryption keys from being lo On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways: -- **TPM-only.** Using TPM-only validation doesn't require any interaction with the user to unlock and provide access to the drive. If the TPM validation succeeds, the user sign-in experience is the same as a standard sign-in. If the TPM is missing or changed or if BitLocker detects changes to the BIOS or UEFI code or configuration, critical operating system startup files, or the boot configuration, BitLocker enters recovery mode, and the user must enter a recovery password to regain access to the data. This option is more convenient for sign-in but less secure than the other options, which require an additional authentication factor. +- **TPM-only.** Using TPM-only validation doesn't require any interaction with the user to unlock and provide access to the drive. If the TPM validation succeeds, the user sign-in experience is the same as a standard sign-in. If the TPM is missing or changed or if BitLocker detects changes to the BIOS or UEFI code or configuration, critical operating system startup files, or the boot configuration, BitLocker enters recovery mode, and the user must enter a recovery password to regain access to the data. This option is more convenient for sign-in but less secure than the other options, which require an additional authentication factor. - **TPM with startup key.** In addition to the protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume can't be accessed without the startup key. -- **TPM with PIN.** In addition to the protection that the TPM provides, BitLocker requires that the user enters a PIN. Data on the encrypted volume can't be accessed without entering the PIN. TPMs also have [anti-hammering protection](/windows/security/hardware-protection/tpm/tpm-fundamentals#anti-hammering) that is designed to prevent brute force attacks that attempt to determine the PIN. +- **TPM with PIN.** In addition to the protection that the TPM provides, BitLocker requires that the user enters a PIN. Data on the encrypted volume can't be accessed without entering the PIN. TPMs also have [anti-hammering protection](/windows/security/hardware-protection/tpm/tpm-fundamentals#anti-hammering) that is designed to prevent brute force attacks that attempt to determine the PIN. - **TPM with startup key and PIN.** In addition to the core component protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it can't be used for access to the drive, because the correct PIN is also required. @@ -86,11 +86,11 @@ Pre-boot authentication with a PIN can mitigate an attack vector for devices tha On the other hand, Pre-boot authentication-prompts can be inconvenient to users. In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization's support team to obtain a recovery key. Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN needs to be entered when a computer reboots or resumes from hibernation. -To address these issues, [BitLocker Network Unlock](./bitlocker-how-to-enable-network-unlock.md) can be deployed. Network Unlock allows systems within the physical enterprise security perimeter that meet the hardware requirements and have BitLocker enabled with TPM+PIN to boot into Windows without user intervention. It requires direct ethernet connectivity to an enterprise Windows Deployment Services (WDS) server. +To address these issues, [BitLocker Network Unlock](./bitlocker-how-to-enable-network-unlock.md) can be deployed. Network Unlock allows systems within the physical enterprise security perimeter that meet the hardware requirements and have BitLocker enabled with TPM+PIN to boot into Windows without user intervention. It requires direct ethernet connectivity to an enterprise Windows Deployment Services (WDS) server. ### Protecting Thunderbolt and other DMA ports -There are a few different options to protect DMA ports, such as Thunderbolt™3. Beginning with Windows 10 version 1803, new Intel-based devices have kernel protection against DMA attacks via Thunderbolt™ 3 ports enabled by default. This Kernel DMA Protection is available only for new systems beginning with Windows 10 version 1803, as it requires changes in the system firmware and/or BIOS. +There are a few different options to protect DMA ports, such as Thunderbolt™3. Beginning with Windows 10 version 1803, new Intel-based devices have kernel protection against DMA attacks via Thunderbolt™ 3 ports enabled by default. This Kernel DMA Protection is available only for new systems beginning with Windows 10 version 1803, as it requires changes in the system firmware and/or BIOS. You can use the System Information desktop app `MSINFO32.exe` to check if a device has kernel DMA protection enabled: @@ -112,7 +112,7 @@ For Thunderbolt v1 and v2 (DisplayPort Connector), refer to the **Thunderbolt Mi ## Attack countermeasures -This section covers countermeasures for specific types of attacks. +This section covers countermeasures for specific types of attacks. ### Bootkits and rootkits @@ -142,7 +142,7 @@ Enable secure boot and mandatorily prompt a password to change BIOS settings. Fo ### Tricking BitLocker to pass the key to a rogue operating system An attacker might modify the boot manager configuration database (BCD) which is stored on a non-encrypted partition and add an entry point to a rogue operating system on a different partition. During the boot process, BitLocker code will make sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, we don't recommend storing a hash of a disk partition table in Platform Configuration Register (PCR) 5. - + An attacker might also replace the entire operating system disk while preserving the platform hardware and firmware and could then extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This will not succeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0, and to successfully unseal the blob, PCR 11 in the TPM must have a value of 0. However, when the boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR 11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the BitLocker key. ## Attacker countermeasures diff --git a/windows/security/introduction/index.md b/windows/security/introduction/index.md index f051acac9f..10953d2fbe 100644 --- a/windows/security/introduction/index.md +++ b/windows/security/introduction/index.md @@ -34,7 +34,7 @@ Windows 11 is a natural evolution of its predecessor, Windows 10. We have collab With hardware-based isolation security that begins at the chip, Windows 11 stores sensitive data behind other barriers separated from the operating system. As a result, information including encryption keys and user credentials are protected from unauthorized access and tampering. -In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](../trusted-boot.md) built-in and enabled by default to contain and limit malware exploits. +In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](/windows/security/operating-system-security/system-security/trusted-boot.md) built-in and enabled by default to contain and limit malware exploits. ### Robust application security and privacy controls @@ -54,4 +54,4 @@ Microsoft offers comprehensive cloud services for identity, storage, and access To learn more about the security features included in Windows 11, download the [Windows 11 Security Book: Powerful security from chip to cloud](https://aka.ms/Windows11SecurityBook). -[!INCLUDE [ai-disclaimer-generic](../../../includes/ai-disclaimer-generic.md)] \ No newline at end of file +[!INCLUDE [ai-disclaimer-generic](../../../includes/ai-disclaimer-generic.md)] diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md index 3dca76e27e..85ac1b4e02 100644 --- a/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md +++ b/windows/security/operating-system-security/network-security/vpn/vpn-conditional-access.md @@ -7,7 +7,7 @@ ms.topic: conceptual # VPN and conditional access -The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. +The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. >[!NOTE] >Conditional Access is an Azure AD Premium feature. @@ -16,8 +16,8 @@ Conditional Access Platform components used for Device Compliance include the fo - [Conditional Access Framework](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn) - [Azure AD Connect Health](/azure/active-directory/connect-health/active-directory-aadconnect-health) -- [Windows Health Attestation Service](../../../threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md#device-health-attestation) (optional) -- Azure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). An Azure AD CA is essentially a mini-CA cloud tenant in Azure. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA. +- [Windows Health Attestation Service](../../system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) (optional) +- Azure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). An Azure AD CA is essentially a mini-CA cloud tenant in Azure. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA. See also [Always On VPN deployment for Windows Server and Windows 10](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy). - Azure AD-issued short-lived certificates - When a VPN connection attempt is made, the Azure AD Token Broker on the local device communicates with Azure Active Directory, which then checks for health based on compliance rules. If compliant, Azure AD sends back a short-lived certificate that is used to authenticate the VPN. Note that certificate authentication methods such as EAP-TLS can be used. When the client reconnects and determines that the certificate has expired, the client will again check with Azure AD for health validation before a new certificate is issued. - [Microsoft Intune device compliance policies](/mem/intune/protect/device-compliance-get-started) - Cloud-based device compliance leverages Microsoft Intune Compliance Policies, which are capable of querying the device state and define compliance rules for the following, among other things. @@ -79,19 +79,20 @@ When a VPNv2 Profile is configured with \ \true<\/Ena ## Configure conditional access -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration. +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration. ## Learn more about Conditional Access and Azure AD Health - [Azure Active Directory conditional access](/azure/active-directory/conditional-access/overview) - [Getting started with Azure Active Directory Conditional Access](/azure/active-directory/authentication/tutorial-enable-azure-mfa) -- [Control the health of Windows devices](../../../threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) +- [Control the health of Windows devices](../../system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) - [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 1)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn) - [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2) - [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3) - [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4) ## Related topics + - [VPN technical guide](vpn-guide.md) - [VPN connection types](vpn-connection-type.md) - [VPN routing decisions](vpn-routing.md) diff --git a/windows/security/operating-system.md b/windows/security/operating-system-security/operating-system.md similarity index 89% rename from windows/security/operating-system.md rename to windows/security/operating-system-security/operating-system.md index d5a1753a2a..663d8c4d0c 100644 --- a/windows/security/operating-system.md +++ b/windows/security/operating-system-security/operating-system.md @@ -1,7 +1,7 @@ --- title: Windows operating system security description: Securing the operating system includes system security, encryption, network security, and threat protection. -ms.reviewer: +ms.reviewer: ms.topic: article manager: aaroncz ms.author: paoloma @@ -21,21 +21,20 @@ Use the links in the following table to learn more about the operating system se | Security Measures | Features & Capabilities | |:---|:---| -| Secure Boot and Trusted Boot | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows system boots up safely and securely.

Learn more [Secure Boot and Trusted Boot](trusted-boot.md). | -Cryptography and certificate management|Cryptography uses code to convert data so that only a specific recipient can read it by using a key. Cryptography enforces privacy to prevent anyone except the intended recipient from reading data, integrity to ensure data is free of tampering, and authentication that verifies identity to ensure that communication is secure.

Learn more about [Cryptography and certificate management](cryptography-certificate-mgmt.md).

| -Windows Security app | The Windows built-in security application found in settings provides an at-a-glance view of the security status and health of your device. These insights help you identify issues and take action to make sure you're protected. You can quickly see the status of your virus and threat protection, firewall and network security, device security controls, and more.

Learn more about the [Windows Security app](threat-protection/windows-defender-security-center/windows-defender-security-center.md).| -| Encryption and data protection | Wherever confidential data is stored, it must be protected against unauthorized access, whether through physical device theft or from malicious applications. Windows provides strong at-rest data-protection solutions that guard against nefarious attackers.

Learn more about [Encryption](encryption-data-protection.md). -| BitLocker | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later.

Learn more about [BitLocker](information-protection/bitlocker/bitlocker-overview.md). | -| Encrypted Hard Drive | Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.
By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity.

Learn more about [Encrypted Hard Drives](information-protection/encrypted-hard-drive.md).| -| S/MIME | S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with.

Learn more about [S/MIME for Windows](operating-system-security/data-protection/configure-s-mime.md).| -| Security baselines | A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.

Security baselines are included in the [Security Compliance Toolkit](threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md) that you can download from the Microsoft Download Center.

Learn more about [security baselines](threat-protection/windows-security-configuration-framework/windows-security-baselines.md). | -| Virtual Private Network | Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called tunneling protocols, to make a virtual call to a virtual port on a VPN server.

Learn more about [Virtual Private Networks](identity-protection/vpn/vpn-guide.md).

| -| Windows Defender Firewall | Windows Defender Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device.

Learn more about [Windows Defender Firewall with advanced security](threat-protection/windows-firewall/windows-firewall-with-advanced-security.md).

-| Antivirus & antimalware protection | Microsoft Defender Antivirus is included in all versions of Windows 10, Windows Server 2016 and later, and Windows 11. If you have another antivirus app installed and turned on, Microsoft Defender Antivirus will turn off automatically. If you uninstall the other app, Microsoft Defender Antivirus will turn back on.

From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. Updates are downloaded automatically to help protect your device from threats. Microsoft Defender Antivirus continually scans for malware and threats, and also detects and blocks [potentially unwanted applications](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (applications that can negatively impact your device even though they are not considered malware).

Microsoft Defender Antivirus integrates with [cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus), which helps ensure near-instant detection and blocking of new and emerging threats.

Learn more about [next-generation protection and Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows).| +| Secure Boot and Trusted Boot | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows system boots up safely and securely.

Learn more [Secure Boot and Trusted Boot](system-security/trusted-boot.md). | +Cryptography and certificate management|Cryptography uses code to convert data so that only a specific recipient can read it by using a key. Cryptography enforces privacy to prevent anyone except the intended recipient from reading data, integrity to ensure data is free of tampering, and authentication that verifies identity to ensure that communication is secure.

Learn more about [Cryptography and certificate management](system-security/cryptography-certificate-mgmt.md).

| +Windows Security app | The Windows built-in security application found in settings provides an at-a-glance view of the security status and health of your device. These insights help you identify issues and take action to make sure you're protected. You can quickly see the status of your virus and threat protection, firewall and network security, device security controls, and more.

Learn more about the [Windows Security app](system-security/windows-defender-security-center/windows-defender-security-center.md).| +| Encryption and data protection | Wherever confidential data is stored, it must be protected against unauthorized access, whether through physical device theft or from malicious applications. Windows provides strong at-rest data-protection solutions that guard against nefarious attackers.

Learn more about [Encryption](../encryption-data-protection.md). +| BitLocker | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later.

Learn more about [BitLocker](../information-protection/bitlocker/bitlocker-overview.md). | +| Encrypted Hard Drive | Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.
By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity.

Learn more about [Encrypted Hard Drives](../information-protection/encrypted-hard-drive.md).| +| S/MIME | S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with.

Learn more about [S/MIME for Windows](data-protection/configure-s-mime.md).| +| Security baselines | A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.

Security baselines are included in the [Security Compliance Toolkit](../threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md) that you can download from the Microsoft Download Center.

Learn more about [security baselines](../threat-protection/windows-security-configuration-framework/windows-security-baselines.md). | +| Virtual Private Network | Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called tunneling protocols, to make a virtual call to a virtual port on a VPN server.

Learn more about [Virtual Private Networks](network-security/vpn/vpn-guide.md).

| +| Windows Defender Firewall | Windows Defender Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device.

Learn more about [Windows Defender Firewall with advanced security](network-security/windows-firewall/windows-firewall-with-advanced-security.md).

+| Antivirus & antimalware protection | Microsoft Defender Antivirus is included in all versions of Windows 10, Windows Server 2016 and later, and Windows 11. If you have another antivirus app installed and turned on, Microsoft Defender Antivirus will turn off automatically. If you uninstall the other app, Microsoft Defender Antivirus will turn back on.

From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. Updates are downloaded automatically to help protect your device from threats. Microsoft Defender Antivirus continually scans for malware and threats, and also detects and blocks [potentially unwanted applications](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (applications that can negatively impact your device even though they are not considered malware).

Microsoft Defender Antivirus integrates with [cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus), which helps ensure near-instant detection and blocking of new and emerging threats.

Learn more about [next-generation protection and Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows).| | Attack surface reduction rules | Your attack surfaces are the places and ways you are vulnerable to a cyber attack. Attack surface reduction rules are built into Windows and Windows Server to prevent and block certain behaviors that are often abused to compromise your device or network. Such behaviors can include launching scripts or executables that attempt to download or run other files, running suspicious scripts, or performing other behaviors that apps don't typically initiate during normal work. You can configure your attack surface reduction rules to protect against these risky behaviors.

Learn more about [Attack surface reduction rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction) | -| Anti-tampering protection | During cyber attacks (like ransomware attempts), bad actors attempt to disable security features, such as antivirus protection on targeted devices. Bad actors like to disable security features to get easier access to user's data, to install malware, or to otherwise exploit user's data, identity, and devices without fear of being blocked. Tamper protection helps prevent these kinds of activities.

With tamper protection, malware is prevented from taking actions such as:
- Disabling virus and threat protection
- Disabling real-time protection
- Turning off behavior monitoring
- Disabling antivirus (such as IOfficeAntivirus (IOAV))
- Disabling cloud-delivered protection
- Removing security intelligence updates

Learn more about [Tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection). | +| Anti-tampering protection | During cyber attacks (like ransomware attempts), bad actors attempt to disable security features, such as antivirus protection on targeted devices. Bad actors like to disable security features to get easier access to user's data, to install malware, or to otherwise exploit user's data, identity, and devices without fear of being blocked. Tamper protection helps prevent these kinds of activities.

With tamper protection, malware is prevented from taking actions such as:
- Disabling virus and threat protection
- Disabling real-time protection
- Turning off behavior monitoring
- Disabling antivirus (such as IOfficeAntivirus (IOAV))
- Disabling cloud-delivered protection
- Removing security intelligence updates

Learn more about [Tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection). | | Network protection | Network protection in Windows helps prevent users from accessing dangerous IP addresses and domains that may host phishing scams, exploits, and other malicious content on the Internet. Network protection is part of attack surface reduction and helps provide an extra layer of protection for a user. Using reputation-based services, network protection blocks access to potentially harmful, low-reputation based domains and IP addresses.

In enterprise environments, network protection works best with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/), which provides detailed reporting into protection events as part of larger investigation scenarios.

Learn more about [Network protection](/microsoft-365/security/defender-endpoint/network-protection). | | Controlled folder access | With controlled folder access, you can protect your valuable information in specific folders by managing apps' access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access helps protect valuable data from malicious apps and threats, such as ransomware.

Learn more about [Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). | -| Exploit protection | Exploit protection, available in Windows 10, version 1709 and later, automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios.

You can enable exploit protection on an individual device, and then use Group Policy to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors.

Learn more about [Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection). | +| Exploit protection | Exploit protection, available in Windows 10, version 1709 and later, automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios.

You can enable exploit protection on an individual device, and then use Group Policy to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors.

Learn more about [Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection). | | Microsoft Defender for Endpoint | Windows E5 customers benefit from [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint), an enterprise endpoint detection and response capability that helps enterprise security teams detect, investigate, and respond to advanced threats. With rich event data and attack insights, Defender for Endpoint enables your security team to investigate incidents and take remediation actions effectively and efficiently.

Defender for Endpoint also is part of [Microsoft 365 Defender](/microsoft-365/security/defender/), a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.

Learn more about [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) and [Microsoft 365 Defender](/microsoft-365/security/defender/). | - diff --git a/windows/security/cryptography-certificate-mgmt.md b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md similarity index 95% rename from windows/security/cryptography-certificate-mgmt.md rename to windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md index 2edd15d942..3002e2b481 100644 --- a/windows/security/cryptography-certificate-mgmt.md +++ b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md @@ -1,8 +1,8 @@ --- title: Cryptography and Certificate Management description: Get an overview of cryptography and certificate management in Windows -author: paolomatarazzo -ms.author: paoloma +author: vinaypamnani-msft +ms.author: vinpa manager: aaroncz ms.topic: conceptual ms.date: 09/07/2021 @@ -13,10 +13,9 @@ ms.reviewer: skhadeer, raverma # Cryptography and Certificate Management - ## Cryptography -Cryptography uses code to convert data so that only a specific recipient can read it by using a key. Cryptography enforces privacy to prevent anyone except the intended recipient from reading data, integrity to ensure data is free of tampering, and authentication that verifies identity to ensure that communication is secure. The cryptography stack in Windows extends from the chip to the cloud enabling Windows, applications, and services protect system and user secrets. +Cryptography uses code to convert data so that only a specific recipient can read it by using a key. Cryptography enforces privacy to prevent anyone except the intended recipient from reading data, integrity to ensure data is free of tampering, and authentication that verifies identity to ensure that communication is secure. The cryptography stack in Windows extends from the chip to the cloud enabling Windows, applications, and services protect system and user secrets. Cryptography in Windows is Federal Information Processing Standards (FIPS) 140 certified. FIPS 140 certification ensures that US government approved algorithms are being used (RSA for signing, ECDH with NIST curves for key agreement, AES for symmetric encryption, and SHA2 for hashing), tests module integrity to prove that no tampering has occurred and proves the randomness for entropy sources. @@ -28,10 +27,10 @@ Windows cryptographic modules provide low-level primitives such as: - Signing and verification (padding support for OAEP, PSS, PKCS1) - Key agreement and key derivation (support for ECDH over NIST-standard prime curves P-256, P-384, P-521, and HKDF) -These modules are natively exposed on Windows through the Crypto API (CAPI) and the Cryptography Next Generation API (CNG) which is powered by Microsoft's open-source cryptographic library SymCrypt. Application developers can use these APIs to perform low-level cryptographic operations (BCrypt), key storage operations (NCrypt), protect static data (DPAPI), and securely share secrets (DPAPI-NG). +These modules are natively exposed on Windows through the Crypto API (CAPI) and the Cryptography Next Generation API (CNG) which is powered by Microsoft's open-source cryptographic library SymCrypt. Application developers can use these APIs to perform low-level cryptographic operations (BCrypt), key storage operations (NCrypt), protect static data (DPAPI), and securely share secrets (DPAPI-NG). ## Certificate management -Windows offers several APIs to operate and manage certificates. Certificates are crucial to public key infrastructure (PKI) as they provide the means for safeguarding and authenticating information. Certificates are electronic documents used to claim ownership of a public key. Public keys are used to prove server and client identity, validate code integrity, and used in secure emails. Windows offers users the ability to auto-enroll and renew certificates in Active Directory with Group Policy to reduce the risk of potential outages due to certificate expiration or misconfiguration. Windows validates certificates through an automatic update mechanism that downloads certificate trust lists (CTL) daily. Trusted root certificates are used by applications as a reference for trustworthy PKI hierarchies and digital certificates. The list of trusted and untrusted certificates are stored in the CTL and can be updated by administrators. In the case of certificate revocation, a certificate is added as an untrusted certificate in the CTL causing it to be revoked globally across user devices immediately. +Windows offers several APIs to operate and manage certificates. Certificates are crucial to public key infrastructure (PKI) as they provide the means for safeguarding and authenticating information. Certificates are electronic documents used to claim ownership of a public key. Public keys are used to prove server and client identity, validate code integrity, and used in secure emails. Windows offers users the ability to auto-enroll and renew certificates in Active Directory with Group Policy to reduce the risk of potential outages due to certificate expiration or misconfiguration. Windows validates certificates through an automatic update mechanism that downloads certificate trust lists (CTL) daily. Trusted root certificates are used by applications as a reference for trustworthy PKI hierarchies and digital certificates. The list of trusted and untrusted certificates are stored in the CTL and can be updated by administrators. In the case of certificate revocation, a certificate is added as an untrusted certificate in the CTL causing it to be revoked globally across user devices immediately. -Windows also offers enterprise certificate pinning to help reduce man-in-the-middle attacks by enabling users to protect their internal domain names from chaining to unwanted certificates. A web application's server authentication certificate chain is checked to ensure it matches a restricted set of certificates. Any web application triggering a name mismatch will start event logging and prevent user access from Edge or Internet Explorer. +Windows also offers enterprise certificate pinning to help reduce man-in-the-middle attacks by enabling users to protect their internal domain names from chaining to unwanted certificates. A web application's server authentication certificate chain is checked to ensure it matches a restricted set of certificates. Any web application triggering a name mismatch will start event logging and prevent user access from Edge or Internet Explorer. diff --git a/windows/security/information-protection/images/dn168167.boot_process(en-us,MSDN.10).png b/windows/security/operating-system-security/system-security/images/dn168167.boot_process(en-us,MSDN.10).png similarity index 100% rename from windows/security/information-protection/images/dn168167.boot_process(en-us,MSDN.10).png rename to windows/security/operating-system-security/system-security/images/dn168167.boot_process(en-us,MSDN.10).png diff --git a/windows/security/information-protection/images/dn168167.measure_boot(en-us,MSDN.10).png b/windows/security/operating-system-security/system-security/images/dn168167.measure_boot(en-us,MSDN.10).png similarity index 100% rename from windows/security/information-protection/images/dn168167.measure_boot(en-us,MSDN.10).png rename to windows/security/operating-system-security/system-security/images/dn168167.measure_boot(en-us,MSDN.10).png diff --git a/windows/security/threat-protection/images/hva-fig1-endtoend1.png b/windows/security/operating-system-security/system-security/images/hva-fig1-endtoend1.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig1-endtoend1.png rename to windows/security/operating-system-security/system-security/images/hva-fig1-endtoend1.png diff --git a/windows/security/threat-protection/images/hva-fig10-conditionalaccesscontrol.png b/windows/security/operating-system-security/system-security/images/hva-fig10-conditionalaccesscontrol.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig10-conditionalaccesscontrol.png rename to windows/security/operating-system-security/system-security/images/hva-fig10-conditionalaccesscontrol.png diff --git a/windows/security/threat-protection/images/hva-fig11-office365.png b/windows/security/operating-system-security/system-security/images/hva-fig11-office365.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig11-office365.png rename to windows/security/operating-system-security/system-security/images/hva-fig11-office365.png diff --git a/windows/security/threat-protection/images/hva-fig12-conditionalaccess12.png b/windows/security/operating-system-security/system-security/images/hva-fig12-conditionalaccess12.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig12-conditionalaccess12.png rename to windows/security/operating-system-security/system-security/images/hva-fig12-conditionalaccess12.png diff --git a/windows/security/threat-protection/images/hva-fig2-assessfromcloud2.png b/windows/security/operating-system-security/system-security/images/hva-fig2-assessfromcloud2.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig2-assessfromcloud2.png rename to windows/security/operating-system-security/system-security/images/hva-fig2-assessfromcloud2.png diff --git a/windows/security/threat-protection/images/hva-fig3-endtoendoverview3.png b/windows/security/operating-system-security/system-security/images/hva-fig3-endtoendoverview3.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig3-endtoendoverview3.png rename to windows/security/operating-system-security/system-security/images/hva-fig3-endtoendoverview3.png diff --git a/windows/security/threat-protection/images/hva-fig4-hardware.png b/windows/security/operating-system-security/system-security/images/hva-fig4-hardware.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig4-hardware.png rename to windows/security/operating-system-security/system-security/images/hva-fig4-hardware.png diff --git a/windows/security/threat-protection/images/hva-fig5-virtualbasedsecurity.png b/windows/security/operating-system-security/system-security/images/hva-fig5-virtualbasedsecurity.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig5-virtualbasedsecurity.png rename to windows/security/operating-system-security/system-security/images/hva-fig5-virtualbasedsecurity.png diff --git a/windows/security/threat-protection/images/hva-fig6-logs.png b/windows/security/operating-system-security/system-security/images/hva-fig6-logs.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig6-logs.png rename to windows/security/operating-system-security/system-security/images/hva-fig6-logs.png diff --git a/windows/security/threat-protection/images/hva-fig7-measurement.png b/windows/security/operating-system-security/system-security/images/hva-fig7-measurement.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig7-measurement.png rename to windows/security/operating-system-security/system-security/images/hva-fig7-measurement.png diff --git a/windows/security/threat-protection/images/hva-fig8-evaldevicehealth8.png b/windows/security/operating-system-security/system-security/images/hva-fig8-evaldevicehealth8.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig8-evaldevicehealth8.png rename to windows/security/operating-system-security/system-security/images/hva-fig8-evaldevicehealth8.png diff --git a/windows/security/threat-protection/images/hva-fig8a-healthattest8a.png b/windows/security/operating-system-security/system-security/images/hva-fig8a-healthattest8a.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig8a-healthattest8a.png rename to windows/security/operating-system-security/system-security/images/hva-fig8a-healthattest8a.png diff --git a/windows/security/threat-protection/images/hva-fig9-intune.png b/windows/security/operating-system-security/system-security/images/hva-fig9-intune.png similarity index 100% rename from windows/security/threat-protection/images/hva-fig9-intune.png rename to windows/security/operating-system-security/system-security/images/hva-fig9-intune.png diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md similarity index 80% rename from windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md rename to windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index dba7799e88..8e947b0cad 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -5,18 +5,17 @@ ms.prod: windows-client ms.date: 10/13/2017 ms.localizationpriority: medium ms.technology: itpro-security -author: aczechowski -ms.author: aaroncz -manager: dougeby +author: vinaypamnani-msft +ms.author: vinpa +manager: aaroncz ms.topic: conceptual +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Control the health of Windows devices -**Applies to** - -- Windows 10 - This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows devices. ## Introduction @@ -77,13 +76,13 @@ Access to content is then authorized to the appropriate level of trust for whate Depending on the requirements and the sensitivity of the managed asset, device health status can be combined with user identity information when processing an access request. Access to content is then authorized to the appropriate level of trust. The Conditional Access engine may be structured to allow more verification as needed by the sensitivity of the managed asset. For example, if access to high-value data is requested, further security authentication may need to be established by querying the user to answer a phone call before access is granted. -### Microsoft's security investments in Windows 10 +### Microsoft's security investments in Windows 10 In Windows 10, there are three pillars of investments: -- **Secure identities.** Microsoft is part of the FIDO alliance that aims to provide an interoperable method of secure authentication by moving away from the use of passwords for authentication, both on the local system and for services like on-premises resources and cloud resources. -- **Information protection.** Microsoft is making investments to allow organizations to have better control over who has access to important data and what they can do with that data. With Windows 10, organizations can take advantage of policies that specify which applications are considered to be corporate applications and can be trusted to access secure data. -- **Threat resistance.** Microsoft is helping organizations to better secure enterprise assets against the threats of malware and attacks by using security defenses relying on hardware. +- **Secure identities.** Microsoft is part of the FIDO alliance that aims to provide an interoperable method of secure authentication by moving away from the use of passwords for authentication, both on the local system and for services like on-premises resources and cloud resources. +- **Information protection.** Microsoft is making investments to allow organizations to have better control over who has access to important data and what they can do with that data. With Windows 10, organizations can take advantage of policies that specify which applications are considered to be corporate applications and can be trusted to access secure data. +- **Threat resistance.** Microsoft is helping organizations to better secure enterprise assets against the threats of malware and attacks by using security defenses relying on hardware. ### Protect, control, and report on the security status of Windows 10-based devices @@ -108,43 +107,43 @@ This section describes what Windows 10 offers in terms of security defenses and ### Windows 10 hardware-based security defenses The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. -Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-req) section. +Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-requirements) section. :::image type="content" alt-text="figure 4." source="images/hva-fig4-hardware.png"::: Windows 10 supports features to help prevent sophisticated low-level malware like rootkits and bootkits from loading during the startup process: -- **Trusted Platform Module.** A Trusted Platform Module (TPM) is a hardware component that provides unique security features. +- **Trusted Platform Module.** A Trusted Platform Module (TPM) is a hardware component that provides unique security features. - Windows 10 uses security characteristics of a TPM for measuring boot integrity sequence (and based on that, unlocking automatically BitLocker protected drives), for protecting credentials or for health attestation. + Windows 10 uses security characteristics of a TPM for measuring boot integrity sequence (and based on that, unlocking automatically BitLocker protected drives), for protecting credentials or for health attestation. - A TPM implements controls that meet the specification described by the Trusted Computing Group (TCG). At the time of this writing, there are two versions of TPM specification produced by TCG that aren't compatible with each other: + A TPM implements controls that meet the specification described by the Trusted Computing Group (TCG). At the time of this writing, there are two versions of TPM specification produced by TCG that aren't compatible with each other: - - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. + - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. + - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. - Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](/windows-hardware/design/minimum/minimum-hardware-requirements-overview). + Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](/windows-hardware/design/minimum/minimum-hardware-requirements-overview). - Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. + Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. - TPM 2.0 provides a major revision to the capabilities over TPM 1.2: + TPM 2.0 provides a major revision to the capabilities over TPM 1.2: - - Update crypto strength to meet modern security needs + - Update crypto strength to meet modern security needs - - Support for SHA-256 for PCRs - - Support for HMAC command + - Support for SHA-256 for PCRs + - Support for HMAC command - - Cryptographic algorithms flexibility to support government needs + - Cryptographic algorithms flexibility to support government needs - - TPM 1.2 is severely restricted in terms of what algorithms it can support - - TPM 2.0 can support arbitrary algorithms with minor updates to the TCG specification documents + - TPM 1.2 is severely restricted in terms of what algorithms it can support + - TPM 2.0 can support arbitrary algorithms with minor updates to the TCG specification documents - - Consistency across implementations + - Consistency across implementations - - The TPM 1.2 specification allows vendors wide latitude when choosing implementation details - - TPM 2.0 standardizes much of this behavior + - The TPM 1.2 specification allows vendors wide latitude when choosing implementation details + - TPM 2.0 standardizes much of this behavior -- **Secure Boot.** Devices with UEFI firmware can be configured to load only trusted operating system bootloaders. Secure Boot doesn't require a TPM. +- **Secure Boot.** Devices with UEFI firmware can be configured to load only trusted operating system bootloaders. Secure Boot doesn't require a TPM. The most basic protection is the Secure Boot feature, which is a standard part of the UEFI 2.2+ architecture. On a PC with conventional BIOS, anyone who can take control of the boot process can boot by using an alternative OS loader, and potentially gain access to system resources. When Secure Boot is enabled, you can boot using only an OS loader that's signed using a certificate stored in the UEFI Secure Boot DB. Naturally, the Microsoft certificate used to digitally sign the Windows 10 OS loaders are in that store, which allows UEFI to validate the certificate as part of its security policy. Secure Boot must be enabled by default on all computers that are certified for Windows 10 under the Windows Hardware Compatibility Program. @@ -154,7 +153,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik > [!NOTE] > Secure Boot protects the platform until the Windows kernel is loaded. Then protections like ELAM take over. -- **Secure Boot configuration policy.** Extends Secure Boot functionality to critical Windows 10 configuration. +- **Secure Boot configuration policy.** Extends Secure Boot functionality to critical Windows 10 configuration. Examples of protected configuration information include protecting Disable Execute bit (NX option) or ensuring that the test signing policy (code integrity) can't be enabled. This protective action ensures that the binaries and configuration of the computer can be trusted after the boot process has completed. Secure Boot configuration policy does this protective action with UEFI policy. These signatures for these policies are signed in the same way that operating system binaries are signed for use with Secure Boot. @@ -163,7 +162,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and the ELAM component. This step is important and protects the rest of the boot process by verifying that all Windows boot components have integrity and can be trusted. -- **Early Launch Antimalware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading. +- **Early Launch Antimalware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading. Traditional antimalware apps don't start until after the boot drivers have been loaded, which gives a rootkit that is disguised as a driver the opportunity to work. ELAM is a Windows mechanism introduced in a previous version of Windows that allows antimalware software to run early in the boot sequence. Thus, the antimalware component is the first third-party component to run and control the initialization of other boot drivers until the Windows operating system is operational. When the system is started with a complete runtime environment (network access, storage, and so on), then a full-featured antimalware is loaded. @@ -175,11 +174,12 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik The ELAM signed driver is loaded before any other third-party drivers or applications, which allows the antimalware software to detect and block any attempts to tamper with the boot process by trying to load unsigned or untrusted code. The ELAM driver is a small driver with a small policy database that has a narrow scope, focused on drivers that are loaded early at system launch. The policy database is stored in a registry hive that is also measured to the TPM, to record the operational parameters of the ELAM driver. An ELAM driver must be signed by Microsoft and the associated certificate must contain the complementary EKU (1.3.6.1.4.1.311.61.4.1). -- **Virtualization-based security (Hyper-V + Secure Kernel).** Virtualization-based security is a new enforced security boundary that allows you to protect critical parts of Windows 10. - Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, see [Virtualization-based security](#virtual) section. +- **Virtualization-based security (Hyper-V + Secure Kernel).** Virtualization-based security is a new enforced security boundary that allows you to protect critical parts of Windows 10. -- **Hypervisor-protected Code Integrity (HVCI).** Hypervisor-protected Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run. + Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, see [Virtualization-based security](#virtualization-based-security) section. + +- **Hypervisor-protected Code Integrity (HVCI).** Hypervisor-protected Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run. When enabled and configured, Windows 10 can start the Hyper-V virtualization-based security services. HVCI helps protect the system core (kernel), privileged drivers, and system defenses, like antimalware solutions, by preventing malware from running early in the boot process, or after startup. @@ -191,13 +191,13 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik The Device Guard Code Integrity feature lets organizations control what code is trusted to run into the Windows kernel and what applications are approved to run in user mode. It's configurable by using a policy. Device Guard Code Integrity policy is a binary file that Microsoft recommends you sign. The signing of the Code Integrity policy aids in the protection against a malicious user with Administrator privileges trying to modify or remove the current Code Integrity policy. -- **Credential Guard.** Credential Guard protects corporate credentials with hardware-based credential isolation. +- **Credential Guard.** Credential Guard protects corporate credentials with hardware-based credential isolation. In Windows 10, Credential Guard aims to protect domain corporate credentials from theft and reuse by malware. With Credential Guard, Windows 10 implemented an architectural change that fundamentally prevents the current forms of the pass-the-hash (PtH) attack. This attack-free state is accomplished by using Hyper-V and the new virtualization-based security feature to create a protected container where trusted code and secrets are isolated from the Windows kernel. This accomplishment means that even if the Windows kernel is compromised, an attacker has no way to read and extract the data required to initiate a PtH attack. Credential Guard prevents this unauthorized access because the memory where secrets are stored is no longer accessible from the regular OS, even in kernel mode - the hypervisor controls who can access the memory. -- **Health attestation.** The device's firmware logs the boot process, and Windows 10 can send it to a trusted server that can check and assess the device's health. +- **Health attestation.** The device's firmware logs the boot process, and Windows 10 can send it to a trusted server that can check and assess the device's health. Windows 10 takes measurements of the UEFI firmware and each of the Windows and antimalware components are made as they load during the boot process. Additionally, they're taken and measured sequentially, not all at once. When these measurements are complete, their values are digitally signed and stored securely in the TPM and can't be changed unless the system is reset. @@ -207,7 +207,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an antimalware or an MDM vendor. Unlike Secure Boot, health attestation won't stop the boot process and enter remediation when a measurement doesn't work. But with conditional access control, health attestation will help to prevent access to high-value assets. -### Virtualization-based security +### Virtualization-based security Virtualization-based security provides a new trust boundary for Windows 10 and uses Hyper-V hypervisor technology to enhance platform security. Virtualization-based security provides a secure execution environment to run specific Windows trusted code (trustlet) and to protect sensitive data. @@ -215,14 +215,13 @@ Virtualization-based security helps to protect against a compromised kernel or a The following Windows 10 services are protected with virtualization-based security: -- **Credential Guard** (LSA Credential Isolation): prevents pass-the-hash attacks and enterprise credential theft that happens by reading and dumping the content of lsass memory -- **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. -- **Other isolated services**: for example, on Windows Server 2016, there's the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. +- **Credential Guard** (LSA Credential Isolation): prevents pass-the-hash attacks and enterprise credential theft that happens by reading and dumping the content of lsass memory +- **Device Guard** (Hyper-V Code Integrity): Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, which lets the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. +- **Other isolated services**: for example, on Windows Server 2016, there's the vTPM feature that allows you to have encrypted virtual machines (VMs) on servers. > [!NOTE] > Virtualization-based security is only available with Windows 10 Enterprise. Virtualization-based security requires devices with UEFI (2.3.1 or higher) with Secure Boot enabled, x64 processor with Virtualization Extensions and SLAT enabled. IOMMU, TPM 2.0. and support for Secure Memory overwritten are optional, but recommended. - The schema below is a high-level view of Windows 10 with virtualization-based security. :::image type="content" alt-text="figure 5." source="images/hva-fig5-virtualbasedsecurity.png"::: @@ -234,8 +233,8 @@ remote machines, which mitigates many PtH-style attacks. Credential Guard helps protect credentials by encrypting them with either a per-boot or persistent key: -- **The per-boot key** is used for any in-memory credentials that don't require persistence. An example of such a credential would be a ticket-granting ticket (TGT) session key. This key is negotiated with a Key Distribution Center (KDC) every time authentication occurs and is protected with a per-boot key. -- **The persistent key**, or some derivative, is used to help protect items that are stored and reloaded after a reboot. Such protection is intended for long-term storage, and must be protected with a consistent key. +- **The per-boot key** is used for any in-memory credentials that don't require persistence. An example of such a credential would be a ticket-granting ticket (TGT) session key. This key is negotiated with a Key Distribution Center (KDC) every time authentication occurs and is protected with a per-boot key. +- **The persistent key**, or some derivative, is used to help protect items that are stored and reloaded after a reboot. Such protection is intended for long-term storage, and must be protected with a consistent key. Credential Guard is activated by a registry key and then enabled by using a UEFI variable. This activation is done to protect against remote modifications of the configuration. The use of a UEFI variable implies that physical access is required to change the configuration. When lsass.exe detects that credential isolation is enabled, it then spawns LsaIso.exe as an isolated process, which ensures that it runs within isolated user mode. The startup of LsaIso.exe is performed before initialization of a security support provider, which ensures that the secure mode support routines are ready before any authentication begins. @@ -254,8 +253,8 @@ With Device Guard in Windows 10, organizations are now able to define their own Device Guard is a built-in feature of Windows 10 Enterprise that prevents the execution of unwanted code and applications. Device Guard can be configured using two rule actions - allow and deny: -- **Allow** limits execution of applications to an allowed list of code or trusted publisher and blocks everything else. -- **Deny** completes the allow trusted publisher approach by blocking the execution of a specific application. +- **Allow** limits execution of applications to an allowed list of code or trusted publisher and blocks everything else. +- **Deny** completes the allow trusted publisher approach by blocking the execution of a specific application. At the time of this writing, and according to Microsoft's latest research, more than 90 percent of malware is unsigned completely. So implementing a basic Device Guard policy can simply and effectively help block malware. In fact, Device Guard has the potential to go further, and can also help block signed malware. @@ -263,9 +262,9 @@ Device Guard needs to be planned and configured to be truly effective. It isn't There are three different parts that make up the Device Guard solution in Windows 10: -- The first part is a base **set of hardware security features** introduced with the previous version of Windows. TPM for hardware cryptographic operations and UEFI with modern firmware, along with Secure Boot, allows you to control what the device is running when the systems start. -- After the hardware security feature, there's the code integrity engine. In Windows 10, **Code Integrity is now fully configurable** and now resides in Isolated user mode, a part of the memory that is protected by virtualization-based security. -- The last part of Device Guard is **manageability**. Code Integrity configuration is exposed through specific Group Policy Objects, PowerShell cmdlets, and MDM configuration service providers (CSPs). +- The first part is a base **set of hardware security features** introduced with the previous version of Windows. TPM for hardware cryptographic operations and UEFI with modern firmware, along with Secure Boot, allows you to control what the device is running when the systems start. +- After the hardware security feature, there's the code integrity engine. In Windows 10, **Code Integrity is now fully configurable** and now resides in Isolated user mode, a part of the memory that is protected by virtualization-based security. +- The last part of Device Guard is **manageability**. Code Integrity configuration is exposed through specific Group Policy Objects, PowerShell cmdlets, and MDM configuration service providers (CSPs). For more information on how to deploy Device Guard in an enterprise, see the [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). @@ -325,11 +324,11 @@ Device health attestation uses the TPM to provide cryptographically strong and v For Windows 10-based devices, Microsoft introduces a new public API that will allow MDM software to access a remote attestation service called Windows Health Attestation Service. A health attestation result, in addition with other elements, can be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. -For more information on device health attestation, see the [Detect an unhealthy Windows 10-based device](#detect-unhealthy) section. +For more information on device health attestation, see the [Detect an unhealthy Windows 10-based device](#detect-an-unhealthy-windows-10-based-device) section. -[!INCLUDE [device-health-attestation-service](../../../includes/licensing/device-health-attestation-service.md)] +[!INCLUDE [device-health-attestation-service](../../../../includes/licensing/device-health-attestation-service.md)] -### Hardware requirements +### Hardware requirements The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview). @@ -343,7 +342,7 @@ The following table details the hardware requirements for both virtualization-ba This section presented information about several closely related controls in Windows 10. The multi-layer defenses and in-depth approach help to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. -## Detect an unhealthy Windows 10-based device +## Detect an unhealthy Windows 10-based device As of today, many organizations only consider devices to be compliant with company policy after they've passed various checks that show, for example, that the operating system is in the correct state, properly configured, and has security protection enabled. Unfortunately, with today's systems, this form of reporting isn't entirely reliable because malware can spoof a software statement about system health. A rootkit, or a similar low-level exploit, can report a false healthy state to traditional compliance tools. @@ -394,14 +393,14 @@ When you start a device equipped with TPM, a measurement of different components The health attestation process works as follows: -1. Hardware boot components are measured. -2. Operating system boot components are measured. -3. If Device Guard is enabled, current Device Guard policy is measured. -4. Windows kernel is measured. -5. Antivirus software is started as the first kernel mode driver. -6. Boot start drivers are measured. -7. MDM server through the MDM agent issues a health check command by using the Health Attestation CSP. -8. Boot measurements are validated by the Health Attestation Service +1. Hardware boot components are measured. +2. Operating system boot components are measured. +3. If Device Guard is enabled, current Device Guard policy is measured. +4. Windows kernel is measured. +5. Antivirus software is started as the first kernel mode driver. +6. Boot start drivers are measured. +7. MDM server through the MDM agent issues a health check command by using the Health Attestation CSP. +8. Boot measurements are validated by the Health Attestation Service > [!NOTE] > By default, the last 100 system boot logs and all associated resume logs are archived in the %SystemRoot%\\logs\\measuredboot folder. @@ -409,16 +408,16 @@ The number of retained logs may be set with the registry **REG\_DWORD** value ** The following process describes how health boot measurements are sent to the health attestation service: -1. The client (a Windows 10-based device with TPM) initiates the request with the remote device health attestation service. Because the health attestation server is expected to be a Microsoft cloud service, the URI is already pre-provisioned in the client. -2. The client then sends the TCG log, the AIK signed data (PCR values, boot counter) and the AIK certificate information. -3. The remote device heath attestation service then: +1. The client (a Windows 10-based device with TPM) initiates the request with the remote device health attestation service. Because the health attestation server is expected to be a Microsoft cloud service, the URI is already pre-provisioned in the client. +2. The client then sends the TCG log, the AIK signed data (PCR values, boot counter) and the AIK certificate information. +3. The remote device heath attestation service then: - 1. Verifies that the AIK certificate is issued by a known and trusted CA and the certificate is valid and not revoked. - 2. Verifies that the signature on the PCR quotes is correct and consistent with the TCG log value. - 3. Parses the properties in the TCG log. - 4. Issues the device health token that contains the health information, the AIK information, and the boot counter information. The health token also contains valid issuance time. The device health token is encrypted and signed, that means that the information is protected and only accessible to issuing health attestation service. + 1. Verifies that the AIK certificate is issued by a known and trusted CA and the certificate is valid and not revoked. + 2. Verifies that the signature on the PCR quotes is correct and consistent with the TCG log value. + 3. Parses the properties in the TCG log. + 4. Issues the device health token that contains the health information, the AIK information, and the boot counter information. The health token also contains valid issuance time. The device health token is encrypted and signed, that means that the information is protected and only accessible to issuing health attestation service. -4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. +4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. :::image type="content" alt-text="figure 8." source="images/hva-fig8a-healthattest8a.png"::: @@ -426,7 +425,7 @@ The following process describes how health boot measurements are sent to the hea The device health attestation solution involves different components that are TPM, Health Attestation CSP, and the Windows Health Attestation Service. Those components are described in this section. -### Trusted Platform Module +### Trusted Platform Module This section describes how PCRs (that contain system configuration data), endorsement key (EK) (that act as an identity card for TPM), SRK (that protect keys) and AIKs (that can report platform state) are used for health attestation reporting. @@ -434,11 +433,11 @@ In a simplified manner, the TPM is a passive component with limited resources. I A TPM incorporates in a single component: -- An RSA 2048-bit key generator -- A random number generator -- Nonvolatile memory for storing EK, SRK, and AIK keys -- A cryptographic engine to encrypt, decrypt, and sign -- Volatile memory for storing the PCRs and RSA keys +- An RSA 2048-bit key generator +- A random number generator +- Nonvolatile memory for storing EK, SRK, and AIK keys +- A cryptographic engine to encrypt, decrypt, and sign +- Volatile memory for storing the PCRs and RSA keys ### Endorsement key @@ -450,15 +449,15 @@ The endorsement key acts as an identity card for the TPM. For more information, The endorsement key is often accompanied by one or two digital certificates: -- One certificate is produced by the TPM manufacturer and is called the **endorsement certificate**. The endorsement certificate is used to prove the authenticity of the TPM (for example, that it's a real TPM manufactured by a specific chip maker) to local processes, applications, or cloud services. The endorsement certificate is created during manufacturing or the first time the TPM is initialized by communicating with an online service. -- The other certificate is produced by the platform builder and is called the **platform certificate** to indicate that a specific TPM is integrated with a certain device. +- One certificate is produced by the TPM manufacturer and is called the **endorsement certificate**. The endorsement certificate is used to prove the authenticity of the TPM (for example, that it's a real TPM manufactured by a specific chip maker) to local processes, applications, or cloud services. The endorsement certificate is created during manufacturing or the first time the TPM is initialized by communicating with an online service. +- The other certificate is produced by the platform builder and is called the **platform certificate** to indicate that a specific TPM is integrated with a certain device. For certain devices that use firmware-based TPM produced by Intel or Qualcomm, the endorsement certificate is created when the TPM is initialized during the OOBE of Windows 10. > [!NOTE] > Secure Boot protects the platform until the Windows kernel is loaded. Then protections like Trusted Boot, Hyper-V Code Integrity and ELAM take over. A device that uses Intel TPM or Qualcomm TPM gets a signed certificate online from the manufacturer that has created the chip and then stores the signed certificate in TPM storage. For the operation to succeed, if you are filtering Internet access from your client devices, you must authorize the following URLs: -- For Intel firmware TPM: **```https://ekop.intel.com/ekcertservice```** -- For Qualcomm firmware TPM: **```https://ekcert.spserv.microsoft.com/```** +- For Intel firmware TPM: **```https://ekop.intel.com/ekcertservice```** +- For Qualcomm firmware TPM: **```https://ekcert.spserv.microsoft.com/```** ### Attestation Identity Keys @@ -506,7 +505,7 @@ If the TPM ownership isn't known but the EK exists, the client library will prov As part of the provisioning process, Windows 10 will create an AIK with the TPM. When this operation is performed, the resulting AIK public portion is stored in the registry at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\WindowsAIKPub** > [!NOTE] -> For provisioning AIK certificates and filtering Internet access, you must authorize the following wildcard URL: https://\*.microsoftaik.azure.net +> For provisioning AIK certificates and filtering Internet access, you must authorize the following wildcard URL: `https://\*.microsoftaik.azure.net` ### Windows 10 Health Attestation CSP @@ -514,10 +513,10 @@ Windows 10 contains a configuration service provider (CSP) specialized for inter The following list is that of the functions performed by the Windows 10 Health Attestation CSP: -- Collects data that is used to verify a device's health status -- Forwards the data to the Health Attestation Service -- Provisions the Health Attestation Certificate that it receives from the Health Attestation Service -- Upon request, forwards the Health Attestation Certificate (received from the Health Attestation Service) and related runtime information to the MDM server for verification +- Collects data that is used to verify a device's health status +- Forwards the data to the Health Attestation Service +- Provisions the Health Attestation Certificate that it receives from the Health Attestation Service +- Upon request, forwards the Health Attestation Certificate (received from the Health Attestation Service) and related runtime information to the MDM server for verification During a health attestation session, the Health Attestation CSP forwards the TCG logs and PCRs' values that are measured during the boot, by using a secure communication channel to the Health Attestation Service. @@ -532,21 +531,21 @@ The role of Windows Health Attestation Service is essentially to evaluate a set Checking that a TPM attestation and the associated log are valid takes several steps: -1. First, the server must check that the reports are signed by **trustworthy AIKs**. This verification might be done by checking that the public part of the AIK is listed in a database of assets, or perhaps that a certificate has been checked. -2. After the key has been checked, the signed attestation (a quote structure) should be checked to see whether it's a **valid signature over PCR values**. -3. Next the logs should be checked to ensure that they match the PCR values reported. -4. Finally, the logs themselves should be examined by an MDM solution to see whether they represent **known or valid security configurations**. For example, a simple check might be to see whether the measured early OS components are known to be good, that the ELAM driver is as expected, and that the ELAM driver policy file is up to date. If all of these checks succeed, an attestation statement can be issued that later can be used to determine whether or not the client should be granted access to a resource. +1. First, the server must check that the reports are signed by **trustworthy AIKs**. This verification might be done by checking that the public part of the AIK is listed in a database of assets, or perhaps that a certificate has been checked. +2. After the key has been checked, the signed attestation (a quote structure) should be checked to see whether it's a **valid signature over PCR values**. +3. Next the logs should be checked to ensure that they match the PCR values reported. +4. Finally, the logs themselves should be examined by an MDM solution to see whether they represent **known or valid security configurations**. For example, a simple check might be to see whether the measured early OS components are known to be good, that the ELAM driver is as expected, and that the ELAM driver policy file is up to date. If all of these checks succeed, an attestation statement can be issued that later can be used to determine whether or not the client should be granted access to a resource. The Health Attestation Service provides the following information to an MDM solution about the health of the device: -- Secure Boot enablement -- Boot and kernel debug enablement -- BitLocker enablement -- VSM enabled -- Signed or unsigned Device Guard Code Integrity policy measurement -- ELAM loaded -- Safe Mode boot, DEP enablement, test signing enablement -- Device TPM has been provisioned with a trusted endorsement certificate +- Secure Boot enablement +- Boot and kernel debug enablement +- BitLocker enablement +- VSM enabled +- Signed or unsigned Device Guard Code Integrity policy measurement +- ELAM loaded +- Safe Mode boot, DEP enablement, test signing enablement +- Device TPM has been provisioned with a trusted endorsement certificate For completeness of the measurements, see [Health Attestation CSP](/windows/client-management/mdm/healthattestation-csp). @@ -562,29 +561,29 @@ To make device health relevant, the MDM solution evaluates the device health rep A solution that uses MDM and the Health Attestation Service consists of three main parts: -1. A device with health attestation enabled. This enablement will be done as a part of enrollment with an MDM provider (health attestation will be disabled by default). -2. After this service is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. -3. At any point after this cycle, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it's been attested. +1. A device with health attestation enabled. This enablement will be done as a part of enrollment with an MDM provider (health attestation will be disabled by default). +2. After this service is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. +3. At any point after this cycle, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it's been attested. :::image type="content" alt-text="figure 9." source="images/hva-fig8-evaldevicehealth8.png"::: Interaction between a Windows 10-based device, the Health Attestation Service, and MDM can be performed as follows: -1. The client initiates a session with the MDM server. The URI for the MDM server would be part of the client app that initiates the request. The MDM server at this time could request the health attestation data by using the appropriate CSP URI. -2. The MDM server specifies a nonce along with the request. -3. The client then sends the AIK quoted nonce + the boot counter and the health blob information. This health blob is encrypted with a Health Attestation Service public key that only the Health Attestation Service can decrypt. -4. The MDM server: +1. The client initiates a session with the MDM server. The URI for the MDM server would be part of the client app that initiates the request. The MDM server at this time could request the health attestation data by using the appropriate CSP URI. +2. The MDM server specifies a nonce along with the request. +3. The client then sends the AIK quoted nonce + the boot counter and the health blob information. This health blob is encrypted with a Health Attestation Service public key that only the Health Attestation Service can decrypt. +4. The MDM server: - 1. Verifies that the nonce is as expected. - 2. Passes the quoted data, the nonce and the encrypted health blob to the Health Attestation Service server. + 1. Verifies that the nonce is as expected. + 2. Passes the quoted data, the nonce and the encrypted health blob to the Health Attestation Service server. -5. The Health Attestation Service: +5. The Health Attestation Service: - 1. Decrypts the health blob. - 2. Verifies that the boot counter in the quote is correct using the AIK in the health blob and matches the value in the health blob. - 3. Verifies that the nonce matches in the quote and the one that is passed from MDM. - 4. Because the boot counter and the nonce are quoted with the AIK from the health blob, it also proves that the device is the same one as the one for which the health blob has been generated. - 5. Sends data back to the MDM server including health parameters, freshness, and so on. + 1. Decrypts the health blob. + 2. Verifies that the boot counter in the quote is correct using the AIK in the health blob and matches the value in the health blob. + 3. Verifies that the nonce matches in the quote and the one that is passed from MDM. + 4. Because the boot counter and the nonce are quoted with the AIK from the health blob, it also proves that the device is the same one as the one for which the health blob has been generated. + 5. Sends data back to the MDM server including health parameters, freshness, and so on. > [!NOTE] > The MDM server (relying party) never performs the quote or boot counter validation itself. It gets the quoted data and the health blob (which is encrypted) and sends the data to the Health Attestation Service for validation. This way, the AIK is never visible to the MDM, which thereby addresses privacy concerns. @@ -625,7 +624,7 @@ Third-party MDM servers can manage Windows 10 by using the MDM protocol. The bui The third-party MDM server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. -### Management of Windows Defender by third-party MDM +### Management of Windows Defender by third-party MDM This management infrastructure makes it possible for IT pros to use MDM-capable products like Intune, to manage health attestation, Device Guard, or Windows Defender on Windows 10-based devices, including BYODs that aren't domain joined. IT pros will be able to manage and configure all of the actions and settings they're familiar with customizing by using Intune with Intune Endpoint Protection on down-level operating systems. Admins that currently only manage domain joined devices through Group Policy will find it easy to transition to managing Windows 10-based devices by using MDM because many of the settings and actions are shared across both mechanisms. @@ -641,7 +640,7 @@ If the device isn't registered, the user will get a message with instructions on :::image type="content" alt-text="figure 11." source="images/hva-fig10-conditionalaccesscontrol.png"::: -### Office 365 conditional access control +### Office 365 conditional access control Azure AD enforces conditional access policies to secure access to Office 365 services. A tenant admin can create a conditional access policy that blocks a user on a non-compliant device from accessing an Office 365 service. The user must conform to the company's device policies before access can be granted to the service. Alternately, the admin can also create a policy that requires users to just enroll their devices to gain access to an Office 365 service. Policies may be applied to all users of an organization, or limited to a few target groups and enhanced over time to include more target groups. @@ -663,20 +662,20 @@ Depending on the type of email application that employees use to access Exchange Clients that attempt to access Office 365 will be evaluated for the following properties: -- Is the device managed by an MDM? -- Is the device registered with Azure AD? -- Is the device compliant? +- Is the device managed by an MDM? +- Is the device registered with Azure AD? +- Is the device compliant? To get to a compliant state, the Windows 10-based device needs to: -- Enroll with an MDM solution. -- Register with Azure AD. -- Be compliant with the device policies set by the MDM solution. +- Enroll with an MDM solution. +- Register with Azure AD. +- Be compliant with the device policies set by the MDM solution. > [!NOTE] > At the present time, conditional access policies are selectively enforced on users on iOS and Android devices. For more information, see the [Azure AD, Microsoft Intune and Windows 10 – Using the cloud to modernize enterprise mobility!](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-microsoft-intune-and-windows-10-8211-using-the-cloud-to/ba-p/244012) blog post. -### Cloud and on-premises apps conditional access control +### Cloud and on-premises apps conditional access control Conditional access control is a powerful policy evaluation engine built into Azure AD. It gives IT pros an easy way to create access rules beyond Office 365 that evaluate the context of a user's sign in to make real-time decisions about which applications they should be allowed to access. @@ -689,22 +688,22 @@ For more information about conditional access, see [Azure Conditional Access Pre For on-premises applications there are two options to enable conditional access control based on a device's compliance state: -- For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more information, see [Using Azure AD Application Proxy to publish on-premises apps for remote users](/azure/active-directory/app-proxy/what-is-application-proxy). -- Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. +- For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more information, see [Using Azure AD Application Proxy to publish on-premises apps for remote users](/azure/active-directory/app-proxy/what-is-application-proxy). +- Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. :::image type="content" alt-text="figure 13." source="images/hva-fig12-conditionalaccess12.png"::: The following process describes how Azure AD conditional access works: -1. User has already enrolled with MDM through Workplace Access/Azure AD join, which registers device with Azure AD. -2. When the device boots or resumes from hibernate, a task "Tpm-HASCertRetr" is triggered to request in background a health attestation blob. Device sends TPM boot measurements to the Health Attestation Service. -3. Health Attestation Service validates device state and issues an encrypted blob to the device based on the health state with details on failed checks (if any). -4. User logs on and the MDM agent contacts the Intune/MDM server. -5. MDM server pushes down new policies if available and queries health blob state and other inventory state. -6. Device sends a health attestation blob previously acquired and also the value of the other state inventory requested by the Intune/MDM server. -7. Intune/MDM server sends the health attestation blob to Health Attestation Service to be validated. -8. Health Attestation Service validates that the device that sent the health attestation blob is healthy, and returns this result to Intune/MDM server. -9. Intune/MDM server evaluates compliance based on the compliance and the queried inventory/health attestation state from device. +1. User has already enrolled with MDM through Workplace Access/Azure AD join, which registers device with Azure AD. +2. When the device boots or resumes from hibernate, a task "Tpm-HASCertRetr" is triggered to request in background a health attestation blob. Device sends TPM boot measurements to the Health Attestation Service. +3. Health Attestation Service validates device state and issues an encrypted blob to the device based on the health state with details on failed checks (if any). +4. User logs on and the MDM agent contacts the Intune/MDM server. +5. MDM server pushes down new policies if available and queries health blob state and other inventory state. +6. Device sends a health attestation blob previously acquired and also the value of the other state inventory requested by the Intune/MDM server. +7. Intune/MDM server sends the health attestation blob to Health Attestation Service to be validated. +8. Health Attestation Service validates that the device that sent the health attestation blob is healthy, and returns this result to Intune/MDM server. +9. Intune/MDM server evaluates compliance based on the compliance and the queried inventory/health attestation state from device. 10. Intune/MDM server updates compliance state against device object in Azure AD. 11. User opens app, attempts to access a corporate managed asset. 12. Access gated by compliance claim in Azure AD. @@ -719,43 +718,43 @@ Conditional access control is a topic that many organizations and IT pros may no The following list contains high-level key takeaways to improve the security posture of any organization. However, the few takeaways presented in this section shouldn't be interpreted as an exhaustive list of security best practices. -- **Understand that no solution is 100 percent secure** +- **Understand that no solution is 100 percent secure** If determined adversaries with malicious intent gain physical access to the device, they could eventually break through its security layers and control it. -- **Use health attestation with an MDM solution** +- **Use health attestation with an MDM solution** Devices that attempt to connect to high-value assets must have their health evaluated so that unhealthy and noncompliant devices can be detected, reported, and eventually blocked. -- **Use Credential Guard** +- **Use Credential Guard** Credential Guard is a feature that greatly helps protect corporate domain credentials from pass-the-hash attacks. -- **Use Device Guard** +- **Use Device Guard** Device Guard is a real advance in security and an effective way to help protect against malware. The new Device Guard feature in Windows 10 blocks untrusted apps (apps not authorized by your organization). -- **Sign Device Guard policy** +- **Sign Device Guard policy** Signed Device Guard policy helps protect against a user with administrator privileges trying to defeat the current policy. When a policy is signed, the only way to modify Device Guard later is to provide a new version of the policy signed by the same signer or from a signer specify as part of the Device Guard policy. -- **Use virtualization-based security** +- **Use virtualization-based security** When you have Kernel Mode Code Integrity protected by virtualization-based security, the code integrity rules are still enforced even if a vulnerability allows unauthorized kernel mode memory access. Keep in mind that Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers. -- **Start to deploy Device Guard with Audit mode** +- **Start to deploy Device Guard with Audit mode** Deploy Device Guard policy to targeted computers and devices in Audit mode. Monitor the Code Integrity event log that indicates a program or a driver would have been blocked if Device Guard was configured in Enforcement mode. Adjust Device Guard rules until a high level of confidence has been reached. After the testing phase has been completed, Device Guard policy can be switched to Enforcement mode. -- **Build an isolated reference machine when deploying Device Guard** +- **Build an isolated reference machine when deploying Device Guard** Because the corporate network can contain malware, you should start to configure a reference environment that is isolated from your main corporate network. After that, you can create a code integrity policy that includes the trusted applications you want to run on your protected devices. -- **Use AppLocker when it makes sense** +- **Use AppLocker when it makes sense** Although AppLocker isn't considered a new Device Guard feature, it complements Device Guard functionality for some scenarios like being able to deny a specific Universal Windows application for a specific user or a group of users. -- **Lock down firmware and configuration** +- **Lock down firmware and configuration** After Windows 10 is installed, lock down firmware boot options access. This lockdown prevents a user with physical access from modifying UEFI settings, disabling Secure Boot, or booting other operating systems. Also, in order to protect against an administrator trying to disable Device Guard, add a rule in the current Device Guard policy that will deny and block execution of the **C:\\Windows\\System32\\SecConfig.efi** tool. @@ -765,4 +764,4 @@ Health attestation is a key feature of Windows 10 that includes client and cloud - [Protect derived domain credentials with Credential Guard](/windows/access-protection/credential-guard/credential-guard) - [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide) -- [Trusted Platform Module technology overview](../information-protection/tpm/trusted-platform-module-overview.md) +- [Trusted Platform Module technology overview](../../information-protection/tpm/trusted-platform-module-overview.md) diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md similarity index 93% rename from windows/security/information-protection/secure-the-windows-10-boot-process.md rename to windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index be0c4f800d..be60b9bd1d 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -11,13 +11,13 @@ ms.collection: ms.topic: conceptual ms.date: 03/09/2023 ms.technology: itpro-security -appliesto: -- ✅ Windows 10 and later +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Secure the Windows boot process - The Windows OS has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 OS includes a series of security features that can mitigate the effect. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. Windows has multiple levels of protection for desktop apps and data, too. Windows Defender Antivirus uses cloud-powered real-time detection to identify and quarantine apps that are known to be malicious. Windows Defender SmartScreen warns users before allowing them to run an untrustworthy app, even if it's recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. @@ -52,7 +52,7 @@ Figure 1 shows the Windows startup process. ![Windows startup process.](./images/dn168167.boot_process(en-us,MSDN.10).png) -*Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage* +*Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage*: Secure Boot and Measured Boot are only possible on PCs with UEFI 2.3.1 and a TPM chip. Fortunately, all Windows 10 and Windows 11 PCs that meet Windows Hardware Compatibility Program requirements have these components, and many PCs designed for earlier versions of Windows have them as well. @@ -82,21 +82,17 @@ These requirements help protect you from rootkits while allowing you to run any To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software can't change the Secure Boot settings. -The default state of Secure Boot has a wide circle of trust which can result in customers trusting boot components they may not need. Since the Microsoft 3rd Party UEFI CA certificate signs the bootloaders for all Linux distributions, trusting the Microsoft 3rd Party UEFI CA signature in the UEFI database increase s the attack surface of systems. A customer who intended to only trust and boot a single Linux distribution will trust all distributions – much more than their desired configuration. A vulnerability in any of the bootloaders exposes the system and places the customer at risk of exploit for a bootloader they never intended to use, as seen in recent vulnerabilities, for example [with the GRUB bootloader](https://msrc.microsoft.com/security-guidance/advisory/ADV200011) or [firmware-level rootkit]( https://www.darkreading.com/threat-intelligence/researchers-uncover-dangerous-new-firmware-level-rootkit) affecting boot components. [Secured-core PCs](/windows-hardware/design/device-experiences/OEM-highly-secure-11) require Secure Boot to be enabled and configured to distrust the Microsoft 3rd Party UEFI CA signature, by default, to provide customers with the most secure configuration of their PCs possible. +The default state of Secure Boot has a wide circle of trust which can result in customers trusting boot components they may not need. Since the Microsoft 3rd Party UEFI CA certificate signs the bootloaders for all Linux distributions, trusting the Microsoft 3rd Party UEFI CA signature in the UEFI database increase s the attack surface of systems. A customer who intended to only trust and boot a single Linux distribution will trust all distributions – much more than their desired configuration. A vulnerability in any of the bootloaders exposes the system and places the customer at risk of exploit for a bootloader they never intended to use, as seen in recent vulnerabilities, for example [with the GRUB bootloader](https://msrc.microsoft.com/security-guidance/advisory/ADV200011) or [firmware-level rootkit]( https://www.darkreading.com/threat-intelligence/researchers-uncover-dangerous-new-firmware-level-rootkit) affecting boot components. [Secured-core PCs](/windows-hardware/design/device-experiences/OEM-highly-secure-11) require Secure Boot to be enabled and configured to distrust the Microsoft 3rd Party UEFI CA signature, by default, to provide customers with the most secure configuration of their PCs possible. To trust and boot operating systems, like Linux, and components signed by the UEFI signature, Secured-core PCs can be configured in the BIOS menu to add the signature in the UEFI database by following these steps: -1. Open the firmware menu, either: - - - Boot the PC, and press the manufacturer's key to open the menus. Common keys used: Esc, Delete, F1, F2, F10, F11, or F12. On tablets, common buttons are Volume up or Volume down. During startup, there's often a screen that mentions the key. If there's not one, or if the screen goes by too fast to see it, check your manufacturer's site. +1. Open the firmware menu, either: + - Boot the PC, and press the manufacturer's key to open the menus. Common keys used: Esc, Delete, F1, F2, F10, F11, or F12. On tablets, common buttons are Volume up or Volume down. During startup, there's often a screen that mentions the key. If there's not one, or if the screen goes by too fast to see it, check your manufacturer's site. + - Or, if Windows is already installed, from either the Sign on screen or the Start menu, select Power ( ) > hold Shift while selecting Restart. Select Troubleshoot > Advanced options > UEFI Firmware settings. +2. From the firmware menu navigate to Security > Secure Boot and select the option to trust the "3rd Party CA". +3. Save changes and exit. - - Or, if Windows is already installed, from either the Sign on screen or the Start menu, select Power ( ) > hold Shift while selecting Restart. Select Troubleshoot > Advanced options > UEFI Firmware settings. - -2. From the firmware menu navigate to Security > Secure Boot and select the option to trust the "3rd Party CA". - -3. Save changes and exit. - -Microsoft continues to collaborate with Linux and IHV ecosystem partners to design least privileged features to help you stay secure and opt-in trust for only the publishers and components you trust. +Microsoft continues to collaborate with Linux and IHV ecosystem partners to design least privileged features to help you stay secure and opt-in trust for only the publishers and components you trust. Like most mobile devices, Arm-based devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot can't be turned off, and you can't load a different OS. Fortunately, there's a large market of ARM processor devices designed to run other operating systems. @@ -129,13 +125,12 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. - - ![Measured Boot and remote attestation process.](./images/dn168167.measure_boot(en-us,MSDN.10).png) -*Figure 2. Measured Boot proves the PC's health to a remote server* +*Figure 2. Measured Boot proves the PC's health to a remote server*: Windows includes the application programming interfaces to support Measured Boot, but you'll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For example, see the following tools from Microsoft Research: + - [TPM Platform Crypto-Provider Toolkit](https://www.microsoft.com/download/details.aspx?id=52487) - [TSS.MSR](https://github.com/microsoft/TSS.MSR#tssmsr) diff --git a/windows/security/operating-system-security/system-security/toc.yml b/windows/security/operating-system-security/system-security/toc.yml index 86abf54e55..8d8bf28ca1 100644 --- a/windows/security/operating-system-security/system-security/toc.yml +++ b/windows/security/operating-system-security/system-security/toc.yml @@ -1,28 +1,28 @@ items: - name: Secure the Windows boot process - href: ../../information-protection/secure-the-windows-10-boot-process.md + href: secure-the-windows-10-boot-process.md - name: Secure Boot and Trusted Boot - href: ../../trusted-boot.md -- name: Measured Boot + href: trusted-boot.md +- name: Measured Boot 🔗 href: /windows/compatibility/measured-boot - name: Device health attestation service - href: ../../threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md + href: protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md - name: Cryptography and certificate management - href: ../../cryptography-certificate-mgmt.md + href: cryptography-certificate-mgmt.md - name: The Windows Security app - href: ../../threat-protection/windows-defender-security-center/windows-defender-security-center.md + href: windows-defender-security-center/windows-defender-security-center.md items: - name: Virus & threat protection - href: ../../threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md + href: windows-defender-security-center\wdsc-virus-threat-protection.md - name: Account protection - href: ../../threat-protection\windows-defender-security-center\wdsc-account-protection.md + href: windows-defender-security-center\wdsc-account-protection.md - name: Firewall & network protection - href: ../../threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md + href: windows-defender-security-center\wdsc-firewall-network-protection.md - name: App & browser control - href: ../../threat-protection\windows-defender-security-center\wdsc-app-browser-control.md + href: windows-defender-security-center\wdsc-app-browser-control.md - name: Device security - href: ../../threat-protection\windows-defender-security-center\wdsc-device-security.md + href: windows-defender-security-center\wdsc-device-security.md - name: Device performance & health - href: ../../threat-protection\windows-defender-security-center\wdsc-device-performance-health.md + href: windows-defender-security-center\wdsc-device-performance-health.md - name: Family options - href: ../../threat-protection\windows-defender-security-center\wdsc-family-options.md \ No newline at end of file + href: windows-defender-security-center\wdsc-family-options.md \ No newline at end of file diff --git a/windows/security/trusted-boot.md b/windows/security/operating-system-security/system-security/trusted-boot.md similarity index 92% rename from windows/security/trusted-boot.md rename to windows/security/operating-system-security/system-security/trusted-boot.md index 8790964196..4cce0a44d5 100644 --- a/windows/security/trusted-boot.md +++ b/windows/security/operating-system-security/system-security/trusted-boot.md @@ -21,7 +21,7 @@ Secure Boot and Trusted Boot help prevent malware and corrupted components from The first step in protecting the operating system is to ensure that it boots securely after the initial hardware and firmware boot sequences have safely finished their early boot sequences. Secure Boot makes a safe and trusted path from the Unified Extensible Firmware Interface (UEFI) through the Windows kernel's Trusted Boot sequence. Malware attacks on the Windows boot sequence are blocked by the signature-enforcement handshakes throughout the boot sequence between the UEFI, bootloader, kernel, and application environments. -As the PC begins the boot process, it will first verify that the firmware is digitally signed, reducing the risk of firmware rootkits. Secure Boot then checks all code that runs before the operating system and checks the OS bootloader's digital signature to ensure that it's trusted by the Secure Boot policy and hasn't been tampered with. +As the PC begins the boot process, it will first verify that the firmware is digitally signed, reducing the risk of firmware rootkits. Secure Boot then checks all code that runs before the operating system and checks the OS bootloader's digital signature to ensure that it's trusted by the Secure Boot policy and hasn't been tampered with. ## Trusted Boot @@ -29,8 +29,8 @@ Trusted Boot picks up the process that started with Secure Boot. The Windows boo Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the Windows 11 device to start normally. -[!INCLUDE [secure-boot-and-trusted-boot](../../includes/licensing/secure-boot-and-trusted-boot.md)] +[!INCLUDE [secure-boot-and-trusted-boot](../../../../includes/licensing/secure-boot-and-trusted-boot.md)] ## See also -[Secure the Windows boot process](information-protection/secure-the-windows-10-boot-process.md) \ No newline at end of file +[Secure the Windows boot process](secure-the-windows-10-boot-process.md) diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-custom-flyout.png similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/images/security-center-custom-flyout.png rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-custom-flyout.png diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-home.png b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-home.png similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/images/security-center-home.png rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-home.png diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-start-menu.png b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-start-menu.png similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/images/security-center-start-menu.png rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-start-menu.png diff --git a/windows/security/threat-protection/windows-defender-security-center/images/security-center-taskbar.png b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-taskbar.png similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/images/security-center-taskbar.png rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/security-center-taskbar.png diff --git a/windows/security/threat-protection/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG diff --git a/windows/security/threat-protection/windows-defender-security-center/images/wdsc-all-hide.png b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/wdsc-all-hide.png similarity index 100% rename from windows/security/threat-protection/windows-defender-security-center/images/wdsc-all-hide.png rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/wdsc-all-hide.png diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md new file mode 100644 index 0000000000..aa2c080f9e --- /dev/null +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md @@ -0,0 +1,44 @@ +--- +title: Account protection in the Windows Security app +description: Use the Account protection section to manage security for your account and sign in to Microsoft. +ms.prod: windows-client +author: vinaypamnani-msft +ms.author: vinpa +ms.date: 12/31/2018 +ms.technology: itpro-security +ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +--- + + +# Account protection + +The **Account protection** section contains information and settings for account protection and sign-in. You can get more information about these capabilities from the following list: + +- [Microsoft Account](https://account.microsoft.com/account/faq) +- [Windows Hello for Business](../../../identity-protection/hello-for-business/hello-identity-verification.md) +- [Lock your Windows 10 PC automatically when you step away from it](https://support.microsoft.com/help/4028111/windows-lock-your-windows-10-pc-automatically-when-you-step-away-from) + +You can also choose to hide the section from users of the device. This is useful if you don't want your employees to access or view user-configured options for these features. + +## Hide the Account protection section + +You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. + +You can only configure these settings by using Group Policy. + +> [!IMPORTANT] +> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and select **Edit**. +1. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Account protection**. +1. Open the **Hide the Account protection area** setting and set it to **Enabled**. Select **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). + +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: +> +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md similarity index 93% rename from windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md rename to windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md index 817ff1949e..66f31a6cf3 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md @@ -8,14 +8,13 @@ ms.date: 12/31/2018 manager: aaroncz ms.technology: itpro-security ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # App and browser control -**Applies to** - -- Windows 10 and later - The **App and browser control** section contains information and settings for Windows Defender SmartScreen. IT administrators and IT pros can get configuration guidance from the [Windows Defender SmartScreen documentation library](/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview). In Windows 10, version 1709 and later, the section also provides configuration options for Exploit protection. You can prevent users from modifying these specific options with Group Policy. IT administrators can get more information at [Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection). @@ -32,13 +31,9 @@ You can only prevent users from modifying Exploit protection settings by using G > You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - 2. In the **Group Policy Management Editor** go to **Computer configuration**, select **Policies** and then **Administrative templates**. - 3. Expand the tree to **Windows components > Windows Security > App and browser protection**. - 4. Open the **Prevent users from modifying settings** setting and set it to **Enabled**. Click **OK**. - 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). ## Hide the App & browser control section @@ -51,13 +46,9 @@ This section can be hidden only by using Group Policy. > You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - 2. In the **Group Policy Management Editor** go to **Computer configuration**, select **Policies** and then **Administrative templates**. - 3. Expand the tree to **Windows components > Windows Security > App and browser protection**. - 4. Open the **Hide the App and browser protection area** setting and set it to **Enabled**. Click **OK**. - 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). > [!NOTE] diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md similarity index 94% rename from windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md rename to windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md index 1aed92dc61..3ed5892096 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md @@ -7,14 +7,13 @@ ms.author: vinpa ms.date: 12/31/2018 ms.technology: itpro-security ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Customize the Windows Security app for your organization -**Applies to** - -- Windows 10 and later - You can add information about your organization in a contact card to the Windows Security app. You can include a link to a support site, a phone number for a help desk, and an email address for email-based support. ![The Windows Security custom fly-out.](images/security-center-custom-flyout.png) @@ -36,11 +35,8 @@ You must have Windows 10, version 1709 or later. The ADMX/ADML template files fo There are two stages to using the contact card and customized notifications. First, you have to enable the contact card or custom notifications (or both), and then you must specify at least a name for your organization and one piece of contact information. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - 3. Expand the tree to **Windows components > Windows Security > Enterprise Customization**. - 4. Enable the contact card and the customized notifications by configuring two separate Group Policy settings. They will both use the same source of information (explained in Steps 5 and 6). You can enable both, or select one or the other: 1. To enable the contact card, open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. @@ -51,8 +47,8 @@ There are two stages to using the contact card and customized notifications. Fir 2. To enable the customized notifications, open the **Configure customized notifications** setting and set it to **Enabled**. Click **OK**. 5. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. - 6. To ensure the custom notifications or contact card appear, you must also configure at least one of the following settings. Open the setting, select **Enabled**, and then add the contact information in the field under **Options**: + 1. **Specify contact email address or Email ID** 2. **Specify contact phone number or Skype ID** 3. **Specify contact website** diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md similarity index 58% rename from windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md rename to windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md index bfc66838f7..def0a10485 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md @@ -7,47 +7,36 @@ author: vinaypamnani-msft ms.author: vinpa ms.technology: itpro-security ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Device performance and health -**Applies to** - -- Windows 10 -- Windows 11 - - The **Device performance & health** section contains information about hardware, devices, and drivers related to the machine. IT administrators and IT pros should reference the appropriate documentation library for the issues they're seeing, such as the [configure the Load and unload device drivers security policy setting](/windows/device-security/security-policy-settings/load-and-unload-device-drivers) and how to [deploy drivers during Windows 10 deployment using Microsoft Configuration Manager](/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager). The [Windows 10 IT pro troubleshooting topic](/windows/client-management/windows-10-support-solutions), and the main [Windows 10 documentation library](/windows/windows-10/) can also be helpful for resolving issues. - In Windows 10, version 1709 and later, the section can be hidden from users of the machine. This option can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. - ## Hide the Device performance & health section You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. This section can be hidden only by using Group Policy. ->[!IMPORTANT] ->### Requirements +> [!IMPORTANT] +> You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Device performance and health**. +1. Open the **Hide the Device performance and health area** setting and set it to **Enabled**. Click **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). + +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Device performance and health**. - -6. Open the **Hide the Device performance and health area** setting and set it to **Enabled**. Click **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md new file mode 100644 index 0000000000..171cff5260 --- /dev/null +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md @@ -0,0 +1,61 @@ +--- +title: Device security in the Windows Security app +description: Use the Device security section to manage security built into your device, including virtualization-based security. +ms.prod: windows-client +author: vinaypamnani-msft +ms.author: vinpa +ms.date: 12/31/2018 +manager: aaroncz +ms.technology: itpro-security +ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +--- + +# Device security + +The **Device security** section contains information and settings for built-in device security. + +You can choose to hide the section from users of the machine. This option can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. + +## Hide the Device security section + +You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. You can hide the device security section by using Group Policy only. + +> [!IMPORTANT] +> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +2. In **Group Policy Management Editor**, go to **Computer configuration** and then select **Administrative templates**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. +4. Open the **Hide the Device security area** setting and set it to **Enabled**. Select **OK**. +5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). + +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: +> +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) + +## Disable the Clear TPM button + +If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. + +> [!IMPORTANT] +> You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +2. In **Group Policy Management Editor**, go to **Computer configuration** and then select **Administrative templates**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. +4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Select **OK**. +5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). + +## Hide the TPM Firmware Update recommendation + +If you don't want users to see the recommendation to update TPM firmware, you can disable it. + +1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +2. In **Group Policy Management Editor**, go to **Computer configuration** and then select **Administrative templates**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. +4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Select **OK**. +5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md new file mode 100644 index 0000000000..0b4c5817bc --- /dev/null +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md @@ -0,0 +1,42 @@ +--- +title: Family options in the Windows Security app +description: Learn how to hide the Family options section of Windows Security for enterprise environments. Family options aren't intended for business environments. +ms.prod: windows-client +author: vinaypamnani-msft +ms.author: vinpa +ms.date: 12/31/2018 +ms.technology: itpro-security +ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +--- + + +# Family options + +The **Family options** section contains links to settings and further information for parents of a Windows 10 PC. It isn't intended for enterprise or business environments. + +Home users can learn more at the [Help protection your family online in Windows Security topic at support.microsoft.com](https://support.microsoft.com/help/4013209/windows-10-protect-your-family-online-in-windows-defender) + +In Windows 10, version 1709, the section can be hidden from users of the machine. This option can be useful if you don't want employees in your organization to see or have access to this section. + +## Hide the Family options section + +You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. + +This section can be hidden only by using Group Policy. + +> [!IMPORTANT] +> You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Family options**. +1. Open the **Hide the Family options area** setting and set it to **Enabled**. Click **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). + +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: +> +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md new file mode 100644 index 0000000000..e19bcb596b --- /dev/null +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -0,0 +1,38 @@ +--- +title: Firewall and network protection in the Windows Security app +description: Use the Firewall & network protection section to see the status of and make changes to firewalls and network connections for the machine. +author: vinaypamnani-msft +ms.author: vinpa +ms.date: 12/31/2018 +ms.technology: itpro-security +ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +--- + +# Firewall and network protection + +The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](../../network-security/windows-firewall/windows-firewall-with-advanced-security.md). + +In Windows 10, version 1709 and later, the section can be hidden from users of the machine. This information is useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. + +## Hide the Firewall & network protection section + +You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. + +This section can be hidden only by using Group Policy. + +> [!IMPORTANT] +> You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Firewall and network protection**. +1. Open the **Hide the Firewall and network protection area** setting and set it to **Enabled**. Click **OK**. +1. Deploy the updated GPO as you normally do. + +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: +> +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md similarity index 81% rename from windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md rename to windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md index 8ca7f8d1c1..6de436c17c 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md @@ -7,14 +7,13 @@ ms.author: vinpa ms.date: 12/31/2018 ms.technology: itpro-security ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Hide Windows Security app notifications -**Applies to** - -- Windows 10 and later - The Windows Security app is used by many Windows security features to provide notifications about the health and security of the machine. These include notifications about firewalls, antivirus products, Windows Defender SmartScreen, and others. In some cases, it may not be appropriate to show these notifications, for example, if you want to hide regular status updates, or if you want to hide all notifications to the employees in your organization. @@ -28,30 +27,21 @@ If you set **Hide all notifications** to **Enabled**, changing the **Hide non-cr You can only use Group Policy to change these settings. - - ## Use Group Policy to hide non-critical notifications You can hide notifications that describe regular events related to the health and security of the machine. These notifications are the ones that don't require an action from the machine's user. It can be useful to hide these notifications if you find they're too numerous or you have other status reporting on a larger scale (such as Windows Update for Business reports or Microsoft Configuration Manager reporting). These notifications can be hidden only by using Group Policy. ->[!IMPORTANT] -> -> Requirement: You must have Windows 10, version 1903 or higher. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1903 or higher. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. Download the latest [Administrative Templates (.admx) for Windows 10, v2004](https://www.microsoft.com/download/101445). - -2. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below, the path would be **Windows components > Windows Defender Security Center > Notifications** - -6. Open the **Hide non-critical notifications** setting and set it to **Enabled**. Click **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below, the path would be **Windows components > Windows Defender Security Center > Notifications** +1. Open the **Hide non-critical notifications** setting and set it to **Enabled**. Click **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). ## Use Group Policy to hide all notifications @@ -59,22 +49,18 @@ You can hide all notifications that are sourced from the Windows Security app. T These notifications can be hidden only by using Group Policy. ->[!IMPORTANT] -> -> Requirement: You must have Windows 10, version 1903 or higher. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1903 or higher. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below, the path would be **Windows components > Windows Defender Security Center > Notifications**. +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below, the path would be **Windows components > Windows Defender Security Center > Notifications**. > [!NOTE] > For Windows 10 version 2004 and above the path would be **Windows components > Windows Security > Notifications**. -6. Open the **Hide all notifications** setting and set it to **Enabled**. Click **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). +1. Open the **Hide all notifications** setting and set it to **Enabled**. Click **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). > [!NOTE] > You can use the following registry key and DWORD value to **Hide all notifications**. @@ -95,7 +81,7 @@ These notifications can be hidden only by using Group Policy. | HVCI, driver compat check fails (upon trying to enable) | There may be an incompatibility on your device. | HVCI_ENABLE_FAILURE | Yes |Firewall and network protection notification| | HVCI, reboot needed to enable | The recent change to your protection settings requires a restart of your device. | HVCI_ENABLE_SUCCESS | Yes |Firewall and network protection notification| | Item skipped in scan, due to exclusion setting, or network scanning disabled by admin | The Microsoft Defender Antivirus scan skipped an item due to exclusion or network scanning settings. | ITEM_SKIPPED | Yes |Virus & threat protection notification| -| Remediation failure | Microsoft Defender Antivirus couldn’t completely resolve potential threats. | CLEAN_FAILED | Yes |Virus & threat protection notification| +| Remediation failure | Microsoft Defender Antivirus couldn't completely resolve potential threats. | CLEAN_FAILED | Yes |Virus & threat protection notification| | Follow-up action (restart & scan) | Microsoft Defender Antivirus found _threat_ in _file name_. Restart and scan your device. Restart and scan | MANUALSTEPS_REQUIRED | Yes |Virus & threat protection notification| | Follow-up action (restart) | Microsoft Defender Antivirus found _threat_ in _file_. Restart your device. | WDAV_REBOOT | Yes |Virus & threat protection notification| | Follow-up action (Full scan) | Microsoft Defender Antivirus found _threat_ in _file_. Run a full scan of your device. | FULLSCAN_REQUIRED | Yes |Virus & threat protection notification| @@ -109,7 +95,7 @@ These notifications can be hidden only by using Group Policy. | Scan finished, manual, threats found | Microsoft Defender Antivirus scanned your device at _timestamp_ on _date_, and took action against threats. | RECENT_SCAN_FOUND_THREATS | No |Virus & threat protection notification| | Scan finished, manual, **no** threats found | Microsoft Defender Antivirus scanned your device at _timestamp_ on _date_. No threats were found. | RECENT_SCAN_NO_THREATS | No |Virus & threat protection notification| | Threat found | Microsoft Defender Antivirus found threats. Get details. | CRITICAL | No |Virus & threat protection notification| -| LPS on notification | Microsoft Defender Antivirus is periodically scanning your device. You’re also using another antivirus program for active protection. | PERIODIC_SCANNING_ON | No |Virus & threat protection notification| +| LPS on notification | Microsoft Defender Antivirus is periodically scanning your device. You're also using another antivirus program for active protection. | PERIODIC_SCANNING_ON | No |Virus & threat protection notification| | Long running BaFS | Your IT administrator requires a security scan of this item. The scan could take up to _n_ seconds. | BAFS | No |Firewall and network protection notification| | Long running BaFS customized | _Company_ requires a security scan of this item. The scan could take up to _n_ seconds. | BAFS_DETECTED_CUSTOM (body) | No |Firewall and network protection notification| | Sense detection | This application was removed because it was blocked by your IT security settings | WDAV_SENSE_DETECTED | No |Firewall and network protection notification| @@ -131,4 +117,4 @@ These notifications can be hidden only by using Group Policy. | Dynamic lock on, bluetooth on, but device unpaired | | | No |Account protection notification| | Dynamic lock on, bluetooth on, but unable to detect device | | | No |Account protection notification| | NoPa or federated no hello | | | No |Account protection notification| -| NoPa or federated hello broken | | | No |Account protection notification| \ No newline at end of file +| NoPa or federated hello broken | | | No |Account protection notification| diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md similarity index 53% rename from windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md rename to windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md index cfb558208e..c52e5e7bed 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -2,28 +2,22 @@ title: Virus and threat protection in the Windows Security app description: Use the Virus & threat protection section to see and configure Microsoft Defender Antivirus, Controlled folder access, and 3rd-party AV products. keywords: wdav, smartscreen, antivirus, wdsc, exploit, protection, hide -search.product: eADQiWindows 10XVcnh ms.prod: windows-client -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa -ms.reviewer: +ms.reviewer: manager: aaroncz ms.technology: itpro-security ms.date: 12/31/2017 ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # Virus and threat protection -**Applies to** - -- Windows 10 -- Windows 11 - The **Virus & threat protection** section contains information and settings for antivirus protection from Microsoft Defender Antivirus and third-party AV products. In Windows 10, version 1803, this section also contains information and settings for ransomware protection and recovery. These settings include Controlled folder access settings to prevent unknown apps from changing files in protected folders, plus Microsoft OneDrive configuration to help you recover from a ransomware attack. This area also notifies users and provides recovery instructions if there's a ransomware attack. @@ -33,38 +27,31 @@ IT administrators and IT pros can get more configuration information from these - [Microsoft Defender Antivirus in the Windows Security app](/microsoft-365/security/defender-endpoint/microsoft-defender-security-center-antivirus) - [Microsoft Defender Antivirus documentation library](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10) - [Protect important folders with Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders) -- [Defend yourself from cybercrime with new Office 365 capabilities](https://blogs.office.com/en-us/2018/04/05/defend-yourself-from-cybercrime-with-new-office-365-capabilities/) +- [Defend yourself from cybercrime with new Office 365 capabilities](https://blogs.office.com/2018/04/05/defend-yourself-from-cybercrime-with-new-office-365-capabilities/) - [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/defender-for-office-365) -- [Ransomware detection and recovering your files](https://support.office.com/en-us/article/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f?ui=en-US&rs=en-US&ad=US) +- [Ransomware detection and recovering your files](https://support.office.com/article/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f?ui=en-US&rs=en-US&ad=US) You can hide the **Virus & threat protection** section or the **Ransomware protection** area from users of the machine. This option can be useful if you don't want employees in your organization to see or have access to user-configured options for these features. - ## Hide the Virus & threat protection section You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. This section can be hidden only by using Group Policy. ->[!IMPORTANT] ->### Requirements +> [!IMPORTANT] +> You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. + +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Virus and threat protection**. +1. Open the **Hide the Virus and threat protection area** setting and set it to **Enabled**. Click **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). + +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Virus and threat protection**. - -6. Open the **Hide the Virus and threat protection area** setting and set it to **Enabled**. Click **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Hide the Ransomware protection area @@ -72,17 +59,11 @@ You can choose to hide the **Ransomware protection** area by using Group Policy. This area can be hidden only by using Group Policy. ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Virus and threat protection**. - -6. Open the **Hide the Ransomware data recovery area** setting and set it to **Enabled**. Click **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). \ No newline at end of file +1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. +1. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Security > Virus and threat protection**. +1. Open the **Hide the Ransomware data recovery area** setting and set it to **Enabled**. Click **OK**. +1. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md similarity index 92% rename from windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md rename to windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md index 41b535c96b..f497976c30 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md @@ -1,32 +1,26 @@ --- title: The Windows Security app description: The Windows Security app brings together common Windows security features into one place. -search.product: eADQiWindows 10XVcnh ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa -ms.reviewer: +ms.reviewer: manager: aaroncz -ms.technology: itpro-security -ms.collection: +ms.collection: - highpri - tier2 ms.date: 12/31/2017 ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- # The Windows Security app -**Applies to** - -- Windows 10 -- Windows 11 - This library describes the Windows Security app, and provides information on configuring certain features, including: - - - [Showing and customizing contact information on the app and in notifications](wdsc-customize-contact-information.md) - [Hiding notifications](wdsc-hide-notifications.md) @@ -52,7 +46,7 @@ For more information about each section, options for configuring the sections, a - [Firewall & network protection](wdsc-firewall-network-protection.md), which has information and access to firewall settings, including Windows Defender Firewall. - [App & browser control](wdsc-app-browser-control.md), covering Windows Defender SmartScreen settings and Exploit protection mitigations. - [Device security](wdsc-device-security.md), which provides access to built-in device security settings. -- [Device performance & health](wdsc-device-performance-health.md), which has information about drivers, storage space, and general Windows Update issues. +- [Device performance & health](wdsc-device-performance-health.md), which has information about drivers, storage space, and general Windows Update issues. - [Family options](wdsc-family-options.md), which include access to parental controls along with tips and information for keeping kids safe online. > [!NOTE] @@ -65,9 +59,11 @@ For more information about each section, options for configuring the sections, a - Select the icon in the notification area on the taskbar. ![Screenshot of the icon for the Windows Security app on the Windows task bar.](images/security-center-taskbar.png) + - Search the Start menu for **Windows Security**. ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected.](images/security-center-start-menu.png) + - Open an area from Windows **Settings**. ![Screenshot of Windows Settings showing the different areas available in the Windows Security.](images/settings-windows-defender-security-center-areas.png) @@ -78,7 +74,7 @@ For more information about each section, options for configuring the sections, a ## How the Windows Security app works with Windows security features > [!IMPORTANT] -> Microsoft Defender Antivirus and the Windows Security app use similarly named services for specific purposes. +> Microsoft Defender Antivirus and the Windows Security app use similarly named services for specific purposes. > > The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Service*), which in turn utilizes the Windows Security Center Service (*wscsvc*). This service makes sure that the app provides the most up-to-date information about the protection status on the endpoint. This information includes protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. > @@ -86,7 +82,7 @@ For more information about each section, options for configuring the sections, a > > Microsoft Defender Antivirus will be [disabled automatically when a third-party antivirus product is installed and kept up to date](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility). > -> Disabling the Windows Security Center Service won't disable Microsoft Defender Antivirus or [Windows Defender Firewall](../windows-firewall/windows-firewall-with-advanced-security.md). +> Disabling the Windows Security Center Service won't disable Microsoft Defender Antivirus or [Windows Defender Firewall](../../network-security/windows-firewall/windows-firewall-with-advanced-security.md). > [!WARNING] > If you disable the Windows Security Center Service, or configure its associated group policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md deleted file mode 100644 index b85fb0dfe8..0000000000 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Account protection in the Windows Security app -description: Use the Account protection section to manage security for your account and sign in to Microsoft. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa -ms.date: 12/31/2018 -ms.technology: itpro-security -ms.topic: article ---- - - -# Account protection - -**Applies to** - -- Windows 10 and later - -The **Account protection** section contains information and settings for account protection and sign-in. You can get more information about these capabilities from the following list: - -- [Microsoft Account](https://account.microsoft.com/account/faq) -- [Windows Hello for Business](../../identity-protection/hello-for-business/hello-identity-verification.md) -- [Lock your Windows 10 PC automatically when you step away from it](https://support.microsoft.com/help/4028111/windows-lock-your-windows-10-pc-automatically-when-you-step-away-from) - -You can also choose to hide the section from users of the device. This is useful if you don't want your employees to access or view user-configured options for these features. - -## Hide the Account protection section - -You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. - -You can only configure these settings by using Group Policy. - ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and select **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Account protection**. - -6. Open the **Hide the Account protection area** setting and set it to **Enabled**. Select **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md deleted file mode 100644 index d56e6ecd4f..0000000000 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Device security in the Windows Security app -description: Use the Device security section to manage security built into your device, including virtualization-based security. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa -ms.date: 12/31/2018 -manager: aaroncz -ms.technology: itpro-security -ms.topic: article ---- - -# Device security - -**Applies to** - -- Windows 10 and later - -The **Device security** section contains information and settings for built-in device security. - -You can choose to hide the section from users of the machine. This option can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. - -## Hide the Device security section - -You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. You can hide the device security section by using Group Policy only. - -> [!IMPORTANT] -> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In **Group Policy Management Editor**, go to **Computer configuration** and then select **Administrative templates**. - -3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. - -4. Open the **Hide the Device security area** setting and set it to **Enabled**. Select **OK**. - -5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) - -## Disable the Clear TPM button -If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. - -> [!IMPORTANT] -> You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In **Group Policy Management Editor**, go to **Computer configuration** and then select **Administrative templates**. - -3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. - -4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Select **OK**. - -5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - -## Hide the TPM Firmware Update recommendation -If you don't want users to see the recommendation to update TPM firmware, you can disable it. - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In **Group Policy Management Editor**, go to **Computer configuration** and then select **Administrative templates**. - -3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. - -4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Select **OK**. - -5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md deleted file mode 100644 index f4a6bb11c6..0000000000 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Family options in the Windows Security app -description: Learn how to hide the Family options section of Windows Security for enterprise environments. Family options aren't intended for business environments. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa -ms.date: 12/31/2018 -ms.technology: itpro-security -ms.topic: article ---- - - -# Family options - -**Applies to** - -- Windows 10 and later - -The **Family options** section contains links to settings and further information for parents of a Windows 10 PC. It isn't intended for enterprise or business environments. - -Home users can learn more at the [Help protection your family online in Windows Security topic at support.microsoft.com](https://support.microsoft.com/help/4013209/windows-10-protect-your-family-online-in-windows-defender) - -In Windows 10, version 1709, the section can be hidden from users of the machine. This option can be useful if you don't want employees in your organization to see or have access to this section. - - -## Hide the Family options section - -You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. - -This section can be hidden only by using Group Policy. - ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Family options**. - -6. Open the **Hide the Family options area** setting and set it to **Enabled**. Click **OK**. - -7. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md deleted file mode 100644 index 1d0d162d10..0000000000 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Firewall and network protection in the Windows Security app -description: Use the Firewall & network protection section to see the status of and make changes to firewalls and network connections for the machine. -author: vinaypamnani-msft -ms.author: vinpa -ms.date: 12/31/2018 -ms.technology: itpro-security -ms.topic: article ---- - - -# Firewall and network protection - -**Applies to** - -- Windows 10 -- Windows 11 - -The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](../windows-firewall/windows-firewall-with-advanced-security.md). - -In Windows 10, version 1709 and later, the section can be hidden from users of the machine. This information is useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. - - -## Hide the Firewall & network protection section - -You can choose to hide the entire section by using Group Policy. The section won't appear on the home page of the Windows Security app, and its icon won't be shown on the navigation bar on the side of the app. - -This section can be hidden only by using Group Policy. - ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. - -1. On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click **Edit**. - -3. In **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Security > Firewall and network protection**. - -6. Open the **Hide the Firewall and network protection area** setting and set it to **Enabled**. Click **OK**. - -7. Deploy the updated GPO as you normally do. - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) - diff --git a/windows/security/zero-trust-windows-device-health.md b/windows/security/zero-trust-windows-device-health.md index 64a4233745..248d3513f5 100644 --- a/windows/security/zero-trust-windows-device-health.md +++ b/windows/security/zero-trust-windows-device-health.md @@ -1,7 +1,7 @@ --- title: Zero Trust and Windows device health description: Describes the process of Windows device health attestation -ms.reviewer: +ms.reviewer: ms.topic: article manager: aaroncz ms.author: paoloma @@ -13,6 +13,7 @@ ms.date: 12/31/2017 --- # Zero Trust and Windows device health + Organizations need a security model that more effectively adapts to the complexity of the modern work environment. IT admins need to embrace the hybrid workplace, while protecting people, devices, apps, and data wherever they're located. Implementing a Zero Trust model for security helps address today's complex environments. The [Zero Trust](https://www.microsoft.com/security/business/zero-trust) principles are: @@ -23,15 +24,16 @@ The [Zero Trust](https://www.microsoft.com/security/business/zero-trust) princip - **Assume breach**. Prevent attackers from obtaining access to minimize potential damage to data and systems. Protect privileged roles, verify end-to-end encryption, use analytics to get visibility, and drive threat detection to improve defenses. -The Zero Trust concept of **verify explicitly** applies to the risks introduced by both devices and users. Windows enables **device health attestation** and **conditional access** capabilities, which are used to grant access to corporate resources. +The Zero Trust concept of **verify explicitly** applies to the risks introduced by both devices and users. Windows enables **device health attestation** and **conditional access** capabilities, which are used to grant access to corporate resources. -[Conditional access](/azure/active-directory/conditional-access/overview) evaluates identity signals to confirm that users are who they say they are before they're granted access to corporate resources. +[Conditional access](/azure/active-directory/conditional-access/overview) evaluates identity signals to confirm that users are who they say they are before they're granted access to corporate resources. Windows 11 supports device health attestation, helping to confirm that devices are in a good state and haven't been tampered with. This capability helps users access corporate resources whether they're in the office, at home, or when they're traveling. Attestation helps verify the identity and status of essential components and that the device, firmware, and boot process haven't been altered. Information about the firmware, boot process, and software, is used to validate the security state of the device. This information is cryptographically stored in the security co-processor Trusted Platform Module (TPM). Once the device is attested, it can be granted access to resources. ## Device health attestation on Windows + Many security risks can emerge during the boot process as this process can be the most privileged component of the whole system. The verification process uses remote attestation as the secure channel to determine and present the device's health. Remote attestation determines: - If the device can be trusted @@ -40,7 +42,7 @@ Attestation helps verify the identity and status of essential components and tha These determinations are made with the help of a secure root of trust using the Trusted Platform Module (TPM). Devices can attest that the TPM is enabled, and that the device hasn't been tampered with. -Windows includes many security features to help protect users from malware and attacks. However, trusting the Windows security components can only be achieved if the platform boots as expected and wasn't tampered with. Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, Early-launch antimalware (ELAM), Dynamic Root of Trust for Measurement (DRTM), Trusted Boot, and other low-level hardware and firmware security features. When you power on your PC until your anti-malware starts, Windows is backed with the appropriate hardware configuration to help keep you safe. [Measured and Trusted boot](information-protection/secure-the-windows-10-boot-process.md), implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to a security coprocessor (TPM) that acts as the Root of Trust. Remote Attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper resilient report. Remote attestation is the trusted auditor of your system's boot, allowing specific entities to trust the device. +Windows includes many security features to help protect users from malware and attacks. However, trusting the Windows security components can only be achieved if the platform boots as expected and wasn't tampered with. Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, Early-launch antimalware (ELAM), Dynamic Root of Trust for Measurement (DRTM), Trusted Boot, and other low-level hardware and firmware security features. When you power on your PC until your anti-malware starts, Windows is backed with the appropriate hardware configuration to help keep you safe. [Measured and Trusted boot](/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md), implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to a security coprocessor (TPM) that acts as the Root of Trust. Remote Attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper resilient report. Remote attestation is the trusted auditor of your system's boot, allowing specific entities to trust the device. A summary of the steps involved in attestation and Zero Trust on the device side are as follows: From b7c713903ba4e69d8128410d3ac574c26f076d8d Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 1 Jun 2023 14:42:47 -0400 Subject: [PATCH 02/30] Fix links and redirect --- .openpublishing.redirection.json | 60 +++++++++++++++++++ windows/security/index.yml | 2 +- .../operating-system-security/toc.yml | 2 +- 3 files changed, 62 insertions(+), 2 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 1656faae57..eb9fbf4407 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20840,6 +20840,66 @@ "redirect_url": "/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system.md", + "redirect_url": "/windows/security/operating-system-security/operating-system", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", + "redirect_url": "/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md", + "redirect_url": "/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center", + "redirect_document_id": false + }, { "source_path": "windows/security/information-protection/index.md", "redirect_url": "/windows/security/encryption-data-protection", diff --git a/windows/security/index.yml b/windows/security/index.yml index b21e641eed..8166e0bbb9 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -57,7 +57,7 @@ landingContent: - linkListType: overview links: - text: Overview - url: operating-system.md + url: operating-system-security\operating-system.md - linkListType: concept links: - text: Trusted boot diff --git a/windows/security/operating-system-security/toc.yml b/windows/security/operating-system-security/toc.yml index a0ee50c4bb..85e304ccef 100644 --- a/windows/security/operating-system-security/toc.yml +++ b/windows/security/operating-system-security/toc.yml @@ -1,6 +1,6 @@ items: - name: Overview - href: ../operating-system.md + href: operating-system.md - name: System security href: system-security/toc.yml - name: Virus and threat protection From ea5123d98f2bf67cdf6eacbb408e9261d2d23548 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 1 Jun 2023 14:53:57 -0400 Subject: [PATCH 03/30] More redirects --- .openpublishing.redirection.json | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index eb9fbf4407..78b646e5ca 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20845,6 +20845,21 @@ "redirect_url": "/windows/security/operating-system-security/operating-system", "redirect_document_id": false }, + { + "source_path": "windows/security/cryptography-certificate-mgmt.md", + "redirect_url": "/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/secure-the-windows-10-boot-process.md", + "redirect_url": "/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process", + "redirect_document_id": false + }, + { + "source_path": "windows/security/trusted-boot.md", + "redirect_url": "/windows/security/operating-system-security/system-security/trusted-boot", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", "redirect_url": "/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", From 16a1201182cde85a968a0c3260ef3e50c9c5cb72 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 1 Jun 2023 16:16:47 -0400 Subject: [PATCH 04/30] Test1 --- .../virus-and-threat-protection/toc.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/toc.yml b/windows/security/operating-system-security/virus-and-threat-protection/toc.yml index 9f7c2d6f2f..fdd97bdff1 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/toc.yml +++ b/windows/security/operating-system-security/virus-and-threat-protection/toc.yml @@ -2,7 +2,9 @@ items: - name: Microsoft Defender Antivirus 🔗 href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows - name: Configuring LSA Protection - href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json + # href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json + href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection + preserveContext: true - name: Attack surface reduction (ASR) 🔗 href: /microsoft-365/security/defender-endpoint/attack-surface-reduction - name: Tamper protection for MDE 🔗 From 5ff0615acb2e035086d563de3171cafd5cff923e Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 5 Jun 2023 11:08:59 -0400 Subject: [PATCH 05/30] Add sections include files --- .openpublishing.redirection.json | 2 +- ...pplication-application-control-overview.md | 22 +++++++ ...lication-application-isolation-overview.md | 30 +++++++++ .../security/includes/sections/application.md | 26 ++++++++ ...otecting-your-work-information-overview.md | 26 ++++++++ .../cloud-services-update-overview.md | 20 ++++++ .../includes/sections/cloud-services.md | 23 +++++++ ...ardware-hardware-root-of-trust-overview.md | 22 +++++++ ...sisted-security-secured-kernel-overview.md | 26 ++++++++ .../security/includes/sections/hardware.md | 24 ++++++++ ...advanced-credential-protection-overview.md | 28 +++++++++ .../identity-passwordless-sign-in-overview.md | 28 +++++++++ .../security/includes/sections/identity.md | 28 +++++++++ ...erating-system-data-protection-overview.md | 26 ++++++++ ...ystem-modern-device-management-overview.md | 22 +++++++ ...rating-system-network-security-overview.md | 36 +++++++++++ ...erating-system-system-security-overview.md | 22 +++++++ ...em-virus-and-threat-protection-overview.md | 34 +++++++++++ .../includes/sections/operating-system.md | 61 +++++++++++++++++++ windows/security/includes/sections/privacy.md | 6 ++ ...rity-foundations-certification-overview.md | 20 ++++++ .../includes/sections/security-foundations.md | 13 ++++ windows/security/index.yml | 2 +- .../operating-system-security/index.md | 25 ++++++++ .../operating-system.md | 40 ------------ .../secure-the-windows-10-boot-process.md | 4 +- .../system-security/toc.yml | 2 +- .../windows-defender-security-center.md | 4 +- .../operating-system-security/toc.yml | 2 +- 29 files changed, 576 insertions(+), 48 deletions(-) create mode 100644 windows/security/includes/sections/application-application-control-overview.md create mode 100644 windows/security/includes/sections/application-application-isolation-overview.md create mode 100644 windows/security/includes/sections/application.md create mode 100644 windows/security/includes/sections/cloud-services-protecting-your-work-information-overview.md create mode 100644 windows/security/includes/sections/cloud-services-update-overview.md create mode 100644 windows/security/includes/sections/cloud-services.md create mode 100644 windows/security/includes/sections/hardware-hardware-root-of-trust-overview.md create mode 100644 windows/security/includes/sections/hardware-silicon-assisted-security-secured-kernel-overview.md create mode 100644 windows/security/includes/sections/hardware.md create mode 100644 windows/security/includes/sections/identity-advanced-credential-protection-overview.md create mode 100644 windows/security/includes/sections/identity-passwordless-sign-in-overview.md create mode 100644 windows/security/includes/sections/identity.md create mode 100644 windows/security/includes/sections/operating-system-data-protection-overview.md create mode 100644 windows/security/includes/sections/operating-system-modern-device-management-overview.md create mode 100644 windows/security/includes/sections/operating-system-network-security-overview.md create mode 100644 windows/security/includes/sections/operating-system-system-security-overview.md create mode 100644 windows/security/includes/sections/operating-system-virus-and-threat-protection-overview.md create mode 100644 windows/security/includes/sections/operating-system.md create mode 100644 windows/security/includes/sections/privacy.md create mode 100644 windows/security/includes/sections/security-foundations-certification-overview.md create mode 100644 windows/security/includes/sections/security-foundations.md create mode 100644 windows/security/operating-system-security/index.md delete mode 100644 windows/security/operating-system-security/operating-system.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 78b646e5ca..a01af87c70 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20842,7 +20842,7 @@ }, { "source_path": "windows/security/operating-system.md", - "redirect_url": "/windows/security/operating-system-security/operating-system", + "redirect_url": "/windows/security/operating-system-security", "redirect_document_id": false }, { diff --git a/windows/security/includes/sections/application-application-control-overview.md b/windows/security/includes/sections/application-application-control-overview.md new file mode 100644 index 0000000000..00b89b3535 --- /dev/null +++ b/windows/security/includes/sections/application-application-control-overview.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Application Control features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)|Yes|Yes|Yes|Yes| +|[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)|Yes|Yes|Yes|Yes| +|[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Application Control features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)|Yes|Yes|Yes|Yes|Yes| +|[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)|Yes|Yes|Yes|Yes|Yes| +|[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/application-application-isolation-overview.md b/windows/security/includes/sections/application-application-isolation-overview.md new file mode 100644 index 0000000000..ff7f030ea9 --- /dev/null +++ b/windows/security/includes/sections/application-application-isolation-overview.md @@ -0,0 +1,30 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Application Isolation features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)|Yes|Yes|Yes|Yes| +|[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)|❌|Yes|❌|Yes| +|Microsoft Defender Application Guard (MDAG) public APIs|❌|Yes|❌|Yes| +|[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)|❌|Yes|❌|Yes| +|[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)|❌|Yes|❌|Yes| +|[Windows containers](/virtualization/windowscontainers/about/)|Yes|Yes|Yes|Yes| +|[Windows Sandbox](/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Application Isolation features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)|❌|Yes|Yes|Yes|Yes| +|Microsoft Defender Application Guard (MDAG) public APIs|❌|Yes|Yes|Yes|Yes| +|[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)|❌|❌|❌|❌|❌| +|[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)|❌|Yes|Yes|Yes|Yes| +|[Windows containers](/virtualization/windowscontainers/about/)|Yes|Yes|Yes|Yes|Yes| +|[Windows Sandbox](/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/application.md b/windows/security/includes/sections/application.md new file mode 100644 index 0000000000..ed961385ec --- /dev/null +++ b/windows/security/includes/sections/application.md @@ -0,0 +1,26 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +## Application Control + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[User Account Control (UAC)](https://learn.microsoft.com/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | +| **[Windows Defender Application Control (WDAC)](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | | +| **[Smart App Control](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they are using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | + +## Application Isolation + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)** | Standalone mode allows Windows users to use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, user must manually start Microsoft Edge in Application Guard from Edge menu for browsing untrusted sites | +| **[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)** | Microsoft Defender Application Guard protect user's desktop while they browse the Internet using Microsoft Edge browser. Application Guard in enterprise mode automatically redirects untrusted website navigations in an anonymous and isolated Hyper-V based container which is separate from the host operating system. With Enterprise mode you can define your corporate boundaries by explicitly adding trusted domains and can customizing the Application Guard experience to meet and enforce your organization needs on Windows devices. | +| **Microsoft Defender Application Guard (MDAG) public APIs** | Enable applications using them to be isolated Hyper-V based container which is separate from the host operating system. | +| **[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)** | Application Guard protects Office files including Word, PowerPoint, and Excel. Application icons will have a small shield if Application Guard has been enabled and they are under protection. | +| **[Microsoft Defender Application Guard (MDAG) configure via MDM](https://learn.microsoft.com/windows/client-management/mdm/windowsdefenderapplicationguard-csp)** | The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Microsoft Defender Application Guard. | +| **[Windows containers](https://learn.microsoft.com/virtualization/windowscontainers/about/)** | Universal Windows Platform (UWP) applications run in Windows containers known as app containers. Processes that run in app containers operate with low integrity level, meaning they have limited access to resources they do not own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the filesystem, registry, and other resources. The app container also enforces restrictions on network connectivity; for example, access to a local host is not allowed. As a result, malware or infected apps have limited footprint for escape. | +| **[Windows Sandbox](https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)** | Windows Sandbox provides a lightweight desktop environment to safely run untrusted Win32 applications in isolation, using the same hardware-based Hyper-V virtualization technology to isolate apps without fear of lasting impact to your PC. | diff --git a/windows/security/includes/sections/cloud-services-protecting-your-work-information-overview.md b/windows/security/includes/sections/cloud-services-protecting-your-work-information-overview.md new file mode 100644 index 0000000000..ecd8d4c9c6 --- /dev/null +++ b/windows/security/includes/sections/cloud-services-protecting-your-work-information-overview.md @@ -0,0 +1,26 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Protecting Your Work Information features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](/azure/active-directory/devices/concept-azure-ad-join)|Yes|Yes|Yes|Yes| +|[Security baselines](/mem/intune/protect/security-baselines)|Yes|Yes|Yes|Yes| +|[Remote wipe](/windows/client-management/mdm/remotewipe-csp)|Yes|Yes|Yes|Yes| +|[Manage by Mobile Device Management (MDM) and group policy](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)|Yes|Yes|Yes|Yes| +|[Universal Print](/universal-print/)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Protecting Your Work Information features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](/azure/active-directory/devices/concept-azure-ad-join)|Yes|Yes|Yes|Yes|Yes| +|[Security baselines](/mem/intune/protect/security-baselines)|Yes|Yes|Yes|Yes|Yes| +|[Remote wipe](/windows/client-management/mdm/remotewipe-csp)|Yes|Yes|Yes|Yes|Yes| +|[Manage by Mobile Device Management (MDM) and group policy](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)|Yes|Yes|Yes|Yes|Yes| +|[Universal Print](/universal-print/)|❌|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/cloud-services-update-overview.md b/windows/security/includes/sections/cloud-services-update-overview.md new file mode 100644 index 0000000000..b20a97756d --- /dev/null +++ b/windows/security/includes/sections/cloud-services-update-overview.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Update features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Windows Autopatch](/windows/deployment/windows-autopatch/)|❌|Yes|❌|Yes| +|[Windows Autopilot](/windows/deployment/windows-autopilot)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Update features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Windows Autopatch](/windows/deployment/windows-autopatch/)|❌|Yes|Yes|❌|❌| +|[Windows Autopilot](/windows/deployment/windows-autopilot)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/cloud-services.md b/windows/security/includes/sections/cloud-services.md new file mode 100644 index 0000000000..47390fb38b --- /dev/null +++ b/windows/security/includes/sections/cloud-services.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +## Protecting Your Work Information + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join)** | | +| **[Security baselines](https://learn.microsoft.com/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client. Windows 11 can be configured with Microsoft’s MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | +| **[Remote wipe](https://learn.microsoft.com/windows/client-management/mdm/remotewipe-csp)** | When a device is lost or stolen, IT administrators might want to remotely wipe data stored in memory and hard disks. A help desk agent might also want to reset devices to fix issues encountered by remote workers. Windows 11 supports the Remote Wipe configuration service provider (CSP) so that MDM solutions can remotely initiate any of the following operations: 1) Reset the device and remove user accounts and data. 2) Reset the device and clean the drive. 3) Reset the device but persist user accounts and data. | +| **[Manage by Mobile Device Management (MDM) and group policy](https://learn.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)** | | +| **[Universal Print](https://learn.microsoft.com/universal-print/)** | | + +## Update + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Windows Autopatch](https://learn.microsoft.com/windows/deployment/windows-autopatch/)** | With the Autopatch service, IT teams can delegate management of updates to Windows 10/11, Microsoft Edge, and Microsoft 365 apps to Microsoft. Under the hood, Autopatch takes over configuration of the policies and deployment service of Windows Update for Business. What the customer gets are endpoints that are up to date, thanks to dynamically generated rings for progressive deployment that will pause and/or roll back updates (where possible) when issues arise. The goal is to provide peace of mind to IT pros, encourage rapid adoption of updates, and to reduce bandwidth required to deploy them successfully, thereby closing gaps in protection that may have been open to exploitation by malicious actors. | +| **[Windows Autopilot](https://learn.microsoft.com/windows/deployment/windows-autopilot)** | | diff --git a/windows/security/includes/sections/hardware-hardware-root-of-trust-overview.md b/windows/security/includes/sections/hardware-hardware-root-of-trust-overview.md new file mode 100644 index 0000000000..f1f16ade3e --- /dev/null +++ b/windows/security/includes/sections/hardware-hardware-root-of-trust-overview.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Hardware Root-Of-Trust features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Windows Defender System Guard](/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)|Yes|Yes|Yes|Yes| +|[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)|Yes|Yes|Yes|Yes| +|[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Hardware Root-Of-Trust features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Windows Defender System Guard](/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)|Yes|Yes|Yes|Yes|Yes| +|[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/hardware-silicon-assisted-security-secured-kernel-overview.md b/windows/security/includes/sections/hardware-silicon-assisted-security-secured-kernel-overview.md new file mode 100644 index 0000000000..b6c18f1b62 --- /dev/null +++ b/windows/security/includes/sections/hardware-silicon-assisted-security-secured-kernel-overview.md @@ -0,0 +1,26 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Silicon Assisted Security (Secured Kernel) features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)|Yes|Yes|Yes|Yes| +|[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)|Yes|Yes|Yes|Yes| +|[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)|Yes|Yes|Yes|Yes| +|[Secured-core PC](/windows-hardware/design/device-experiences/oem-highly-secure-11)|Yes|Yes|Yes|Yes| +|[Kernel Direct Memory Access (DMA) protection](/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Silicon Assisted Security (Secured Kernel) features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)|Yes|Yes|Yes|Yes|Yes| +|[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)|Yes|Yes|Yes|Yes|Yes| +|[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)|Yes|Yes|Yes|Yes|Yes| +|[Secured-core PC](/windows-hardware/design/device-experiences/oem-highly-secure-11)|Yes|Yes|Yes|Yes|Yes| +|[Kernel Direct Memory Access (DMA) protection](/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/hardware.md b/windows/security/includes/sections/hardware.md new file mode 100644 index 0000000000..66b94bb83e --- /dev/null +++ b/windows/security/includes/sections/hardware.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +## Hardware Root-Of-Trust + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Windows Defender System Guard](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)** | | +| **[Trusted Platform Module (TPM) 2.0](https://learn.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance. Starting with Windows 10, Microsoft’s hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | +| **[Microsoft Pluton security processor](https://learn.microsoft.com/windows/security/information-protection/pluton/microsoft-pluton-security-processor)** | Microsoft Pluton security processors are designed by Microsoft in partnership with silicon partners. Pluton enhances the protection of Windows 11 devices with a hardware root-of-trust that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface as it integrates the security chip directly into the processor. It can be used with a discreet TPM 2.0 or as a standalone security processor. When root of trust is located on a separate, discrete chip on the motherboard, the communication path between the root-of-trust and the CPU can be vulnerable to physical attack. Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPMs including BitLocker, Windows Hello, and Windows Defender System Guard. In addition to providing root-of trust, Pluton also supports other security functionality beyond what is possible with the TPM 2.0 specification, and this extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. Pluton enabled Windows 11 devices are available and the selection of options with Pluton is growing. | + +## Silicon Assisted Security (Secured Kernel) + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Virtualization-based security (VBS)](https://learn.microsoft.com/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS) also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Hypervisor-protected Code Integrity (HVCI)](https://learn.microsoft.com/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run. HVCI helps ensure that only validated code can be executed in kernel-mode. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)** | Hardware-enforced stack protection integrates software and hardware for a modern defense against cyberthreats such as memory corruption and zero-day exploits. Based on Control-flow Enforcement Technology (CET) from Intel and AMD Shadow Stacks, hardware-enforced stack protection is designed to protect against exploit techniques that try to hijack return addresses on the stack. | +| **[Secured-core PC](https://learn.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure-11)** | Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs. The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows. Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root of trust. Virtualization-based security comes enabled by default. And with built-in hypervisor protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all executables are signed by known and approved authorities only. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks. | +| **[Kernel Direct Memory Access (DMA) protection](https://learn.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)** | Kernel DMA Protection protects against external peripherals from gaining unauthorized access to memory. Physical threats such as drive-by Direct Memory Access (DMA) attacks typically happen quickly while the system owner isn’t present. PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot plug ports are external and easily accessible, PCs are susceptible to drive-by DMA attacks. | diff --git a/windows/security/includes/sections/identity-advanced-credential-protection-overview.md b/windows/security/includes/sections/identity-advanced-credential-protection-overview.md new file mode 100644 index 0000000000..c8f646fb31 --- /dev/null +++ b/windows/security/includes/sections/identity-advanced-credential-protection-overview.md @@ -0,0 +1,28 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Advanced Credential Protection features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Windows LAPS](/windows-server/identity/laps/laps-overview)|Yes|Yes|Yes|Yes| +|[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)|Yes|Yes|Yes|Yes| +|[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)|Yes|Yes|Yes|Yes| +|[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)|Yes|Yes|Yes|Yes| +|[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)|❌|Yes|❌|Yes| +|[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Advanced Credential Protection features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Windows LAPS](/windows-server/identity/laps/laps-overview)|Yes|Yes|Yes|Yes|Yes| +|[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)|Yes|Yes|Yes|Yes|Yes| +|[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)|Yes|Yes|Yes|Yes|Yes| +|[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)|Yes|Yes|Yes|Yes|Yes| +|[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)|❌|Yes|Yes|Yes|Yes| +|[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/identity-passwordless-sign-in-overview.md b/windows/security/includes/sections/identity-passwordless-sign-in-overview.md new file mode 100644 index 0000000000..c2666f968d --- /dev/null +++ b/windows/security/includes/sections/identity-passwordless-sign-in-overview.md @@ -0,0 +1,28 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Passwordless Sign In features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)|Yes|Yes|Yes|Yes| +|[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)|Yes|Yes|Yes|Yes| +|[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)|Yes|Yes|Yes|Yes| +|[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)|Yes|Yes|Yes|Yes| +|[Federated sign-in](/education/windows/federated-sign-in)|❌|❌|Yes|Yes| +|[Smart Cards for Windows Service](/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Passwordless Sign In features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)|Yes|Yes|Yes|Yes|Yes| +|[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)|Yes|Yes|Yes|Yes|Yes| +|[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)|Yes|Yes|Yes|Yes|Yes| +|[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)|Yes|Yes|Yes|Yes|Yes| +|[Federated sign-in](/education/windows/federated-sign-in)|❌|❌|❌|Yes|Yes| +|[Smart Cards for Windows Service](/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md new file mode 100644 index 0000000000..cb24042348 --- /dev/null +++ b/windows/security/includes/sections/identity.md @@ -0,0 +1,28 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +## Passwordless Sign In + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Windows Hello for Business](https://learn.microsoft.com/windows/security/identity-protection/hello-for-business)** | | +| **[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)** | Windows presence sensing provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to your presence to help you stay secure and productive, whether you’re working at home, the office, or a public environment. Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to automatically lock your device when you leave, and then unlock your device and sign you in using Windows Hello facial recognition when you return. Requires OEM supporting hardware. | +| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](https://learn.microsoft.com/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in. Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process. Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more. For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. For facial recognition, Enhanced Sign-in Security is supported by Intel USB and AMD USB processor/camera combinations including specific modules from manufacturers. Intel MIPI is supported starting with version Windows 11 2022 Update. | +| **[Fast Identity Online (FIDO2) security key](https://learn.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets. Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | +| **[Federated sign-in](https://learn.microsoft.com/education/windows/federated-sign-in)** | Windows 11 supports federated sign in with external education identity management services. For students unable to type easily or remember complex passwords, this capability enables secure sign in through methods like QR codes or pictures. | +| **[Smart Cards for Windows Service](https://learn.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)** | Organizations also have the option of using smart cards, an authentication method that pre-dates biometric sign in. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating clients, signing code, securing e-mail, and signing in with Windows domain accounts. Smart cards can only be used to sign into domain accounts, not local accounts. When a password is used to sign into a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. | + +## Advanced Credential Protection + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Windows LAPS](https://learn.microsoft.com/windows-server/identity/laps/laps-overview)** | | +| **[Account Lockout Policy](https://learn.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | +| **[Enhanced phishing protection with SmartScreen](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | People who are still using passwords can benefit from powerful credential protection in Windows 11. Microsoft Defender SmartScreen now includes enhanced phishing protection to automatically detect when you enter your Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if your credentials are at risk. Because you are alerted at the moment of potential credential theft, you can take pre-emptive action before your password is used against you or your organization. | +| **[Access Control (ACLs/SCALS)](https://learn.microsoft.com/windows/security/identity-protection/access-control/access-control)** | Access control in Windows help ensure that shared resources are available to users and groups in addition to the resource owner and are protected from unauthorized use. IT administrators can manage users’, groups’, and computers’ access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions. Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | +| **[Windows Defender Credential Guard](https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard)** | | +| **[Windows Defender Remote Credential Guard](https://learn.microsoft.com/windows/security/identity-protection/remote-credential-guard)** | | diff --git a/windows/security/includes/sections/operating-system-data-protection-overview.md b/windows/security/includes/sections/operating-system-data-protection-overview.md new file mode 100644 index 0000000000..68b64731f3 --- /dev/null +++ b/windows/security/includes/sections/operating-system-data-protection-overview.md @@ -0,0 +1,26 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Data Protection features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[BitLocker management](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)|Yes|Yes|Yes|Yes| +|[BitLocker enablement](/windows/security/information-protection/bitlocker/bitlocker-overview)|Yes|Yes|Yes|Yes| +|[Encrypted hard drive](/windows/security/information-protection/encrypted-hard-drive)|Yes|Yes|Yes|Yes| +|[Personal data encryption (PDE)](/windows/security/information-protection/personal-data-encryption/overview-pde)|❌|Yes|❌|Yes| +|[Email Encryption (S/MIME)](/windows/security/identity-protection/configure-s-mime)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Data Protection features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[BitLocker management](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)|❌|Yes|Yes|Yes|Yes| +|[BitLocker enablement](/windows/security/information-protection/bitlocker/bitlocker-overview)|Yes|Yes|Yes|Yes|Yes| +|[Encrypted hard drive](/windows/security/information-protection/encrypted-hard-drive)|Yes|Yes|Yes|Yes|Yes| +|[Personal data encryption (PDE)](/windows/security/information-protection/personal-data-encryption/overview-pde)|❌|Yes|Yes|Yes|Yes| +|[Email Encryption (S/MIME)](/windows/security/identity-protection/configure-s-mime)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/operating-system-modern-device-management-overview.md b/windows/security/includes/sections/operating-system-modern-device-management-overview.md new file mode 100644 index 0000000000..b43f14f6ef --- /dev/null +++ b/windows/security/includes/sections/operating-system-modern-device-management-overview.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Modern Device Management features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)|Yes|Yes|Yes|Yes| +|[Secured-core configuration lock](/windows/client-management/config-lock)|Yes|Yes|Yes|Yes| +|[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Modern Device Management features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)|Yes|Yes|Yes|Yes|Yes| +|[Secured-core configuration lock](/windows/client-management/config-lock)|Yes|Yes|Yes|Yes|Yes| +|[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/operating-system-network-security-overview.md b/windows/security/includes/sections/operating-system-network-security-overview.md new file mode 100644 index 0000000000..95b71a85f8 --- /dev/null +++ b/windows/security/includes/sections/operating-system-network-security-overview.md @@ -0,0 +1,36 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Network Security features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Transport layer security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)|Yes|Yes|Yes|Yes| +|Bluetooth pairing and connection protection|Yes|Yes|Yes|Yes| +|[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)|Yes|Yes|Yes|Yes| +|Opportunistic Wireless Encryption (OWE)|Yes|Yes|Yes|Yes| +|[Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)|Yes|Yes|Yes|Yes| +|[Virtual Private Network (VPN)](/windows/security/identity-protection/vpn/vpn-guide)|Yes|Yes|Yes|Yes| +|[Always On VPN (device tunnel)](/windows-server/remote/remote-access/vpn/always-on-vpn/)|❌|Yes|❌|Yes| +|[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)|❌|Yes|❌|Yes| +|[Server Message Block (SMB) file service](/windows-server/storage/file-server/file-server-smb-overview)|Yes|Yes|Yes|Yes| +|[Server Message Block Direct (SMB Direct)](/windows-server/storage/file-server/smb-direct)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Network Security features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Transport layer security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)|Yes|Yes|Yes|Yes|Yes| +|Bluetooth pairing and connection protection|Yes|Yes|Yes|Yes|Yes| +|[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)|Yes|Yes|Yes|Yes|Yes| +|Opportunistic Wireless Encryption (OWE)|Yes|Yes|Yes|Yes|Yes| +|[Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)|Yes|Yes|Yes|Yes|Yes| +|[Virtual Private Network (VPN)](/windows/security/identity-protection/vpn/vpn-guide)|Yes|Yes|Yes|Yes|Yes| +|[Always On VPN (device tunnel)](/windows-server/remote/remote-access/vpn/always-on-vpn/)|❌|Yes|Yes|Yes|Yes| +|[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)|❌|Yes|Yes|Yes|Yes| +|[Server Message Block (SMB) file service](/windows-server/storage/file-server/file-server-smb-overview)|Yes|Yes|Yes|Yes|Yes| +|[Server Message Block Direct (SMB Direct)](/windows-server/storage/file-server/smb-direct)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/operating-system-system-security-overview.md b/windows/security/includes/sections/operating-system-system-security-overview.md new file mode 100644 index 0000000000..426c265aca --- /dev/null +++ b/windows/security/includes/sections/operating-system-system-security-overview.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all System Security features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Secure Boot and Trusted Boot](/windows/security/trusted-boot)|Yes|Yes|Yes|Yes| +|[Measured boot](/windows/compatibility/measured-boot)|Yes|Yes|Yes|Yes| +|[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all System Security features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Secure Boot and Trusted Boot](/windows/security/trusted-boot)|Yes|Yes|Yes|Yes|Yes| +|[Measured boot](/windows/compatibility/measured-boot)|Yes|Yes|Yes|Yes|Yes| +|[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/operating-system-virus-and-threat-protection-overview.md b/windows/security/includes/sections/operating-system-virus-and-threat-protection-overview.md new file mode 100644 index 0000000000..4853fdc620 --- /dev/null +++ b/windows/security/includes/sections/operating-system-virus-and-threat-protection-overview.md @@ -0,0 +1,34 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Virus And Threat Protection features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)|Yes|Yes|Yes|Yes| +|Local Security Authority (LSA) Protection|Yes|Yes|Yes|Yes| +|[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)|Yes|Yes|Yes|Yes| +|[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)|Yes|Yes|Yes|Yes| +|[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)|Yes|Yes|Yes|Yes| +|[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)|Yes|Yes|Yes|Yes| +|[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)|Yes|Yes|Yes|Yes| +|[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)|Yes|Yes|Yes|Yes| +|[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Virus And Threat Protection features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)|Yes|Yes|Yes|Yes|Yes| +|Local Security Authority (LSA) Protection|Yes|Yes|Yes|Yes|Yes| +|[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)|Yes|Yes|Yes|Yes|Yes| +|[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)|Yes|Yes|Yes|Yes|Yes| +|[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)|Yes|Yes|Yes|Yes|Yes| +|[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)|Yes|Yes|Yes|Yes|Yes| +|[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)|❌|❌|Yes|❌|Yes| diff --git a/windows/security/includes/sections/operating-system.md b/windows/security/includes/sections/operating-system.md new file mode 100644 index 0000000000..30e1709b0e --- /dev/null +++ b/windows/security/includes/sections/operating-system.md @@ -0,0 +1,61 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +## System Security + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Secure Boot and Trusted Boot](https://learn.microsoft.com/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows 11 device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows 11 system boots up safely and securely. | +| **[Measured boot](https://learn.microsoft.com/windows/compatibility/measured-boot)** | | +| **[Device health attestation service](https://learn.microsoft.com/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. These determinations are made with data stored in the TPM which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Endpoint Manager reviews device health and connects this information with Azure Active Directory for conditional access. | + +## Virus And Threat Protection + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Microsoft Defender Antivirus](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a next-generation protection solution included in all versions of Windows 10 and Windows 11. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. In addition to real time protection, updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus, includes real-time, behavior-based, and heuristic antivirus protection. This combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but are not considered malware. | +| **Local Security Authority (LSA) Protection** | Windows has several critical processes to verify a user’s identity. Verification processes include Local Security Authority (LSA) which is responsible for authenticating users and verifying Windows logins. LSA handles tokens and credentials such as passwords that are used for single sign-on to a Microsoft account and Azure services. To help protect these credentials, additional LSA protection only allows loading of trusted, signed code and provides significant protection against Credential theft. LSA protection will be enabled by default on new, enterprise joined Windows 11 devices with added support for non-UEFI lock and policy management controls via MDM/GP. | +| **[Attack surface reduction (ASR)](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization. Administrators can configure specific attack surface reduction rules to help block certain behaviors, such as 1) Launching executable files and scripts that attempt to download or run files 2) Running obfuscated or otherwise suspicious scripts 3) Performing behaviors that apps don’t usually initiate during normal day-to-day work. | +| **[Tamper protection settings for MDE](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | | +| **[Microsoft Vulnerable Driver Blocklist](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to Windows 11 2022 Update, Windows enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Beginning with Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs and users can opt-in to enforce the policy from the Windows Security app. | +| **[Controlled folder access](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders. Controlled folder access helps protect user’s valuable data from malicious apps and threats, such as ransomware. | +| **[Exploit protection](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use Group Policy in Azure Active Directory to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | +| **[Microsoft Defender SmartScreen](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their Microsoft credentials into a potentially risky location. IT can customize which notifications appear through Microsoft Endpoint Manager. This protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. Because Windows 11 comes with these enhancements already built-in and enabled, users have extra security from the moment they turn on their device. | +| **[Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents 1) Endpoint behavioral sensors, 2) Cloud security analytics 3) Threat intelligence 4) Rich response capabilities. | + +## Network Security + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Transport layer security (TLS)](https://learn.microsoft.com/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | +| **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | +| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | "The current security standard for Wi-Fi Authentication is WPA3 which provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows support 3 WPA3 modes – WPA3 personal, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B Window includes WPA3 personal with the new H2E protocol, and WPA3 Enterprise 192-bit Suite B Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication " | +| **Opportunistic Wireless Encryption (OWE)** | Opportunistic Wireless Encryption (OWE) is a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots. | +| **[Windows Firewall](https://learn.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Security is an important part of a layered security model. It provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Win 11 Firewall offers the following benefits 1) Reduces the risk of network security threats: Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. 2) Safeguards sensitive data and intellectual property: With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. 3) Extends the value of existing investments: Windows Firewall is a host based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | +| **[Virtual Private Network (VPN)](https://learn.microsoft.com/windows/security/identity-protection/vpn/vpn-guide)** | Organizations have long relied on Windows to provide reliable, secured, and manageable virtual private network (VPN) solutions. The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways. In Windows 11 we’ve integrated the most commonly used VPN controls right into the Windows 11 Quick Actions pane. From the Quick Actions pane users can see the status of their VPN, start and stop the VPN tunnels, and with one click can go to the modern Settings app for more control. For E3 customers you have the option to have this always on by default. | +| **[Always On VPN (device tunnel)](https://learn.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/)** | | +| **[Direct Access](https://learn.microsoft.com/windows-server/remote/remote-access/directaccess/directaccess)** | | +| **[Server Message Block (SMB) file service](https://learn.microsoft.com/windows-server/storage/file-server/file-server-smb-overview)** | SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks. SMB and file services are the most common Windows workload in the commercial and public sector ecosystem. In Windows 11, the SMB protocol has significant security updates to meet today’s threats, including AES-256 bits encryption, accelerated SMB signing, Remote Directory Memory Access (RDMA) network encryption, and entirely new scenario, SMB over QUIC for untrusted networks. Windows 11 introduces AES-256-GCM and AES-256-CCM cryptographic suites for SMB 3.1.1 encryption. Windows administrators can mandate the use of this more advanced security or continue to use the more compatible and still-safe AES-128 encryption. | +| **[Server Message Block Direct (SMB Direct)](https://learn.microsoft.com/windows-server/storage/file-server/smb-direct)** | In Windows 11 Enterprise, Education, and Pro Workstation, SMB Direct now supports encryption. For demanding workloads like video rendering, data science, or extremely large files, you can now operate with the same safety as traditional TCP and the performance of RDMA. Previously, enabling SMB encryption disabled direct data placement, making RDMA as slow as TCP. Now data is encrypted before placement, leading to relatively minor performance degradation while adding AES-128 and AES-256 protected packet privacy. | + +## Data Protection + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[BitLocker management](https://learn.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)** | | +| **[BitLocker enablement](https://learn.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview)** | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune using a configuration service provider (CSP). BitLocker provides encryption for the OS, fixed data, and removable data drives leveraging technologies like hardware security test interface (HSTI), Modern Standby, UEFI Secure Boot and TPM. | +| **[Encrypted hard drive](https://learn.microsoft.com/windows/security/information-protection/encrypted-hard-drive)** | Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives. By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. Encrypted hard drives enable 1) Smooth performance: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate without performance degradation. 2) Strong security based in hardware: Encryption is always “on” and the keys for encryption never leave the hard drive. The drive authenticates users independently from the operating system before it unlocks. 3) Ease of use: Encryption is transparent to the user and the user does not need to enable it. Encrypted hard drives are easily erased using an on-board encryption key; there is no need to re-encrypt data on the drive. 4) Lower cost of ownership: There is no need for new infrastructure to manage encryption keys since BitLocker leverages your existing infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process. | +| **[Personal data encryption (PDE)](https://learn.microsoft.com/windows/security/information-protection/personal-data-encryption/overview-pde)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow. Windows Hello for Business, either with PIN or biometrics (Face or Fingerprint), is used to protect the container which houses the encryption keys used by PDE. When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content. | +| **[Email Encryption (S/MIME)](https://learn.microsoft.com/windows/security/identity-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital identification (ID)—also called a certificate—can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message has not been tampered with. These encrypted messages can be sent by a user to people within their organization as well as external contacts if they have proper encryption certificates. | + +## Modern Device Management + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Windows Security policy settings and auditing](https://learn.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies IT administrators can use to help protect Windows devices and other resources in your organization. Security settings policies are rules you can configure on a device, or multiple devices, to control - User authentication to a network or device, Resources users are permitted to access, Whether to record a user’s or group’s actions in the event log, Membership in a group. | +| **[Secured-core configuration lock](https://learn.microsoft.com/windows/client-management/config-lock)** | In an enterprise organization, IT administrators enforce policies on their corporate devices to protect the OS and keep devices in a compliant state by preventing users from changing configurations and creating configuration drift. Configuration drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Secured-core configuration lock (config lock) is a Secured-core PC feature that prevents users from making unwanted changes to security settings. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. | +| **[Assigned Access (kiosk mode)](https://learn.microsoft.com/windows/configuration/kiosk-methods)** | | diff --git a/windows/security/includes/sections/privacy.md b/windows/security/includes/sections/privacy.md new file mode 100644 index 0000000000..cb5118754a --- /dev/null +++ b/windows/security/includes/sections/privacy.md @@ -0,0 +1,6 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- diff --git a/windows/security/includes/sections/security-foundations-certification-overview.md b/windows/security/includes/sections/security-foundations-certification-overview.md new file mode 100644 index 0000000000..78601c07dd --- /dev/null +++ b/windows/security/includes/sections/security-foundations-certification-overview.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +The following table lists the edition applicability for all Certification features. + +|Feature|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| +|:-:|:-:|:-:|:-:|:-:| +|[Common Criteria certifications](/windows/security/threat-protection/windows-platform-common-criteria)|Yes|Yes|Yes|Yes| +|[Federal Information Processing Standard (FIPS) 140 validation](/windows/security/threat-protection/fips-140-validation)|Yes|Yes|Yes|Yes| + +The following table lists the licensing applicability for all Certification features. + +|Feature|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|:-:|:-:|:-:|:-:|:-:|:-:| +|[Common Criteria certifications](/windows/security/threat-protection/windows-platform-common-criteria)|Yes|Yes|Yes|Yes|Yes| +|[Federal Information Processing Standard (FIPS) 140 validation](/windows/security/threat-protection/fips-140-validation)|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/includes/sections/security-foundations.md b/windows/security/includes/sections/security-foundations.md new file mode 100644 index 0000000000..fec88db411 --- /dev/null +++ b/windows/security/includes/sections/security-foundations.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 06/02/2023 +ms.topic: include +--- + +## Certification + +| Security Measures | Features & Capabilities | +|:---|:---| +| **[Common Criteria certifications](https://learn.microsoft.com/windows/security/threat-protection/windows-platform-common-criteria)** | Microsoft is committed to supporting product security standards and certifications, including FIPS 140 and Common Criteria as an external validation of security assurance. Common Criteria (CC) is an international standard currently maintained by national governments who participate in the Common Criteria Recognition Arrangement. CC defines a common taxonomy for security functional requirements, security assurance requirements, and an evaluation methodology used to ensure products undergoing evaluation satisfy the functional and assurance requirements. Microsoft Windows client and server products  incorporate the features and functions required by relevant Common Criteria Protection Profiles and completes Common Criteria certifications. | +| **[Federal Information Processing Standard (FIPS) 140 validation](https://learn.microsoft.com/windows/security/threat-protection/fips-140-validation)** | The Federal Information Processing Standard (FIPS) Publication 140 is a U.S. government standard that defines the minimum security requirements for cryptographic modules in IT products. Microsoft maintains an active commitment to meeting the requirements of the FIPS 140 standard, having validated cryptographic modules against FIPS 140-2 since it was first established in 2001. Multiple Microsoft products, including Windows 11, Windows 10, Windows Server, and many cloud services, use these cryptographic modules. | diff --git a/windows/security/index.yml b/windows/security/index.yml index 8166e0bbb9..49ea17d20f 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -57,7 +57,7 @@ landingContent: - linkListType: overview links: - text: Overview - url: operating-system-security\operating-system.md + url: operating-system-security/index.md - linkListType: concept links: - text: Trusted boot diff --git a/windows/security/operating-system-security/index.md b/windows/security/operating-system-security/index.md new file mode 100644 index 0000000000..cb0887f0d5 --- /dev/null +++ b/windows/security/operating-system-security/index.md @@ -0,0 +1,25 @@ +--- +title: Windows operating system security +description: Securing the operating system includes system security, encryption, network security, and threat protection. +ms.reviewer: +ms.topic: article +manager: aaroncz +ms.author: vinpa +author: vinaypamnani-msft +ms.prod: windows-client +ms.technology: itpro-security +ms.date: 09/21/2021 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 +--- + +# Windows operating system security + +Security and privacy depend on an operating system that guards your system and information from the moment it starts up, providing fundamental chip-to-cloud protection. Windows 11 is the most secure Windows yet with extensive security measures designed to help keep you safe. These measures include built-in advanced encryption and data protection, robust network and system security, and intelligent safeguards against ever-evolving threats. + +Watch the latest [Microsoft Mechanics Windows 11 security](https://youtu.be/tg9QUrnVFho) video that shows off some of the latest Windows 11 security technology. + +Use the links in the following sections to learn more about the operating system security features and capabilities in Windows. + +[!INCLUDE [operating-system-security](../includes/sections/operating-system.md)] diff --git a/windows/security/operating-system-security/operating-system.md b/windows/security/operating-system-security/operating-system.md deleted file mode 100644 index 663d8c4d0c..0000000000 --- a/windows/security/operating-system-security/operating-system.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Windows operating system security -description: Securing the operating system includes system security, encryption, network security, and threat protection. -ms.reviewer: -ms.topic: article -manager: aaroncz -ms.author: paoloma -author: paolomatarazzo -ms.prod: windows-client -ms.technology: itpro-security -ms.date: 09/21/2021 ---- - -# Windows operating system security - -Security and privacy depend on an operating system that guards your system and information from the moment it starts up, providing fundamental chip-to-cloud protection. Windows 11 is the most secure Windows yet with extensive security measures designed to help keep you safe. These measures include built-in advanced encryption and data protection, robust network and system security, and intelligent safeguards against ever-evolving threats. - -Watch the latest [Microsoft Mechanics Windows 11 security](https://youtu.be/tg9QUrnVFho) video that shows off some of the latest Windows 11 security technology. - -Use the links in the following table to learn more about the operating system security features and capabilities in Windows 11.

- -| Security Measures | Features & Capabilities | -|:---|:---| -| Secure Boot and Trusted Boot | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows system boots up safely and securely.

Learn more [Secure Boot and Trusted Boot](system-security/trusted-boot.md). | -Cryptography and certificate management|Cryptography uses code to convert data so that only a specific recipient can read it by using a key. Cryptography enforces privacy to prevent anyone except the intended recipient from reading data, integrity to ensure data is free of tampering, and authentication that verifies identity to ensure that communication is secure.

Learn more about [Cryptography and certificate management](system-security/cryptography-certificate-mgmt.md).

| -Windows Security app | The Windows built-in security application found in settings provides an at-a-glance view of the security status and health of your device. These insights help you identify issues and take action to make sure you're protected. You can quickly see the status of your virus and threat protection, firewall and network security, device security controls, and more.

Learn more about the [Windows Security app](system-security/windows-defender-security-center/windows-defender-security-center.md).| -| Encryption and data protection | Wherever confidential data is stored, it must be protected against unauthorized access, whether through physical device theft or from malicious applications. Windows provides strong at-rest data-protection solutions that guard against nefarious attackers.

Learn more about [Encryption](../encryption-data-protection.md). -| BitLocker | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later.

Learn more about [BitLocker](../information-protection/bitlocker/bitlocker-overview.md). | -| Encrypted Hard Drive | Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.
By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity.

Learn more about [Encrypted Hard Drives](../information-protection/encrypted-hard-drive.md).| -| S/MIME | S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with.

Learn more about [S/MIME for Windows](data-protection/configure-s-mime.md).| -| Security baselines | A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.

Security baselines are included in the [Security Compliance Toolkit](../threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md) that you can download from the Microsoft Download Center.

Learn more about [security baselines](../threat-protection/windows-security-configuration-framework/windows-security-baselines.md). | -| Virtual Private Network | Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called tunneling protocols, to make a virtual call to a virtual port on a VPN server.

Learn more about [Virtual Private Networks](network-security/vpn/vpn-guide.md).

| -| Windows Defender Firewall | Windows Defender Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device.

Learn more about [Windows Defender Firewall with advanced security](network-security/windows-firewall/windows-firewall-with-advanced-security.md).

-| Antivirus & antimalware protection | Microsoft Defender Antivirus is included in all versions of Windows 10, Windows Server 2016 and later, and Windows 11. If you have another antivirus app installed and turned on, Microsoft Defender Antivirus will turn off automatically. If you uninstall the other app, Microsoft Defender Antivirus will turn back on.

From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. Updates are downloaded automatically to help protect your device from threats. Microsoft Defender Antivirus continually scans for malware and threats, and also detects and blocks [potentially unwanted applications](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (applications that can negatively impact your device even though they are not considered malware).

Microsoft Defender Antivirus integrates with [cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus), which helps ensure near-instant detection and blocking of new and emerging threats.

Learn more about [next-generation protection and Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows).| -| Attack surface reduction rules | Your attack surfaces are the places and ways you are vulnerable to a cyber attack. Attack surface reduction rules are built into Windows and Windows Server to prevent and block certain behaviors that are often abused to compromise your device or network. Such behaviors can include launching scripts or executables that attempt to download or run other files, running suspicious scripts, or performing other behaviors that apps don't typically initiate during normal work. You can configure your attack surface reduction rules to protect against these risky behaviors.

Learn more about [Attack surface reduction rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction) | -| Anti-tampering protection | During cyber attacks (like ransomware attempts), bad actors attempt to disable security features, such as antivirus protection on targeted devices. Bad actors like to disable security features to get easier access to user's data, to install malware, or to otherwise exploit user's data, identity, and devices without fear of being blocked. Tamper protection helps prevent these kinds of activities.

With tamper protection, malware is prevented from taking actions such as:
- Disabling virus and threat protection
- Disabling real-time protection
- Turning off behavior monitoring
- Disabling antivirus (such as IOfficeAntivirus (IOAV))
- Disabling cloud-delivered protection
- Removing security intelligence updates

Learn more about [Tamper protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection). | -| Network protection | Network protection in Windows helps prevent users from accessing dangerous IP addresses and domains that may host phishing scams, exploits, and other malicious content on the Internet. Network protection is part of attack surface reduction and helps provide an extra layer of protection for a user. Using reputation-based services, network protection blocks access to potentially harmful, low-reputation based domains and IP addresses.

In enterprise environments, network protection works best with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/), which provides detailed reporting into protection events as part of larger investigation scenarios.

Learn more about [Network protection](/microsoft-365/security/defender-endpoint/network-protection). | -| Controlled folder access | With controlled folder access, you can protect your valuable information in specific folders by managing apps' access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access helps protect valuable data from malicious apps and threats, such as ransomware.

Learn more about [Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). | -| Exploit protection | Exploit protection, available in Windows 10, version 1709 and later, automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios.

You can enable exploit protection on an individual device, and then use Group Policy to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors.

Learn more about [Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection). | -| Microsoft Defender for Endpoint | Windows E5 customers benefit from [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint), an enterprise endpoint detection and response capability that helps enterprise security teams detect, investigate, and respond to advanced threats. With rich event data and attack insights, Defender for Endpoint enables your security team to investigate incidents and take remediation actions effectively and efficiently.

Defender for Endpoint also is part of [Microsoft 365 Defender](/microsoft-365/security/defender/), a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.

Learn more about [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) and [Microsoft 365 Defender](/microsoft-365/security/defender/). | diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index be60b9bd1d..517ff0f3be 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -18,7 +18,7 @@ appliesto: # Secure the Windows boot process -The Windows OS has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 OS includes a series of security features that can mitigate the effect. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. +Windows has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, Windows includes a series of security features that can mitigate the effect. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. Windows has multiple levels of protection for desktop apps and data, too. Windows Defender Antivirus uses cloud-powered real-time detection to identify and quarantine apps that are known to be malicious. Windows Defender SmartScreen warns users before allowing them to run an untrustworthy app, even if it's recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. @@ -98,7 +98,7 @@ Like most mobile devices, Arm-based devices, such as the Microsoft Surface RT de ## Trusted Boot -Trusted Boot takes over where Secure Boot ends. The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM. If a file has been modified, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. +Trusted Boot takes over where Secure Boot ends. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM. If a file has been modified, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. ## Early Launch Anti-Malware diff --git a/windows/security/operating-system-security/system-security/toc.yml b/windows/security/operating-system-security/system-security/toc.yml index 8d8bf28ca1..2945f5f884 100644 --- a/windows/security/operating-system-security/system-security/toc.yml +++ b/windows/security/operating-system-security/system-security/toc.yml @@ -9,7 +9,7 @@ items: href: protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md - name: Cryptography and certificate management href: cryptography-certificate-mgmt.md -- name: The Windows Security app +- name: Windows Security app href: windows-defender-security-center/windows-defender-security-center.md items: - name: Virus & threat protection diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md index f497976c30..bafcbcac6d 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md @@ -1,5 +1,5 @@ --- -title: The Windows Security app +title: Windows Security app description: The Windows Security app brings together common Windows security features into one place. ms.prod: windows-client ms.localizationpriority: medium @@ -17,7 +17,7 @@ appliesto: - ✅ Windows 10 --- -# The Windows Security app +# Windows Security app This library describes the Windows Security app, and provides information on configuring certain features, including: diff --git a/windows/security/operating-system-security/toc.yml b/windows/security/operating-system-security/toc.yml index 85e304ccef..8df8195bdd 100644 --- a/windows/security/operating-system-security/toc.yml +++ b/windows/security/operating-system-security/toc.yml @@ -1,6 +1,6 @@ items: - name: Overview - href: operating-system.md + href: index.md - name: System security href: system-security/toc.yml - name: Virus and threat protection From 03dbfb4c70343c086b7043f2b3042bf2851e42ba Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 5 Jun 2023 12:49:06 -0400 Subject: [PATCH 06/30] Update links --- .../security/includes/sections/application.md | 18 +++---- .../includes/sections/cloud-services.md | 16 +++--- .../security/includes/sections/hardware.md | 16 +++--- .../security/includes/sections/identity.md | 24 ++++----- .../includes/sections/operating-system.md | 54 +++++++++---------- .../includes/sections/security-foundations.md | 6 +-- 6 files changed, 67 insertions(+), 67 deletions(-) diff --git a/windows/security/includes/sections/application.md b/windows/security/includes/sections/application.md index ed961385ec..21be9b5992 100644 --- a/windows/security/includes/sections/application.md +++ b/windows/security/includes/sections/application.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/02/2023 +ms.date: 06/05/2023 ms.topic: include --- @@ -9,18 +9,18 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[User Account Control (UAC)](https://learn.microsoft.com/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | -| **[Windows Defender Application Control (WDAC)](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | | -| **[Smart App Control](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they are using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | +| **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | +| **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | | +| **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they are using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | ## Application Isolation | Security Measures | Features & Capabilities | |:---|:---| -| **[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)** | Standalone mode allows Windows users to use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, user must manually start Microsoft Edge in Application Guard from Edge menu for browsing untrusted sites | -| **[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)** | Microsoft Defender Application Guard protect user's desktop while they browse the Internet using Microsoft Edge browser. Application Guard in enterprise mode automatically redirects untrusted website navigations in an anonymous and isolated Hyper-V based container which is separate from the host operating system. With Enterprise mode you can define your corporate boundaries by explicitly adding trusted domains and can customizing the Application Guard experience to meet and enforce your organization needs on Windows devices. | +| **[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)** | Standalone mode allows Windows users to use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, user must manually start Microsoft Edge in Application Guard from Edge menu for browsing untrusted sites | +| **[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)** | Microsoft Defender Application Guard protect user's desktop while they browse the Internet using Microsoft Edge browser. Application Guard in enterprise mode automatically redirects untrusted website navigations in an anonymous and isolated Hyper-V based container which is separate from the host operating system. With Enterprise mode you can define your corporate boundaries by explicitly adding trusted domains and can customizing the Application Guard experience to meet and enforce your organization needs on Windows devices. | | **Microsoft Defender Application Guard (MDAG) public APIs** | Enable applications using them to be isolated Hyper-V based container which is separate from the host operating system. | | **[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)** | Application Guard protects Office files including Word, PowerPoint, and Excel. Application icons will have a small shield if Application Guard has been enabled and they are under protection. | -| **[Microsoft Defender Application Guard (MDAG) configure via MDM](https://learn.microsoft.com/windows/client-management/mdm/windowsdefenderapplicationguard-csp)** | The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Microsoft Defender Application Guard. | -| **[Windows containers](https://learn.microsoft.com/virtualization/windowscontainers/about/)** | Universal Windows Platform (UWP) applications run in Windows containers known as app containers. Processes that run in app containers operate with low integrity level, meaning they have limited access to resources they do not own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the filesystem, registry, and other resources. The app container also enforces restrictions on network connectivity; for example, access to a local host is not allowed. As a result, malware or infected apps have limited footprint for escape. | -| **[Windows Sandbox](https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)** | Windows Sandbox provides a lightweight desktop environment to safely run untrusted Win32 applications in isolation, using the same hardware-based Hyper-V virtualization technology to isolate apps without fear of lasting impact to your PC. | +| **[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)** | The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Microsoft Defender Application Guard. | +| **[Windows containers](/virtualization/windowscontainers/about/)** | Universal Windows Platform (UWP) applications run in Windows containers known as app containers. Processes that run in app containers operate with low integrity level, meaning they have limited access to resources they do not own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the filesystem, registry, and other resources. The app container also enforces restrictions on network connectivity; for example, access to a local host is not allowed. As a result, malware or infected apps have limited footprint for escape. | +| **[Windows Sandbox](/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)** | Windows Sandbox provides a lightweight desktop environment to safely run untrusted Win32 applications in isolation, using the same hardware-based Hyper-V virtualization technology to isolate apps without fear of lasting impact to your PC. | diff --git a/windows/security/includes/sections/cloud-services.md b/windows/security/includes/sections/cloud-services.md index 47390fb38b..de74d51fde 100644 --- a/windows/security/includes/sections/cloud-services.md +++ b/windows/security/includes/sections/cloud-services.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/02/2023 +ms.date: 06/05/2023 ms.topic: include --- @@ -9,15 +9,15 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join)** | | -| **[Security baselines](https://learn.microsoft.com/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client. Windows 11 can be configured with Microsoft’s MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | -| **[Remote wipe](https://learn.microsoft.com/windows/client-management/mdm/remotewipe-csp)** | When a device is lost or stolen, IT administrators might want to remotely wipe data stored in memory and hard disks. A help desk agent might also want to reset devices to fix issues encountered by remote workers. Windows 11 supports the Remote Wipe configuration service provider (CSP) so that MDM solutions can remotely initiate any of the following operations: 1) Reset the device and remove user accounts and data. 2) Reset the device and clean the drive. 3) Reset the device but persist user accounts and data. | -| **[Manage by Mobile Device Management (MDM) and group policy](https://learn.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)** | | -| **[Universal Print](https://learn.microsoft.com/universal-print/)** | | +| **[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](/azure/active-directory/devices/concept-azure-ad-join)** | | +| **[Security baselines](/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client. Windows 11 can be configured with Microsoft’s MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | +| **[Remote wipe](/windows/client-management/mdm/remotewipe-csp)** | When a device is lost or stolen, IT administrators might want to remotely wipe data stored in memory and hard disks. A help desk agent might also want to reset devices to fix issues encountered by remote workers. Windows 11 supports the Remote Wipe configuration service provider (CSP) so that MDM solutions can remotely initiate any of the following operations: 1) Reset the device and remove user accounts and data. 2) Reset the device and clean the drive. 3) Reset the device but persist user accounts and data. | +| **[Manage by Mobile Device Management (MDM) and group policy](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)** | | +| **[Universal Print](/universal-print/)** | | ## Update | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Autopatch](https://learn.microsoft.com/windows/deployment/windows-autopatch/)** | With the Autopatch service, IT teams can delegate management of updates to Windows 10/11, Microsoft Edge, and Microsoft 365 apps to Microsoft. Under the hood, Autopatch takes over configuration of the policies and deployment service of Windows Update for Business. What the customer gets are endpoints that are up to date, thanks to dynamically generated rings for progressive deployment that will pause and/or roll back updates (where possible) when issues arise. The goal is to provide peace of mind to IT pros, encourage rapid adoption of updates, and to reduce bandwidth required to deploy them successfully, thereby closing gaps in protection that may have been open to exploitation by malicious actors. | -| **[Windows Autopilot](https://learn.microsoft.com/windows/deployment/windows-autopilot)** | | +| **[Windows Autopatch](/windows/deployment/windows-autopatch/)** | With the Autopatch service, IT teams can delegate management of updates to Windows 10/11, Microsoft Edge, and Microsoft 365 apps to Microsoft. Under the hood, Autopatch takes over configuration of the policies and deployment service of Windows Update for Business. What the customer gets are endpoints that are up to date, thanks to dynamically generated rings for progressive deployment that will pause and/or roll back updates (where possible) when issues arise. The goal is to provide peace of mind to IT pros, encourage rapid adoption of updates, and to reduce bandwidth required to deploy them successfully, thereby closing gaps in protection that may have been open to exploitation by malicious actors. | +| **[Windows Autopilot](/windows/deployment/windows-autopilot)** | | diff --git a/windows/security/includes/sections/hardware.md b/windows/security/includes/sections/hardware.md index 66b94bb83e..b0c2ef45b0 100644 --- a/windows/security/includes/sections/hardware.md +++ b/windows/security/includes/sections/hardware.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/02/2023 +ms.date: 06/05/2023 ms.topic: include --- @@ -9,16 +9,16 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Defender System Guard](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)** | | -| **[Trusted Platform Module (TPM) 2.0](https://learn.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance. Starting with Windows 10, Microsoft’s hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | -| **[Microsoft Pluton security processor](https://learn.microsoft.com/windows/security/information-protection/pluton/microsoft-pluton-security-processor)** | Microsoft Pluton security processors are designed by Microsoft in partnership with silicon partners. Pluton enhances the protection of Windows 11 devices with a hardware root-of-trust that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface as it integrates the security chip directly into the processor. It can be used with a discreet TPM 2.0 or as a standalone security processor. When root of trust is located on a separate, discrete chip on the motherboard, the communication path between the root-of-trust and the CPU can be vulnerable to physical attack. Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPMs including BitLocker, Windows Hello, and Windows Defender System Guard. In addition to providing root-of trust, Pluton also supports other security functionality beyond what is possible with the TPM 2.0 specification, and this extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. Pluton enabled Windows 11 devices are available and the selection of options with Pluton is growing. | +| **[Windows Defender System Guard](/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)** | | +| **[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance. Starting with Windows 10, Microsoft’s hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | +| **[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)** | Microsoft Pluton security processors are designed by Microsoft in partnership with silicon partners. Pluton enhances the protection of Windows 11 devices with a hardware root-of-trust that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface as it integrates the security chip directly into the processor. It can be used with a discreet TPM 2.0 or as a standalone security processor. When root of trust is located on a separate, discrete chip on the motherboard, the communication path between the root-of-trust and the CPU can be vulnerable to physical attack. Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPMs including BitLocker, Windows Hello, and Windows Defender System Guard. In addition to providing root-of trust, Pluton also supports other security functionality beyond what is possible with the TPM 2.0 specification, and this extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. Pluton enabled Windows 11 devices are available and the selection of options with Pluton is growing. | ## Silicon Assisted Security (Secured Kernel) | Security Measures | Features & Capabilities | |:---|:---| -| **[Virtualization-based security (VBS)](https://learn.microsoft.com/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS) also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | -| **[Hypervisor-protected Code Integrity (HVCI)](https://learn.microsoft.com/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run. HVCI helps ensure that only validated code can be executed in kernel-mode. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS) also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run. HVCI helps ensure that only validated code can be executed in kernel-mode. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | | **[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)** | Hardware-enforced stack protection integrates software and hardware for a modern defense against cyberthreats such as memory corruption and zero-day exploits. Based on Control-flow Enforcement Technology (CET) from Intel and AMD Shadow Stacks, hardware-enforced stack protection is designed to protect against exploit techniques that try to hijack return addresses on the stack. | -| **[Secured-core PC](https://learn.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure-11)** | Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs. The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows. Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root of trust. Virtualization-based security comes enabled by default. And with built-in hypervisor protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all executables are signed by known and approved authorities only. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks. | -| **[Kernel Direct Memory Access (DMA) protection](https://learn.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)** | Kernel DMA Protection protects against external peripherals from gaining unauthorized access to memory. Physical threats such as drive-by Direct Memory Access (DMA) attacks typically happen quickly while the system owner isn’t present. PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot plug ports are external and easily accessible, PCs are susceptible to drive-by DMA attacks. | +| **[Secured-core PC](/windows-hardware/design/device-experiences/oem-highly-secure-11)** | Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs. The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows. Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root of trust. Virtualization-based security comes enabled by default. And with built-in hypervisor protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all executables are signed by known and approved authorities only. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks. | +| **[Kernel Direct Memory Access (DMA) protection](/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)** | Kernel DMA Protection protects against external peripherals from gaining unauthorized access to memory. Physical threats such as drive-by Direct Memory Access (DMA) attacks typically happen quickly while the system owner isn’t present. PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot plug ports are external and easily accessible, PCs are susceptible to drive-by DMA attacks. | diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md index cb24042348..47be3d75c6 100644 --- a/windows/security/includes/sections/identity.md +++ b/windows/security/includes/sections/identity.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/02/2023 +ms.date: 06/05/2023 ms.topic: include --- @@ -9,20 +9,20 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Hello for Business](https://learn.microsoft.com/windows/security/identity-protection/hello-for-business)** | | +| **[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)** | | | **[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)** | Windows presence sensing provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to your presence to help you stay secure and productive, whether you’re working at home, the office, or a public environment. Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to automatically lock your device when you leave, and then unlock your device and sign you in using Windows Hello facial recognition when you return. Requires OEM supporting hardware. | -| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](https://learn.microsoft.com/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in. Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process. Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more. For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. For facial recognition, Enhanced Sign-in Security is supported by Intel USB and AMD USB processor/camera combinations including specific modules from manufacturers. Intel MIPI is supported starting with version Windows 11 2022 Update. | -| **[Fast Identity Online (FIDO2) security key](https://learn.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets. Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | -| **[Federated sign-in](https://learn.microsoft.com/education/windows/federated-sign-in)** | Windows 11 supports federated sign in with external education identity management services. For students unable to type easily or remember complex passwords, this capability enables secure sign in through methods like QR codes or pictures. | -| **[Smart Cards for Windows Service](https://learn.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)** | Organizations also have the option of using smart cards, an authentication method that pre-dates biometric sign in. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating clients, signing code, securing e-mail, and signing in with Windows domain accounts. Smart cards can only be used to sign into domain accounts, not local accounts. When a password is used to sign into a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. | +| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in. Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process. Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more. For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. For facial recognition, Enhanced Sign-in Security is supported by Intel USB and AMD USB processor/camera combinations including specific modules from manufacturers. Intel MIPI is supported starting with version Windows 11 2022 Update. | +| **[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets. Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | +| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 supports federated sign in with external education identity management services. For students unable to type easily or remember complex passwords, this capability enables secure sign in through methods like QR codes or pictures. | +| **[Smart Cards for Windows Service](/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)** | Organizations also have the option of using smart cards, an authentication method that pre-dates biometric sign in. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating clients, signing code, securing e-mail, and signing in with Windows domain accounts. Smart cards can only be used to sign into domain accounts, not local accounts. When a password is used to sign into a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. | ## Advanced Credential Protection | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows LAPS](https://learn.microsoft.com/windows-server/identity/laps/laps-overview)** | | -| **[Account Lockout Policy](https://learn.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | -| **[Enhanced phishing protection with SmartScreen](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | People who are still using passwords can benefit from powerful credential protection in Windows 11. Microsoft Defender SmartScreen now includes enhanced phishing protection to automatically detect when you enter your Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if your credentials are at risk. Because you are alerted at the moment of potential credential theft, you can take pre-emptive action before your password is used against you or your organization. | -| **[Access Control (ACLs/SCALS)](https://learn.microsoft.com/windows/security/identity-protection/access-control/access-control)** | Access control in Windows help ensure that shared resources are available to users and groups in addition to the resource owner and are protected from unauthorized use. IT administrators can manage users’, groups’, and computers’ access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions. Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | -| **[Windows Defender Credential Guard](https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard)** | | -| **[Windows Defender Remote Credential Guard](https://learn.microsoft.com/windows/security/identity-protection/remote-credential-guard)** | | +| **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | | +| **[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | +| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | People who are still using passwords can benefit from powerful credential protection in Windows 11. Microsoft Defender SmartScreen now includes enhanced phishing protection to automatically detect when you enter your Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if your credentials are at risk. Because you are alerted at the moment of potential credential theft, you can take pre-emptive action before your password is used against you or your organization. | +| **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows help ensure that shared resources are available to users and groups in addition to the resource owner and are protected from unauthorized use. IT administrators can manage users’, groups’, and computers’ access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions. Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | +| **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | | +| **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | | diff --git a/windows/security/includes/sections/operating-system.md b/windows/security/includes/sections/operating-system.md index 30e1709b0e..3639a0025b 100644 --- a/windows/security/includes/sections/operating-system.md +++ b/windows/security/includes/sections/operating-system.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/02/2023 +ms.date: 06/05/2023 ms.topic: include --- @@ -9,53 +9,53 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Secure Boot and Trusted Boot](https://learn.microsoft.com/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows 11 device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows 11 system boots up safely and securely. | -| **[Measured boot](https://learn.microsoft.com/windows/compatibility/measured-boot)** | | -| **[Device health attestation service](https://learn.microsoft.com/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. These determinations are made with data stored in the TPM which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Endpoint Manager reviews device health and connects this information with Azure Active Directory for conditional access. | +| **[Secure Boot and Trusted Boot](/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows 11 device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows 11 system boots up safely and securely. | +| **[Measured boot](/windows/compatibility/measured-boot)** | | +| **[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. These determinations are made with data stored in the TPM which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Endpoint Manager reviews device health and connects this information with Azure Active Directory for conditional access. | ## Virus And Threat Protection | Security Measures | Features & Capabilities | |:---|:---| -| **[Microsoft Defender Antivirus](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a next-generation protection solution included in all versions of Windows 10 and Windows 11. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. In addition to real time protection, updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus, includes real-time, behavior-based, and heuristic antivirus protection. This combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but are not considered malware. | +| **[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a next-generation protection solution included in all versions of Windows 10 and Windows 11. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. In addition to real time protection, updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus, includes real-time, behavior-based, and heuristic antivirus protection. This combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but are not considered malware. | | **Local Security Authority (LSA) Protection** | Windows has several critical processes to verify a user’s identity. Verification processes include Local Security Authority (LSA) which is responsible for authenticating users and verifying Windows logins. LSA handles tokens and credentials such as passwords that are used for single sign-on to a Microsoft account and Azure services. To help protect these credentials, additional LSA protection only allows loading of trusted, signed code and provides significant protection against Credential theft. LSA protection will be enabled by default on new, enterprise joined Windows 11 devices with added support for non-UEFI lock and policy management controls via MDM/GP. | -| **[Attack surface reduction (ASR)](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization. Administrators can configure specific attack surface reduction rules to help block certain behaviors, such as 1) Launching executable files and scripts that attempt to download or run files 2) Running obfuscated or otherwise suspicious scripts 3) Performing behaviors that apps don’t usually initiate during normal day-to-day work. | -| **[Tamper protection settings for MDE](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | | -| **[Microsoft Vulnerable Driver Blocklist](https://learn.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to Windows 11 2022 Update, Windows enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Beginning with Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs and users can opt-in to enforce the policy from the Windows Security app. | -| **[Controlled folder access](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders. Controlled folder access helps protect user’s valuable data from malicious apps and threats, such as ransomware. | -| **[Exploit protection](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use Group Policy in Azure Active Directory to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | -| **[Microsoft Defender SmartScreen](https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their Microsoft credentials into a potentially risky location. IT can customize which notifications appear through Microsoft Endpoint Manager. This protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. Because Windows 11 comes with these enhancements already built-in and enabled, users have extra security from the moment they turn on their device. | -| **[Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents 1) Endpoint behavioral sensors, 2) Cloud security analytics 3) Threat intelligence 4) Rich response capabilities. | +| **[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization. Administrators can configure specific attack surface reduction rules to help block certain behaviors, such as 1) Launching executable files and scripts that attempt to download or run files 2) Running obfuscated or otherwise suspicious scripts 3) Performing behaviors that apps don’t usually initiate during normal day-to-day work. | +| **[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | | +| **[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to Windows 11 2022 Update, Windows enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Beginning with Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs and users can opt-in to enforce the policy from the Windows Security app. | +| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders. Controlled folder access helps protect user’s valuable data from malicious apps and threats, such as ransomware. | +| **[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use Group Policy in Azure Active Directory to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | +| **[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their Microsoft credentials into a potentially risky location. IT can customize which notifications appear through Microsoft Endpoint Manager. This protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. Because Windows 11 comes with these enhancements already built-in and enabled, users have extra security from the moment they turn on their device. | +| **[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents 1) Endpoint behavioral sensors, 2) Cloud security analytics 3) Threat intelligence 4) Rich response capabilities. | ## Network Security | Security Measures | Features & Capabilities | |:---|:---| -| **[Transport layer security (TLS)](https://learn.microsoft.com/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | +| **[Transport layer security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | | **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | | **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | "The current security standard for Wi-Fi Authentication is WPA3 which provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows support 3 WPA3 modes – WPA3 personal, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B Window includes WPA3 personal with the new H2E protocol, and WPA3 Enterprise 192-bit Suite B Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication " | | **Opportunistic Wireless Encryption (OWE)** | Opportunistic Wireless Encryption (OWE) is a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots. | -| **[Windows Firewall](https://learn.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Security is an important part of a layered security model. It provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Win 11 Firewall offers the following benefits 1) Reduces the risk of network security threats: Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. 2) Safeguards sensitive data and intellectual property: With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. 3) Extends the value of existing investments: Windows Firewall is a host based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | -| **[Virtual Private Network (VPN)](https://learn.microsoft.com/windows/security/identity-protection/vpn/vpn-guide)** | Organizations have long relied on Windows to provide reliable, secured, and manageable virtual private network (VPN) solutions. The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways. In Windows 11 we’ve integrated the most commonly used VPN controls right into the Windows 11 Quick Actions pane. From the Quick Actions pane users can see the status of their VPN, start and stop the VPN tunnels, and with one click can go to the modern Settings app for more control. For E3 customers you have the option to have this always on by default. | -| **[Always On VPN (device tunnel)](https://learn.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/)** | | -| **[Direct Access](https://learn.microsoft.com/windows-server/remote/remote-access/directaccess/directaccess)** | | -| **[Server Message Block (SMB) file service](https://learn.microsoft.com/windows-server/storage/file-server/file-server-smb-overview)** | SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks. SMB and file services are the most common Windows workload in the commercial and public sector ecosystem. In Windows 11, the SMB protocol has significant security updates to meet today’s threats, including AES-256 bits encryption, accelerated SMB signing, Remote Directory Memory Access (RDMA) network encryption, and entirely new scenario, SMB over QUIC for untrusted networks. Windows 11 introduces AES-256-GCM and AES-256-CCM cryptographic suites for SMB 3.1.1 encryption. Windows administrators can mandate the use of this more advanced security or continue to use the more compatible and still-safe AES-128 encryption. | -| **[Server Message Block Direct (SMB Direct)](https://learn.microsoft.com/windows-server/storage/file-server/smb-direct)** | In Windows 11 Enterprise, Education, and Pro Workstation, SMB Direct now supports encryption. For demanding workloads like video rendering, data science, or extremely large files, you can now operate with the same safety as traditional TCP and the performance of RDMA. Previously, enabling SMB encryption disabled direct data placement, making RDMA as slow as TCP. Now data is encrypted before placement, leading to relatively minor performance degradation while adding AES-128 and AES-256 protected packet privacy. | +| **[Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Security is an important part of a layered security model. It provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Win 11 Firewall offers the following benefits 1) Reduces the risk of network security threats: Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. 2) Safeguards sensitive data and intellectual property: With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. 3) Extends the value of existing investments: Windows Firewall is a host based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | +| **[Virtual Private Network (VPN)](/windows/security/identity-protection/vpn/vpn-guide)** | Organizations have long relied on Windows to provide reliable, secured, and manageable virtual private network (VPN) solutions. The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways. In Windows 11 we’ve integrated the most commonly used VPN controls right into the Windows 11 Quick Actions pane. From the Quick Actions pane users can see the status of their VPN, start and stop the VPN tunnels, and with one click can go to the modern Settings app for more control. For E3 customers you have the option to have this always on by default. | +| **[Always On VPN (device tunnel)](/windows-server/remote/remote-access/vpn/always-on-vpn/)** | | +| **[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)** | | +| **[Server Message Block (SMB) file service](/windows-server/storage/file-server/file-server-smb-overview)** | SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks. SMB and file services are the most common Windows workload in the commercial and public sector ecosystem. In Windows 11, the SMB protocol has significant security updates to meet today’s threats, including AES-256 bits encryption, accelerated SMB signing, Remote Directory Memory Access (RDMA) network encryption, and entirely new scenario, SMB over QUIC for untrusted networks. Windows 11 introduces AES-256-GCM and AES-256-CCM cryptographic suites for SMB 3.1.1 encryption. Windows administrators can mandate the use of this more advanced security or continue to use the more compatible and still-safe AES-128 encryption. | +| **[Server Message Block Direct (SMB Direct)](/windows-server/storage/file-server/smb-direct)** | In Windows 11 Enterprise, Education, and Pro Workstation, SMB Direct now supports encryption. For demanding workloads like video rendering, data science, or extremely large files, you can now operate with the same safety as traditional TCP and the performance of RDMA. Previously, enabling SMB encryption disabled direct data placement, making RDMA as slow as TCP. Now data is encrypted before placement, leading to relatively minor performance degradation while adding AES-128 and AES-256 protected packet privacy. | ## Data Protection | Security Measures | Features & Capabilities | |:---|:---| -| **[BitLocker management](https://learn.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)** | | -| **[BitLocker enablement](https://learn.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview)** | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune using a configuration service provider (CSP). BitLocker provides encryption for the OS, fixed data, and removable data drives leveraging technologies like hardware security test interface (HSTI), Modern Standby, UEFI Secure Boot and TPM. | -| **[Encrypted hard drive](https://learn.microsoft.com/windows/security/information-protection/encrypted-hard-drive)** | Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives. By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. Encrypted hard drives enable 1) Smooth performance: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate without performance degradation. 2) Strong security based in hardware: Encryption is always “on” and the keys for encryption never leave the hard drive. The drive authenticates users independently from the operating system before it unlocks. 3) Ease of use: Encryption is transparent to the user and the user does not need to enable it. Encrypted hard drives are easily erased using an on-board encryption key; there is no need to re-encrypt data on the drive. 4) Lower cost of ownership: There is no need for new infrastructure to manage encryption keys since BitLocker leverages your existing infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process. | -| **[Personal data encryption (PDE)](https://learn.microsoft.com/windows/security/information-protection/personal-data-encryption/overview-pde)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow. Windows Hello for Business, either with PIN or biometrics (Face or Fingerprint), is used to protect the container which houses the encryption keys used by PDE. When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content. | -| **[Email Encryption (S/MIME)](https://learn.microsoft.com/windows/security/identity-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital identification (ID)—also called a certificate—can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message has not been tampered with. These encrypted messages can be sent by a user to people within their organization as well as external contacts if they have proper encryption certificates. | +| **[BitLocker management](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)** | | +| **[BitLocker enablement](/windows/security/information-protection/bitlocker/bitlocker-overview)** | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune using a configuration service provider (CSP). BitLocker provides encryption for the OS, fixed data, and removable data drives leveraging technologies like hardware security test interface (HSTI), Modern Standby, UEFI Secure Boot and TPM. | +| **[Encrypted hard drive](/windows/security/information-protection/encrypted-hard-drive)** | Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives. By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. Encrypted hard drives enable 1) Smooth performance: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate without performance degradation. 2) Strong security based in hardware: Encryption is always “on” and the keys for encryption never leave the hard drive. The drive authenticates users independently from the operating system before it unlocks. 3) Ease of use: Encryption is transparent to the user and the user does not need to enable it. Encrypted hard drives are easily erased using an on-board encryption key; there is no need to re-encrypt data on the drive. 4) Lower cost of ownership: There is no need for new infrastructure to manage encryption keys since BitLocker leverages your existing infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process. | +| **[Personal data encryption (PDE)](/windows/security/information-protection/personal-data-encryption/overview-pde)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow. Windows Hello for Business, either with PIN or biometrics (Face or Fingerprint), is used to protect the container which houses the encryption keys used by PDE. When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content. | +| **[Email Encryption (S/MIME)](/windows/security/identity-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital identification (ID)—also called a certificate—can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message has not been tampered with. These encrypted messages can be sent by a user to people within their organization as well as external contacts if they have proper encryption certificates. | ## Modern Device Management | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Security policy settings and auditing](https://learn.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies IT administrators can use to help protect Windows devices and other resources in your organization. Security settings policies are rules you can configure on a device, or multiple devices, to control - User authentication to a network or device, Resources users are permitted to access, Whether to record a user’s or group’s actions in the event log, Membership in a group. | -| **[Secured-core configuration lock](https://learn.microsoft.com/windows/client-management/config-lock)** | In an enterprise organization, IT administrators enforce policies on their corporate devices to protect the OS and keep devices in a compliant state by preventing users from changing configurations and creating configuration drift. Configuration drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Secured-core configuration lock (config lock) is a Secured-core PC feature that prevents users from making unwanted changes to security settings. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. | -| **[Assigned Access (kiosk mode)](https://learn.microsoft.com/windows/configuration/kiosk-methods)** | | +| **[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies IT administrators can use to help protect Windows devices and other resources in your organization. Security settings policies are rules you can configure on a device, or multiple devices, to control - User authentication to a network or device, Resources users are permitted to access, Whether to record a user’s or group’s actions in the event log, Membership in a group. | +| **[Secured-core configuration lock](/windows/client-management/config-lock)** | In an enterprise organization, IT administrators enforce policies on their corporate devices to protect the OS and keep devices in a compliant state by preventing users from changing configurations and creating configuration drift. Configuration drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Secured-core configuration lock (config lock) is a Secured-core PC feature that prevents users from making unwanted changes to security settings. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. | +| **[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)** | | diff --git a/windows/security/includes/sections/security-foundations.md b/windows/security/includes/sections/security-foundations.md index fec88db411..2fd0412633 100644 --- a/windows/security/includes/sections/security-foundations.md +++ b/windows/security/includes/sections/security-foundations.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/02/2023 +ms.date: 06/05/2023 ms.topic: include --- @@ -9,5 +9,5 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Common Criteria certifications](https://learn.microsoft.com/windows/security/threat-protection/windows-platform-common-criteria)** | Microsoft is committed to supporting product security standards and certifications, including FIPS 140 and Common Criteria as an external validation of security assurance. Common Criteria (CC) is an international standard currently maintained by national governments who participate in the Common Criteria Recognition Arrangement. CC defines a common taxonomy for security functional requirements, security assurance requirements, and an evaluation methodology used to ensure products undergoing evaluation satisfy the functional and assurance requirements. Microsoft Windows client and server products  incorporate the features and functions required by relevant Common Criteria Protection Profiles and completes Common Criteria certifications. | -| **[Federal Information Processing Standard (FIPS) 140 validation](https://learn.microsoft.com/windows/security/threat-protection/fips-140-validation)** | The Federal Information Processing Standard (FIPS) Publication 140 is a U.S. government standard that defines the minimum security requirements for cryptographic modules in IT products. Microsoft maintains an active commitment to meeting the requirements of the FIPS 140 standard, having validated cryptographic modules against FIPS 140-2 since it was first established in 2001. Multiple Microsoft products, including Windows 11, Windows 10, Windows Server, and many cloud services, use these cryptographic modules. | +| **[Common Criteria certifications](/windows/security/threat-protection/windows-platform-common-criteria)** | Microsoft is committed to supporting product security standards and certifications, including FIPS 140 and Common Criteria as an external validation of security assurance. Common Criteria (CC) is an international standard currently maintained by national governments who participate in the Common Criteria Recognition Arrangement. CC defines a common taxonomy for security functional requirements, security assurance requirements, and an evaluation methodology used to ensure products undergoing evaluation satisfy the functional and assurance requirements. Microsoft Windows client and server products  incorporate the features and functions required by relevant Common Criteria Protection Profiles and completes Common Criteria certifications. | +| **[Federal Information Processing Standard (FIPS) 140 validation](/windows/security/threat-protection/fips-140-validation)** | The Federal Information Processing Standard (FIPS) Publication 140 is a U.S. government standard that defines the minimum security requirements for cryptographic modules in IT products. Microsoft maintains an active commitment to meeting the requirements of the FIPS 140 standard, having validated cryptographic modules against FIPS 140-2 since it was first established in 2001. Multiple Microsoft products, including Windows 11, Windows 10, Windows Server, and many cloud services, use these cryptographic modules. | From 9ab06bce702e143e0f2779196b1e9c37a7ef483e Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 5 Jun 2023 13:05:46 -0400 Subject: [PATCH 07/30] Formatting changes test --- windows/security/includes/sections/application.md | 2 +- windows/security/includes/sections/hardware.md | 6 +++--- windows/security/includes/sections/identity.md | 2 +- windows/security/includes/sections/operating-system.md | 8 ++++---- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/includes/sections/application.md b/windows/security/includes/sections/application.md index 21be9b5992..6405f7e217 100644 --- a/windows/security/includes/sections/application.md +++ b/windows/security/includes/sections/application.md @@ -9,7 +9,7 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | +| **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.
| | **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | | | **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they are using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | diff --git a/windows/security/includes/sections/hardware.md b/windows/security/includes/sections/hardware.md index b0c2ef45b0..c72dfcfe86 100644 --- a/windows/security/includes/sections/hardware.md +++ b/windows/security/includes/sections/hardware.md @@ -10,15 +10,15 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| | **[Windows Defender System Guard](/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)** | | -| **[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance. Starting with Windows 10, Microsoft’s hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | +| **[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance.
Starting with Windows 10, Microsoft’s hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | | **[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)** | Microsoft Pluton security processors are designed by Microsoft in partnership with silicon partners. Pluton enhances the protection of Windows 11 devices with a hardware root-of-trust that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface as it integrates the security chip directly into the processor. It can be used with a discreet TPM 2.0 or as a standalone security processor. When root of trust is located on a separate, discrete chip on the motherboard, the communication path between the root-of-trust and the CPU can be vulnerable to physical attack. Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPMs including BitLocker, Windows Hello, and Windows Defender System Guard. In addition to providing root-of trust, Pluton also supports other security functionality beyond what is possible with the TPM 2.0 specification, and this extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. Pluton enabled Windows 11 devices are available and the selection of options with Pluton is growing. | ## Silicon Assisted Security (Secured Kernel) | Security Measures | Features & Capabilities | |:---|:---| -| **[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS) also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | -| **[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run. HVCI helps ensure that only validated code can be executed in kernel-mode. Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows. With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS) also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected.

Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows.
With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run. HVCI helps ensure that only validated code can be executed in kernel-mode.

Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows.
With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | | **[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)** | Hardware-enforced stack protection integrates software and hardware for a modern defense against cyberthreats such as memory corruption and zero-day exploits. Based on Control-flow Enforcement Technology (CET) from Intel and AMD Shadow Stacks, hardware-enforced stack protection is designed to protect against exploit techniques that try to hijack return addresses on the stack. | | **[Secured-core PC](/windows-hardware/design/device-experiences/oem-highly-secure-11)** | Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs. The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows. Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root of trust. Virtualization-based security comes enabled by default. And with built-in hypervisor protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all executables are signed by known and approved authorities only. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks. | | **[Kernel Direct Memory Access (DMA) protection](/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)** | Kernel DMA Protection protects against external peripherals from gaining unauthorized access to memory. Physical threats such as drive-by Direct Memory Access (DMA) attacks typically happen quickly while the system owner isn’t present. PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot plug ports are external and easily accessible, PCs are susceptible to drive-by DMA attacks. | diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md index 47be3d75c6..dece547ea1 100644 --- a/windows/security/includes/sections/identity.md +++ b/windows/security/includes/sections/identity.md @@ -11,7 +11,7 @@ ms.topic: include |:---|:---| | **[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)** | | | **[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)** | Windows presence sensing provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to your presence to help you stay secure and productive, whether you’re working at home, the office, or a public environment. Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to automatically lock your device when you leave, and then unlock your device and sign you in using Windows Hello facial recognition when you return. Requires OEM supporting hardware. | -| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in. Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process. Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more. For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. For facial recognition, Enhanced Sign-in Security is supported by Intel USB and AMD USB processor/camera combinations including specific modules from manufacturers. Intel MIPI is supported starting with version Windows 11 2022 Update. | +| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in. Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process. Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more.

For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft issued certificate to protect and securely store user authentication data.

For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. For facial recognition, Enhanced Sign-in Security is supported by Intel USB and AMD USB processor/camera combinations including specific modules from manufacturers. Intel MIPI is supported starting with version Windows 11 2022 Update. | | **[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets. Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | | **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 supports federated sign in with external education identity management services. For students unable to type easily or remember complex passwords, this capability enables secure sign in through methods like QR codes or pictures. | | **[Smart Cards for Windows Service](/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)** | Organizations also have the option of using smart cards, an authentication method that pre-dates biometric sign in. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating clients, signing code, securing e-mail, and signing in with Windows domain accounts. Smart cards can only be used to sign into domain accounts, not local accounts. When a password is used to sign into a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. | diff --git a/windows/security/includes/sections/operating-system.md b/windows/security/includes/sections/operating-system.md index 3639a0025b..6a15dc88c8 100644 --- a/windows/security/includes/sections/operating-system.md +++ b/windows/security/includes/sections/operating-system.md @@ -9,7 +9,7 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Secure Boot and Trusted Boot](/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a Windows 11 device is starting. Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure your Windows 11 system boots up safely and securely. | +| **[Secure Boot and Trusted Boot](/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a device starts.

Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure the system boots up safely and securely. | | **[Measured boot](/windows/compatibility/measured-boot)** | | | **[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. These determinations are made with data stored in the TPM which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Endpoint Manager reviews device health and connects this information with Azure Active Directory for conditional access. | @@ -22,7 +22,7 @@ ms.topic: include | **[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization. Administrators can configure specific attack surface reduction rules to help block certain behaviors, such as 1) Launching executable files and scripts that attempt to download or run files 2) Running obfuscated or otherwise suspicious scripts 3) Performing behaviors that apps don’t usually initiate during normal day-to-day work. | | **[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | | | **[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to Windows 11 2022 Update, Windows enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Beginning with Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs and users can opt-in to enforce the policy from the Windows Security app. | -| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders. Controlled folder access helps protect user’s valuable data from malicious apps and threats, such as ransomware. | +| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.

Controlled folder access helps protect user’s valuable data from malicious apps and threats, such as ransomware. | | **[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use Group Policy in Azure Active Directory to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | | **[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their Microsoft credentials into a potentially risky location. IT can customize which notifications appear through Microsoft Endpoint Manager. This protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. Because Windows 11 comes with these enhancements already built-in and enabled, users have extra security from the moment they turn on their device. | | **[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents 1) Endpoint behavioral sensors, 2) Cloud security analytics 3) Threat intelligence 4) Rich response capabilities. | @@ -33,7 +33,7 @@ ms.topic: include |:---|:---| | **[Transport layer security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | | **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | -| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | "The current security standard for Wi-Fi Authentication is WPA3 which provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows support 3 WPA3 modes – WPA3 personal, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B Window includes WPA3 personal with the new H2E protocol, and WPA3 Enterprise 192-bit Suite B Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication " | +| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | "The current security standard for Wi-Fi Authentication is WPA3 which provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows support 3 WPA3 modes – WPA3 personal, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B

Window includes WPA3 personal with the new H2E protocol, and WPA3 Enterprise 192-bit Suite B

Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication " | | **Opportunistic Wireless Encryption (OWE)** | Opportunistic Wireless Encryption (OWE) is a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots. | | **[Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Security is an important part of a layered security model. It provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Win 11 Firewall offers the following benefits 1) Reduces the risk of network security threats: Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. 2) Safeguards sensitive data and intellectual property: With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. 3) Extends the value of existing investments: Windows Firewall is a host based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | | **[Virtual Private Network (VPN)](/windows/security/identity-protection/vpn/vpn-guide)** | Organizations have long relied on Windows to provide reliable, secured, and manageable virtual private network (VPN) solutions. The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways. In Windows 11 we’ve integrated the most commonly used VPN controls right into the Windows 11 Quick Actions pane. From the Quick Actions pane users can see the status of their VPN, start and stop the VPN tunnels, and with one click can go to the modern Settings app for more control. For E3 customers you have the option to have this always on by default. | @@ -56,6 +56,6 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies IT administrators can use to help protect Windows devices and other resources in your organization. Security settings policies are rules you can configure on a device, or multiple devices, to control - User authentication to a network or device, Resources users are permitted to access, Whether to record a user’s or group’s actions in the event log, Membership in a group. | +| **[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies IT administrators can use to help protect Windows devices and other resources in your organization. Security settings policies are rules you can configure on a device, or multiple devices, to control - User authentication to a network or device, Resources users are permitted to access, Whether to record a user’s or group’s actions in the event log, Membership in a group.
| | **[Secured-core configuration lock](/windows/client-management/config-lock)** | In an enterprise organization, IT administrators enforce policies on their corporate devices to protect the OS and keep devices in a compliant state by preventing users from changing configurations and creating configuration drift. Configuration drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Secured-core configuration lock (config lock) is a Secured-core PC feature that prevents users from making unwanted changes to security settings. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. | | **[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)** | | From 422cca0373e01371f8ef29fa5d745414fab8a589 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 6 Jun 2023 10:37:43 -0400 Subject: [PATCH 08/30] Fix link --- .../data-protection/bitlocker/bitlocker-countermeasures.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md index 2e5f0de6fe..98b5a376c9 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-countermeasures.md @@ -31,7 +31,7 @@ A trusted platform module (TPM) is a microchip designed to provide basic securit Unified Extensible Firmware Interface (UEFI) is a programmable boot environment that initializes devices and starts the operating system's bootloader. -The UEFI specification defines a firmware execution authentication process called [Secure Boot](../../../information-protection/secure-the-windows-10-boot-process.md). Secure Boot blocks untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system. +The UEFI specification defines a firmware execution authentication process called [Secure Boot](../../system-security/secure-the-windows-10-boot-process.md). Secure Boot blocks untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system. By default, BitLocker provides integrity protection for Secure Boot by utilizing the TPM PCR[7] measurement. An unauthorized EFI firmware, EFI boot application, or bootloader can't run and acquire the BitLocker key. From 22433019503956e410d70e57e73f24e6f1128077 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 6 Jun 2023 11:53:32 -0400 Subject: [PATCH 09/30] Update include files --- .../security/includes/sections/application.md | 6 +-- .../includes/sections/cloud-services.md | 16 +++--- .../security/includes/sections/hardware.md | 14 ++--- .../security/includes/sections/identity.md | 20 +++---- .../includes/sections/operating-system.md | 54 +++++++++---------- .../includes/sections/security-foundations.md | 4 +- 6 files changed, 57 insertions(+), 57 deletions(-) diff --git a/windows/security/includes/sections/application.md b/windows/security/includes/sections/application.md index 6405f7e217..80c68e57f3 100644 --- a/windows/security/includes/sections/application.md +++ b/windows/security/includes/sections/application.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/05/2023 +ms.date: 06/06/2023 ms.topic: include --- @@ -9,8 +9,8 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.
| -| **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | | +| **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a device. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevents inadvertent changes to system settings. Enabling UAC helps to prevent malware from altering device settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | +| **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means for addressing the threat of executable file-based malware.

Windows 10 and above include Windows Defender Application Control (WDAC) as well as AppLocker. WDAC is the next generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to WDAC for the stronger protection. | | **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they are using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | ## Application Isolation diff --git a/windows/security/includes/sections/cloud-services.md b/windows/security/includes/sections/cloud-services.md index de74d51fde..c4d7b76626 100644 --- a/windows/security/includes/sections/cloud-services.md +++ b/windows/security/includes/sections/cloud-services.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/05/2023 +ms.date: 06/06/2023 ms.topic: include --- @@ -9,15 +9,15 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](/azure/active-directory/devices/concept-azure-ad-join)** | | -| **[Security baselines](/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client. Windows 11 can be configured with Microsoft’s MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | -| **[Remote wipe](/windows/client-management/mdm/remotewipe-csp)** | When a device is lost or stolen, IT administrators might want to remotely wipe data stored in memory and hard disks. A help desk agent might also want to reset devices to fix issues encountered by remote workers. Windows 11 supports the Remote Wipe configuration service provider (CSP) so that MDM solutions can remotely initiate any of the following operations: 1) Reset the device and remove user accounts and data. 2) Reset the device and clean the drive. 3) Reset the device but persist user accounts and data. | -| **[Manage by Mobile Device Management (MDM) and group policy](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)** | | -| **[Universal Print](/universal-print/)** | | +| **[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](/azure/active-directory/devices/concept-azure-ad-join)** | Microsoft Azure Active Directory is a comprehensive cloud-based identity management solution that helps enable secure access to applications, networks, and other resources and guard against threats. | +| **[Security baselines](/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client.

Windows 11 can be configured with Microsoft’s MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | +| **[Remote wipe](/windows/client-management/mdm/remotewipe-csp)** | When a device is lost or stolen, IT administrators may want to remotely wipe data stored on the device. A helpdesk agent may also want to reset devices to fix issues encountered by remote workers.

With the Remote Wipe configuration service provider (CSP), an MDM solution can remotely initiate any of the following operations on a Windows device: reset the device and remove user accounts and data, reset the device and clean the drive, reset the device but persist user accounts and data. | +| **[Manage by Mobile Device Management (MDM) and group policy](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client. | +| **[Universal Print](/universal-print/)** | Unlike traditional print solutions that rely on Windows print servers, Universal Print is a
Microsoft hosted cloud subscription service that supports a zero-trust security model by
enabling network isolation of printers, including the Universal Print connector software, from
the rest of the organization’s resources. | ## Update | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Autopatch](/windows/deployment/windows-autopatch/)** | With the Autopatch service, IT teams can delegate management of updates to Windows 10/11, Microsoft Edge, and Microsoft 365 apps to Microsoft. Under the hood, Autopatch takes over configuration of the policies and deployment service of Windows Update for Business. What the customer gets are endpoints that are up to date, thanks to dynamically generated rings for progressive deployment that will pause and/or roll back updates (where possible) when issues arise. The goal is to provide peace of mind to IT pros, encourage rapid adoption of updates, and to reduce bandwidth required to deploy them successfully, thereby closing gaps in protection that may have been open to exploitation by malicious actors. | -| **[Windows Autopilot](/windows/deployment/windows-autopilot)** | | +| **[Windows Autopatch](/windows/deployment/windows-autopatch/)** | With the Autopatch service, IT teams can delegate management of updates to Windows 10/11, Microsoft Edge, and Microsoft 365 apps to Microsoft. Under the hood, Autopatch takes over configuration of the policies and deployment service of Windows Update for Business. What the customer gets are endpoints that are up to date, thanks to dynamically generated rings for progressive deployment that will pause and/or roll back updates (where possible) when issues arise.

The goal is to provide peace of mind to IT pros, encourage rapid adoption of updates, and to reduce bandwidth required to deploy them successfully, thereby closing gaps in protection that may have been open to exploitation by malicious actors. | +| **[Windows Autopilot](/windows/deployment/windows-autopilot)** | Windows Autopilot simplifies the way devices get deployed, reset, and repurposed, with an experience that is zero touch for IT. | diff --git a/windows/security/includes/sections/hardware.md b/windows/security/includes/sections/hardware.md index c72dfcfe86..7488c5606c 100644 --- a/windows/security/includes/sections/hardware.md +++ b/windows/security/includes/sections/hardware.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/05/2023 +ms.date: 06/06/2023 ms.topic: include --- @@ -9,16 +9,16 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Defender System Guard](/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)** | | -| **[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance.
Starting with Windows 10, Microsoft’s hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | -| **[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)** | Microsoft Pluton security processors are designed by Microsoft in partnership with silicon partners. Pluton enhances the protection of Windows 11 devices with a hardware root-of-trust that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface as it integrates the security chip directly into the processor. It can be used with a discreet TPM 2.0 or as a standalone security processor. When root of trust is located on a separate, discrete chip on the motherboard, the communication path between the root-of-trust and the CPU can be vulnerable to physical attack. Pluton supports the TPM 2.0 industry standard allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPMs including BitLocker, Windows Hello, and Windows Defender System Guard. In addition to providing root-of trust, Pluton also supports other security functionality beyond what is possible with the TPM 2.0 specification, and this extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. Pluton enabled Windows 11 devices are available and the selection of options with Pluton is growing. | +| **[Windows Defender System Guard](/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows)** | In Secured-core PCs, Windows Defender System Guard Secure Launch protects bootup with a technology known as the Dynamic Root of Trust for Measurement (DRTM). With DRTM, the system initially follows the normal UEFI Secure Boot process. However, before launching, the system enters a hardware-controlled trusted state that forces the CPU(s) down a hardware-secured code path. If a malware rootkit/bootkit has bypassed UEFI Secure Boot and resides in memory, DRTM will prevent it from accessing secrets and critical code protected by the virtualization-based security environment. Firmware Attack Surface Reduction technology can be used instead of DRTM on supporting devices such as Microsoft Surface. | +| **[Trusted Platform Module (TPM) 2.0](/windows/security/information-protection/tpm/trusted-platform-module-overview)** | TPMs provide security and privacy benefits for system hardware, platform owners, and users. Windows Hello, BitLocker, Windows Defender System Guard, and other Windows features rely on the TPM for capabilities such as key generation, secure storage, encryption, boot integrity measurements, and attestation. The 2.0 version of the specification includes support for newer algorithms, which can improve driver signing and key generation performance.

Starting with Windows 10, Microsoft's hardware certification requires all new Windows PCs to include TPM 2.0 built in and enabled by default. With Windows 11, both new and upgraded devices must have TPM 2.0. | +| **[Microsoft Pluton security processor](/windows/security/information-protection/pluton/microsoft-pluton-security-processor)** | Microsoft Pluton security processors are designed by Microsoft in partnership with silicon partners. Pluton enhances the protection of Windows devices with a hardware root-of-trust that provides additional protection for cryptographic keys and other secrets. Pluton is designed to reduce the attack surface as it integrates the security chip directly into the processor. It can be used with a discreet TPM 2.0, or as a standalone security processor. When root of trust is located on a separate, discrete chip on the motherboard, the communication path between the root-of-trust and the CPU can be vulnerable to physical attack. Pluton supports the TPM 2.0 industry standard, allowing customers to immediately benefit from the enhanced security in Windows features that rely on TPMs including BitLocker, Windows Hello, and Windows Defender System Guard.

In addition to providing root-of trust, Pluton also supports other security functionality beyond what is possible with the TPM 2.0 specification, and this extensibility allows for additional Pluton firmware and OS features to be delivered over time via Windows Update. Pluton-enabled Windows 11 devices are available and the selection of options with Pluton is growing. | ## Silicon Assisted Security (Secured Kernel) | Security Measures | Features & Capabilities | |:---|:---| -| **[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS) also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected.

Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows.
With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | -| **[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run. HVCI helps ensure that only validated code can be executed in kernel-mode.

Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows.
With new installs of Windows 11, OS support for VBS & HVCI is automatically turned on by default for all devices that meet modern CPU, RAM, 64G space in SSD etc and other pre-requirements | +| **[Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)** | In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats, such as by protecting the boot process, safeguarding the integrity of memory, isolating security sensitive compute logic, and more. Two examples include Virtualization-based security (VBS) and Hypervisor-protected code integrity (HVCI). Virtualization-based security (VBS), also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel remains protected.

Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows.
With new installs of Windows 11, OS support for VBS and HVCI is turned on by default for all devices that meet prerequisites. | +| **[Hypervisor-protected Code Integrity (HVCI)](/windows-hardware/design/device-experiences/oem-hvci-enablement)** | Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps to prevent attacks that attempt to modify kernel mode code, such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn't been tampered with before it is allowed to run. HVCI helps to ensure that only validated code can be executed in kernel-mode.

Starting with Windows 10, all new devices are required to ship with firmware support for VBS and HCVI enabled by default in the BIOS. Customers can then enable the OS support in Windows.
With new installs of Windows 11, OS support for VBS and HVCI is turned on by default for all devices that meet prerequisites. | | **[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)** | Hardware-enforced stack protection integrates software and hardware for a modern defense against cyberthreats such as memory corruption and zero-day exploits. Based on Control-flow Enforcement Technology (CET) from Intel and AMD Shadow Stacks, hardware-enforced stack protection is designed to protect against exploit techniques that try to hijack return addresses on the stack. | | **[Secured-core PC](/windows-hardware/design/device-experiences/oem-highly-secure-11)** | Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs. The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows. Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root of trust. Virtualization-based security comes enabled by default. And with built-in hypervisor protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all executables are signed by known and approved authorities only. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks. | -| **[Kernel Direct Memory Access (DMA) protection](/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)** | Kernel DMA Protection protects against external peripherals from gaining unauthorized access to memory. Physical threats such as drive-by Direct Memory Access (DMA) attacks typically happen quickly while the system owner isn’t present. PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot plug ports are external and easily accessible, PCs are susceptible to drive-by DMA attacks. | +| **[Kernel Direct Memory Access (DMA) protection](/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)** | Kernel DMA Protection protects against external peripherals from gaining unauthorized access to memory. Physical threats such as drive-by Direct Memory Access (DMA) attacks typically happen quickly while the system owner isn't present. PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach new classes of external peripherals, including graphics cards or other PCI devices, to their PCs with the plug-and-play ease of USB. Because PCI hot plug ports are external and easily accessible, devices are susceptible to drive-by DMA attacks. | diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md index dece547ea1..b2e9e25496 100644 --- a/windows/security/includes/sections/identity.md +++ b/windows/security/includes/sections/identity.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/05/2023 +ms.date: 06/06/2023 ms.topic: include --- @@ -9,20 +9,20 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)** | | +| **[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)** | Windows 11 devices can protect user identities by removing the need to use passwords from day one. It’s easy to get started with the method that’s right for your organization. A password may only need to be used once during the provisioning process, after which people use a PIN, face, or fingerprint to unlock credentials and sign into the device.

Windows Hello for Business replaces the username and password by combining a security key or certificate with a PIN or biometrics data, and then mapping the credentials to a user account during setup. There are multiple ways to deploy Windows Hello for Business, depending on your organization’s needs. Organizations that rely on certificates typically use on-premises public key infrastructure (PKI) to support authentication through Certificate Trust. Organizations using key trust deployment require root-of-trust provided by certificates on domain controllers. | | **[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)** | Windows presence sensing provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to your presence to help you stay secure and productive, whether you’re working at home, the office, or a public environment. Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to automatically lock your device when you leave, and then unlock your device and sign you in using Windows Hello facial recognition when you return. Requires OEM supporting hardware. | -| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in. Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process. Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more.

For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft issued certificate to protect and securely store user authentication data.

For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. For facial recognition, Enhanced Sign-in Security is supported by Intel USB and AMD USB processor/camera combinations including specific modules from manufacturers. Intel MIPI is supported starting with version Windows 11 2022 Update. | -| **[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets. Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | -| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 supports federated sign in with external education identity management services. For students unable to type easily or remember complex passwords, this capability enables secure sign in through methods like QR codes or pictures. | +| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in.

Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more.

For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft-issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. | +| **[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets.

Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | +| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 education editions supports federated sign-in with third-party identity providers. Federated sign-in enables secure sign in through methods like QR codes or pictures. | | **[Smart Cards for Windows Service](/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)** | Organizations also have the option of using smart cards, an authentication method that pre-dates biometric sign in. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating clients, signing code, securing e-mail, and signing in with Windows domain accounts. Smart cards can only be used to sign into domain accounts, not local accounts. When a password is used to sign into a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. | ## Advanced Credential Protection | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | | +| **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Azure Active Directory-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it. | | **[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | -| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | People who are still using passwords can benefit from powerful credential protection in Windows 11. Microsoft Defender SmartScreen now includes enhanced phishing protection to automatically detect when you enter your Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if your credentials are at risk. Because you are alerted at the moment of potential credential theft, you can take pre-emptive action before your password is used against you or your organization. | -| **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows help ensure that shared resources are available to users and groups in addition to the resource owner and are protected from unauthorized use. IT administrators can manage users’, groups’, and computers’ access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions. Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | -| **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | | -| **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | | +| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take pre-emptive action before their password is used against them or their organization. | +| **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows ensures that shared resources are available to users and groups other than the resource’s owner and are protected from unauthorized use. IT administrators can manage users’, groups’, and computers’ access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions.

Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | +| **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | Enabled by default in Windows 11 Enterprise, Windows Credential Guard uses hardware-backed, virtualization-based security (VBS) to protect against credential theft. With Windows Credential Guard, the Local Security Authority (LSA) stores and protects secrets in an isolated environment that is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.

By protecting the LSA process with virtualization-based security, Windows Credential Guard shields systems from credential theft attack techniques like pass-the-hash or pass-the-ticket. It also helps prevent malware from accessing system secrets even if the process is running with admin privileges. | +| **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | Window Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that is requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.

Administrator credentials are highly privileged and must be protected. When you use Windows Defender Remote Credential Guard to connect during Remote Desktop sessions your credential and credential derivatives are never passed over the network to the target device. If the target device is compromised, your credentials are not exposed. | diff --git a/windows/security/includes/sections/operating-system.md b/windows/security/includes/sections/operating-system.md index 6a15dc88c8..0f125c1107 100644 --- a/windows/security/includes/sections/operating-system.md +++ b/windows/security/includes/sections/operating-system.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/05/2023 +ms.date: 06/06/2023 ms.topic: include --- @@ -9,53 +9,53 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Secure Boot and Trusted Boot](/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help prevent malware and corrupted components from loading when a device starts.

Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure the system boots up safely and securely. | -| **[Measured boot](/windows/compatibility/measured-boot)** | | -| **[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. These determinations are made with data stored in the TPM which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Endpoint Manager reviews device health and connects this information with Azure Active Directory for conditional access. | +| **[Secure Boot and Trusted Boot](/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help to prevent malware and corrupted components from loading when a device starts.

Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure the system boots up safely and securely. | +| **[Measured boot](/windows/compatibility/measured-boot)** | Measured Boot measures all important code and configuration settings during the boot of Windows. This includes: the firmware, boot manager, hypervisor, kernel, secure kernel and operating system. Measured Boot stores the measurements in the TPM on the machine, and makes them available in a log that can be tested remotely to verify the boot state of the client.

The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components that started before it. The antimalware software can use the log to determine whether components that ran before it are trustworthy, or if they are infected with malware. The antimalware software on the local machine can send the log to a remote sever for evaluation. The remote server may initiate remediation actions, either by interacting with software on the client, or through out-of-band mechanisms, as appropriate. | +| **[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters, to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. The determinations are made with data stored in the TPM, which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Intune reviews device health and connects this information with Azure Active Directory for conditional access. | ## Virus And Threat Protection | Security Measures | Features & Capabilities | |:---|:---| -| **[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a next-generation protection solution included in all versions of Windows 10 and Windows 11. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. In addition to real time protection, updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus, includes real-time, behavior-based, and heuristic antivirus protection. This combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but are not considered malware. | -| **Local Security Authority (LSA) Protection** | Windows has several critical processes to verify a user’s identity. Verification processes include Local Security Authority (LSA) which is responsible for authenticating users and verifying Windows logins. LSA handles tokens and credentials such as passwords that are used for single sign-on to a Microsoft account and Azure services. To help protect these credentials, additional LSA protection only allows loading of trusted, signed code and provides significant protection against Credential theft. LSA protection will be enabled by default on new, enterprise joined Windows 11 devices with added support for non-UEFI lock and policy management controls via MDM/GP. | -| **[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization. Administrators can configure specific attack surface reduction rules to help block certain behaviors, such as 1) Launching executable files and scripts that attempt to download or run files 2) Running obfuscated or otherwise suspicious scripts 3) Performing behaviors that apps don’t usually initiate during normal day-to-day work. | -| **[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | | -| **[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers. Prior to Windows 11 2022 Update, Windows enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Beginning with Windows 11 2022 Update, the block policy is now on by default for all new Windows PCs and users can opt-in to enforce the policy from the Windows Security app. | -| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, are included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.

Controlled folder access helps protect user’s valuable data from malicious apps and threats, such as ransomware. | -| **[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use Group Policy in Azure Active Directory to distribute the XML file to multiple devices simultaneously. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | -| **[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their Microsoft credentials into a potentially risky location. IT can customize which notifications appear through Microsoft Endpoint Manager. This protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. Because Windows 11 comes with these enhancements already built-in and enabled, users have extra security from the moment they turn on their device. | -| **[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents 1) Endpoint behavioral sensors, 2) Cloud security analytics 3) Threat intelligence 4) Rich response capabilities. | +| **[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a protection solution included in all versions of Windows. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. Updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus includes real-time, behavior-based, and heuristic antivirus protection.

The combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but are not considered malware. | +| **Local Security Authority (LSA) Protection** | Windows has several critical processes to verify a user's identity. Verification processes include Local Security Authority (LSA), which is responsible for authenticating users and verifying Windows logins. LSA handles tokens and credentials such as passwords that are used for single sign-on to a Microsoft account and Azure services. To help protect these credentials, additional LSA protection only allows loading of trusted, signed code and provides significant protection against Credential theft.

LSA protection is enabled by default on new, enterprise joined Windows 11 devices with added support for non-UEFI lock and policy management controls via MDM and group policy. | +| **[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction (ASR) rules help to prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization.

Administrators can configure specific ASR rules to help block certain behaviors, such as launching executable files and scripts that attempt to download or run files, running obfuscated or otherwise suspicious scripts, performing behaviors that apps don't usually initiate during normal day-to-day work. | +| **[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | Tamper protection is a capability in Microsoft Defender for Endpoint that helps protect certain security settings, such as virus and threat protection, from being disabled or changed. During some kinds of cyber attacks, bad actors try to disable security features on devices. Disabling security features provides bad actors with easier access to your data, the ability to install malware, and the ability to exploit your data, identity, and devices. Tamper protection helps guard against these types of activities. | +| **[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers.

Prior to Windows 11, version 22H2, the operating system enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Starting in Windows 11, version 22H2, the block policy is enabled by default for all new Windows devices, and users can opt-in to enforce the policy from the Windows Security app. | +| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Commonly used folders, such as those used for documents, pictures, downloads, are typically included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.

Controlled folder access helps to protect user’s valuable data from malicious apps and threats, such as ransomware. | +| **[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use MDM or group policy to distribute the configuration file to multiple devices. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | +| **[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their credentials into a potentially risky location. IT can customize which notifications appear via MDM or group policy. The protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. | +| **[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams to detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents: endpoint behavioral sensors, cloud security analytics, threat intelligence and rich response capabilities. | ## Network Security | Security Measures | Features & Capabilities | |:---|:---| -| **[Transport layer security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | +| **[Transport layer security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a network. TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average, and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | | **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | -| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | "The current security standard for Wi-Fi Authentication is WPA3 which provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows support 3 WPA3 modes – WPA3 personal, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B

Window includes WPA3 personal with the new H2E protocol, and WPA3 Enterprise 192-bit Suite B

Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication " | +| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | Wi-Fi Protected Access (WPA) is a security certification programs designed to secure wireless networks. WPA3 is the latest version of the certification and provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows supports three WPA3 modes: WPA3 personal with the Hash-to-Element (H2E) protocol, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B.

Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication. | | **Opportunistic Wireless Encryption (OWE)** | Opportunistic Wireless Encryption (OWE) is a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots. | -| **[Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Security is an important part of a layered security model. It provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Win 11 Firewall offers the following benefits 1) Reduces the risk of network security threats: Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. 2) Safeguards sensitive data and intellectual property: With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. 3) Extends the value of existing investments: Windows Firewall is a host based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | -| **[Virtual Private Network (VPN)](/windows/security/identity-protection/vpn/vpn-guide)** | Organizations have long relied on Windows to provide reliable, secured, and manageable virtual private network (VPN) solutions. The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways. In Windows 11 we’ve integrated the most commonly used VPN controls right into the Windows 11 Quick Actions pane. From the Quick Actions pane users can see the status of their VPN, start and stop the VPN tunnels, and with one click can go to the modern Settings app for more control. For E3 customers you have the option to have this always on by default. | +| **[Windows Firewall](/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Securityprovides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. Windows Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | +| **[Virtual Private Network (VPN)](/windows/security/identity-protection/vpn/vpn-guide)** | The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways.

In Windows 11, the most commonly used VPN controls are integrated right into the Quick Actions pane. From the Quick Actions pane, users can see the status of their VPN, start and stop the VPN tunnels, and access the Settings app for more controls. | | **[Always On VPN (device tunnel)](/windows-server/remote/remote-access/vpn/always-on-vpn/)** | | -| **[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)** | | -| **[Server Message Block (SMB) file service](/windows-server/storage/file-server/file-server-smb-overview)** | SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks. SMB and file services are the most common Windows workload in the commercial and public sector ecosystem. In Windows 11, the SMB protocol has significant security updates to meet today’s threats, including AES-256 bits encryption, accelerated SMB signing, Remote Directory Memory Access (RDMA) network encryption, and entirely new scenario, SMB over QUIC for untrusted networks. Windows 11 introduces AES-256-GCM and AES-256-CCM cryptographic suites for SMB 3.1.1 encryption. Windows administrators can mandate the use of this more advanced security or continue to use the more compatible and still-safe AES-128 encryption. | -| **[Server Message Block Direct (SMB Direct)](/windows-server/storage/file-server/smb-direct)** | In Windows 11 Enterprise, Education, and Pro Workstation, SMB Direct now supports encryption. For demanding workloads like video rendering, data science, or extremely large files, you can now operate with the same safety as traditional TCP and the performance of RDMA. Previously, enabling SMB encryption disabled direct data placement, making RDMA as slow as TCP. Now data is encrypted before placement, leading to relatively minor performance degradation while adding AES-128 and AES-256 protected packet privacy. | +| **[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)** | DirectAccess allows connectivity for remote users to organization network resources without the need for traditional Virtual Private Network (VPN) connections.

With DirectAccess connections, remote devices are always connected to the organization and there's no need for remote users to start and stop connections. | +| **[Server Message Block (SMB) file service](/windows-server/storage/file-server/file-server-smb-overview)** | SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on internal networks. In Windows 11, the SMB protocol has significant security updates, including AES-256 bits encryption, accelerated SMB signing, Remote Directory Memory Access (RDMA) network encryption, and SMB over QUIC for untrusted networks. Windows 11 introduces AES-256-GCM and AES-256-CCM cryptographic suites for SMB 3.1.1 encryption. Windows administrators can mandate the use of more advanced security or continue to use the more compatible, and still-safe, AES-128 encryption. | +| **[Server Message Block Direct (SMB Direct)](/windows-server/storage/file-server/smb-direct)** | SMB Direct (SMB over remote direct memory access) is a storage protocol that enables direct memory-to-memory data transfers between device and storage, with minimal CPU usage, while using standard RDMA-capable network adapters.

SMB Direct supports encryption, and now you can operate with the same safety as traditional TCP and the performance of RDMA. Previously, enabling SMB encryption disabled direct data placement, making RDMA as slow as TCP. Now data is encrypted before placement, leading to relatively minor performance degradation while adding AES-128 and AES-256 protected packet privacy. | ## Data Protection | Security Measures | Features & Capabilities | |:---|:---| -| **[BitLocker management](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)** | | -| **[BitLocker enablement](/windows/security/information-protection/bitlocker/bitlocker-overview)** | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune using a configuration service provider (CSP). BitLocker provides encryption for the OS, fixed data, and removable data drives leveraging technologies like hardware security test interface (HSTI), Modern Standby, UEFI Secure Boot and TPM. | -| **[Encrypted hard drive](/windows/security/information-protection/encrypted-hard-drive)** | Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives. By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. Encrypted hard drives enable 1) Smooth performance: Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate without performance degradation. 2) Strong security based in hardware: Encryption is always “on” and the keys for encryption never leave the hard drive. The drive authenticates users independently from the operating system before it unlocks. 3) Ease of use: Encryption is transparent to the user and the user does not need to enable it. Encrypted hard drives are easily erased using an on-board encryption key; there is no need to re-encrypt data on the drive. 4) Lower cost of ownership: There is no need for new infrastructure to manage encryption keys since BitLocker leverages your existing infrastructure to store recovery information. Your device operates more efficiently because processor cycles do not need to be used for the encryption process. | -| **[Personal data encryption (PDE)](/windows/security/information-protection/personal-data-encryption/overview-pde)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow. Windows Hello for Business, either with PIN or biometrics (Face or Fingerprint), is used to protect the container which houses the encryption keys used by PDE. When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content. | -| **[Email Encryption (S/MIME)](/windows/security/identity-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital identification (ID)—also called a certificate—can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message has not been tampered with. These encrypted messages can be sent by a user to people within their organization as well as external contacts if they have proper encryption certificates. | +| **[BitLocker management](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises)** | The BitLocker CSP allows an MDM solution, like Microsoft Intune, to manage the BitLocker encryption features on Windows devices. This includes OS volumes, fixed drives and removeable storage, and recovery key management into Azure AD. | +| **[BitLocker enablement](/windows/security/information-protection/bitlocker/bitlocker-overview)** | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune, using a configuration service provider (CSP).

BitLocker provides encryption for the OS, fixed data, and removable data drives leveraging technologies like hardware security test interface (HSTI), Modern Standby, UEFI Secure Boot and TPM. | +| **[Encrypted hard drive](/windows/security/information-protection/encrypted-hard-drive)** | Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives.

By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. | +| **[Personal data encryption (PDE)](/windows/security/information-protection/personal-data-encryption/overview-pde)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow.

Windows Hello for Business is used to protect the container which houses the encryption keys used by PDE. When the user signs in, the container gets authenticated to release the keys in the container to decrypt user content. | +| **[Email Encryption (S/MIME)](/windows/security/identity-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital ID (certificate) can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message has not been tampered with. The encrypted messages can be sent by a user to other users within their organization or external contacts if they have proper encryption certificates. | ## Modern Device Management | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Security policy settings are a critical part of your overall security strategy. Windows provides a robust set of security setting policies IT administrators can use to help protect Windows devices and other resources in your organization. Security settings policies are rules you can configure on a device, or multiple devices, to control - User authentication to a network or device, Resources users are permitted to access, Whether to record a user’s or group’s actions in the event log, Membership in a group.
| +| **[Windows Security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Microsoft provides a robust set of security settings policies that IT administrators can use to protect Windows devices and other resources in their organization. | | **[Secured-core configuration lock](/windows/client-management/config-lock)** | In an enterprise organization, IT administrators enforce policies on their corporate devices to protect the OS and keep devices in a compliant state by preventing users from changing configurations and creating configuration drift. Configuration drift occurs when users with local admin rights change settings and put the device out of sync with security policies. Devices in a non-compliant state can be vulnerable until the next sync and configuration reset with the MDM. Secured-core configuration lock (config lock) is a Secured-core PC feature that prevents users from making unwanted changes to security settings. With config lock, the OS monitors the registry keys that configure each feature and when it detects a drift, reverts to the IT-desired state in seconds. | -| **[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)** | | +| **[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)** | Some desktop devices in an enterprise serve a special purpose. For example, a PC in the lobby that customers use to see your product catalog. Or, a PC displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use: A single-app kiosk that runs a single Universal Windows Platform (UWP) app in full screen above the lock screen, or A multi-app kiosk that runs one or more apps from the desktop.

Kiosk configurations are based on Assigned Access, a feature in Windows that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. | diff --git a/windows/security/includes/sections/security-foundations.md b/windows/security/includes/sections/security-foundations.md index 2fd0412633..8c3cd14c92 100644 --- a/windows/security/includes/sections/security-foundations.md +++ b/windows/security/includes/sections/security-foundations.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 06/05/2023 +ms.date: 06/06/2023 ms.topic: include --- @@ -9,5 +9,5 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Common Criteria certifications](/windows/security/threat-protection/windows-platform-common-criteria)** | Microsoft is committed to supporting product security standards and certifications, including FIPS 140 and Common Criteria as an external validation of security assurance. Common Criteria (CC) is an international standard currently maintained by national governments who participate in the Common Criteria Recognition Arrangement. CC defines a common taxonomy for security functional requirements, security assurance requirements, and an evaluation methodology used to ensure products undergoing evaluation satisfy the functional and assurance requirements. Microsoft Windows client and server products  incorporate the features and functions required by relevant Common Criteria Protection Profiles and completes Common Criteria certifications. | +| **[Common Criteria certifications](/windows/security/threat-protection/windows-platform-common-criteria)** | Common Criteria (CC) is an international standard currently maintained by national governments who participate in the Common Criteria Recognition Arrangement. CC defines a common taxonomy for security functional requirements, security assurance requirements, and an evaluation methodology used to ensure products undergoing evaluation satisfy the functional and assurance requirements. Microsoft ensures that products incorporate the features and functions required by relevant Common Criteria Protection Profiles and completes Common Criteria certifications of Microsoft Windows products. | | **[Federal Information Processing Standard (FIPS) 140 validation](/windows/security/threat-protection/fips-140-validation)** | The Federal Information Processing Standard (FIPS) Publication 140 is a U.S. government standard that defines the minimum security requirements for cryptographic modules in IT products. Microsoft maintains an active commitment to meeting the requirements of the FIPS 140 standard, having validated cryptographic modules against FIPS 140-2 since it was first established in 2001. Multiple Microsoft products, including Windows 11, Windows 10, Windows Server, and many cloud services, use these cryptographic modules. | From 263bf3427a016dfd4b399a0a9eb034b56cf60a16 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 6 Jun 2023 12:15:04 -0400 Subject: [PATCH 10/30] Update includes again --- windows/security/includes/sections/application.md | 14 +++++++------- .../security/includes/sections/cloud-services.md | 4 ++-- windows/security/includes/sections/identity.md | 14 +++++++------- .../security/includes/sections/operating-system.md | 2 +- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/security/includes/sections/application.md b/windows/security/includes/sections/application.md index 80c68e57f3..3f730cfd2e 100644 --- a/windows/security/includes/sections/application.md +++ b/windows/security/includes/sections/application.md @@ -10,17 +10,17 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| | **[User Account Control (UAC)](/windows/security/application-security/application-control/user-account-control/)** | User Account Control (UAC) helps prevent malware from damaging a device. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevents inadvertent changes to system settings. Enabling UAC helps to prevent malware from altering device settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. | -| **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means for addressing the threat of executable file-based malware.

Windows 10 and above include Windows Defender Application Control (WDAC) as well as AppLocker. WDAC is the next generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to WDAC for the stronger protection. | -| **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they are using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | +| **[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means for addressing the threat of executable file-based malware.

Windows 10 and above include Windows Defender Application Control (WDAC) and AppLocker. WDAC is the next generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to WDAC for the stronger protection. | +| **[Smart App Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)** | Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections, by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run that are predicted to be safe based on existing and new intelligence processed daily. Smart App Control builds on top of the same cloud-based AI used in Windows Defender Application Control (WDAC) to predict the safety of an application, so people can be confident they're using safe and reliable applications on their new Windows 11 devices, or Windows 11 devices that have been reset. | ## Application Isolation | Security Measures | Features & Capabilities | |:---|:---| -| **[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)** | Standalone mode allows Windows users to use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, user must manually start Microsoft Edge in Application Guard from Edge menu for browsing untrusted sites | -| **[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)** | Microsoft Defender Application Guard protect user's desktop while they browse the Internet using Microsoft Edge browser. Application Guard in enterprise mode automatically redirects untrusted website navigations in an anonymous and isolated Hyper-V based container which is separate from the host operating system. With Enterprise mode you can define your corporate boundaries by explicitly adding trusted domains and can customizing the Application Guard experience to meet and enforce your organization needs on Windows devices. | -| **Microsoft Defender Application Guard (MDAG) public APIs** | Enable applications using them to be isolated Hyper-V based container which is separate from the host operating system. | -| **[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)** | Application Guard protects Office files including Word, PowerPoint, and Excel. Application icons will have a small shield if Application Guard has been enabled and they are under protection. | +| **[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)** | Standalone mode allows Windows users to use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, user must manually start Microsoft Edge in Application Guard from Edge menu for browsing untrusted sites. | +| **[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)** | Microsoft Defender Application Guard protects users' desktop while they browse the Internet using Microsoft Edge browser. Application Guard in enterprise mode automatically redirects untrusted website navigation in an anonymous and isolated Hyper-V based container, which is separate from the host operating system. With Enterprise mode, you can define your corporate boundaries by explicitly adding trusted domains and can customizing the Application Guard experience to meet and enforce your organization needs on Windows devices. | +| **Microsoft Defender Application Guard (MDAG) public APIs** | Enable applications using them to be isolated Hyper-V based container, which is separate from the host operating system. | +| **[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)** | Application Guard protects Office files including Word, PowerPoint, and Excel. Application icons have a small shield if Application Guard has been enabled and they are under protection. | | **[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)** | The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Microsoft Defender Application Guard. | -| **[Windows containers](/virtualization/windowscontainers/about/)** | Universal Windows Platform (UWP) applications run in Windows containers known as app containers. Processes that run in app containers operate with low integrity level, meaning they have limited access to resources they do not own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the filesystem, registry, and other resources. The app container also enforces restrictions on network connectivity; for example, access to a local host is not allowed. As a result, malware or infected apps have limited footprint for escape. | +| **[Windows containers](/virtualization/windowscontainers/about/)** | Universal Windows Platform (UWP) applications run in Windows containers known as app containers. Processes that run in app containers operate with low integrity level, meaning they have limited access to resources they don't own. Because the default integrity level of most resources is medium integrity level, the UWP app can access only a subset of the filesystem, registry, and other resources. The app container also enforces restrictions on network connectivity; for example, access to a local host isn't allowed. As a result, malware or infected apps have limited footprint for escape. | | **[Windows Sandbox](/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview)** | Windows Sandbox provides a lightweight desktop environment to safely run untrusted Win32 applications in isolation, using the same hardware-based Hyper-V virtualization technology to isolate apps without fear of lasting impact to your PC. | diff --git a/windows/security/includes/sections/cloud-services.md b/windows/security/includes/sections/cloud-services.md index c4d7b76626..defd2bea71 100644 --- a/windows/security/includes/sections/cloud-services.md +++ b/windows/security/includes/sections/cloud-services.md @@ -10,10 +10,10 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| | **[Azure AD join, Active Directory domain join, and Hybrid Azure AD join with single sign-on (SSO)](/azure/active-directory/devices/concept-azure-ad-join)** | Microsoft Azure Active Directory is a comprehensive cloud-based identity management solution that helps enable secure access to applications, networks, and other resources and guard against threats. | -| **[Security baselines](/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client.

Windows 11 can be configured with Microsoft’s MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | +| **[Security baselines](/mem/intune/protect/security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client.

Windows 11 can be configured with Microsoft's MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. | | **[Remote wipe](/windows/client-management/mdm/remotewipe-csp)** | When a device is lost or stolen, IT administrators may want to remotely wipe data stored on the device. A helpdesk agent may also want to reset devices to fix issues encountered by remote workers.

With the Remote Wipe configuration service provider (CSP), an MDM solution can remotely initiate any of the following operations on a Windows device: reset the device and remove user accounts and data, reset the device and clean the drive, reset the device but persist user accounts and data. | | **[Manage by Mobile Device Management (MDM) and group policy](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines)** | Windows 11 supports modern device management so that IT pros can manage company security policies and business applications without compromising user privacy on corporate or employee-owned devices. With MDM solutions, IT can manage Windows 11 using industry-standard protocols. To simplify setup for users, management features are built directly into Windows, eliminating the need for a separate MDM client. | -| **[Universal Print](/universal-print/)** | Unlike traditional print solutions that rely on Windows print servers, Universal Print is a
Microsoft hosted cloud subscription service that supports a zero-trust security model by
enabling network isolation of printers, including the Universal Print connector software, from
the rest of the organization’s resources. | +| **[Universal Print](/universal-print/)** | Unlike traditional print solutions that rely on Windows print servers, Universal Print is a
Microsoft hosted cloud subscription service that supports a zero-trust security model by
enabling network isolation of printers, including the Universal Print connector software, from
the rest of the organization's resources. | ## Update diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md index b2e9e25496..61ad10748b 100644 --- a/windows/security/includes/sections/identity.md +++ b/windows/security/includes/sections/identity.md @@ -9,11 +9,11 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| -| **[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)** | Windows 11 devices can protect user identities by removing the need to use passwords from day one. It’s easy to get started with the method that’s right for your organization. A password may only need to be used once during the provisioning process, after which people use a PIN, face, or fingerprint to unlock credentials and sign into the device.

Windows Hello for Business replaces the username and password by combining a security key or certificate with a PIN or biometrics data, and then mapping the credentials to a user account during setup. There are multiple ways to deploy Windows Hello for Business, depending on your organization’s needs. Organizations that rely on certificates typically use on-premises public key infrastructure (PKI) to support authentication through Certificate Trust. Organizations using key trust deployment require root-of-trust provided by certificates on domain controllers. | -| **[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)** | Windows presence sensing provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to your presence to help you stay secure and productive, whether you’re working at home, the office, or a public environment. Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to automatically lock your device when you leave, and then unlock your device and sign you in using Windows Hello facial recognition when you return. Requires OEM supporting hardware. | -| **[Windows Hello for Business Enhanced Security Sign-in (ESS) ](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in.

Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more.

For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft-issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. | +| **[Windows Hello for Business](/windows/security/identity-protection/hello-for-business)** | Windows 11 devices can protect user identities by removing the need to use passwords from day one. It's easy to get started with the method that's right for your organization. A password may only need to be used once during the provisioning process, after which people use a PIN, face, or fingerprint to unlock credentials and sign into the device.

Windows Hello for Business replaces the username and password by combining a security key or certificate with a PIN or biometrics data, and then mapping the credentials to a user account during setup. There are multiple ways to deploy Windows Hello for Business, depending on your organization's needs. Organizations that rely on certificates typically use on-premises public key infrastructure (PKI) to support authentication through Certificate Trust. Organizations using key trust deployment require root-of-trust provided by certificates on domain controllers. | +| **[Windows presence sensing](https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb)** | Windows presence sensing provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to your presence to help you stay secure and productive, whether you're working at home, the office, or a public environment. Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to automatically lock your device when you leave, and then unlock your device and sign you in using Windows Hello facial recognition when you return. Requires OEM supporting hardware. | +| **[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)** | Windows Hello biometrics also supports enhanced sign-in security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign in.

Enhanced sign-in security biometrics uses VBS and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated. These specialized components protect against a class of attacks that include biometric sample injection, replay, tampering, and more.

For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft-issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional class of attacks. | | **[Fast Identity Online (FIDO2) security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)** | Fast Identity Online (FIDO) defined CTAP and WebAuthN specifications are becoming the open standard for providing strong authentication that is non-phishable, user-friendly, and privacy-respecting with implementations from major platform providers and relying parties. FIDO standards and certifications are becoming recognized as the leading standard for creating secure authentication solutions across enterprises, governments, and consumer markets.

Windows 11 can use external FIDO2 security keys for authentication alongside or in addition to Windows Hello which is also a FIDO2 certified passwordless solution. Windows 11 can be used as a FIDO authenticator for many popular identity management services. | -| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 education editions supports federated sign-in with third-party identity providers. Federated sign-in enables secure sign in through methods like QR codes or pictures. | +| **[Federated sign-in](/education/windows/federated-sign-in)** | Windows 11 Education editions support federated sign-in with third-party identity providers. Federated sign-in enables secure sign in through methods like QR codes or pictures. | | **[Smart Cards for Windows Service](/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service)** | Organizations also have the option of using smart cards, an authentication method that pre-dates biometric sign in. Smart cards are tamper-resistant, portable storage devices that can enhance Windows security when authenticating clients, signing code, securing e-mail, and signing in with Windows domain accounts. Smart cards can only be used to sign into domain accounts, not local accounts. When a password is used to sign into a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. | ## Advanced Credential Protection @@ -23,6 +23,6 @@ ms.topic: include | **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Azure Active Directory-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it. | | **[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | | **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take pre-emptive action before their password is used against them or their organization. | -| **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows ensures that shared resources are available to users and groups other than the resource’s owner and are protected from unauthorized use. IT administrators can manage users’, groups’, and computers’ access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions.

Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | -| **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | Enabled by default in Windows 11 Enterprise, Windows Credential Guard uses hardware-backed, virtualization-based security (VBS) to protect against credential theft. With Windows Credential Guard, the Local Security Authority (LSA) stores and protects secrets in an isolated environment that is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.

By protecting the LSA process with virtualization-based security, Windows Credential Guard shields systems from credential theft attack techniques like pass-the-hash or pass-the-ticket. It also helps prevent malware from accessing system secrets even if the process is running with admin privileges. | -| **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | Window Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that is requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.

Administrator credentials are highly privileged and must be protected. When you use Windows Defender Remote Credential Guard to connect during Remote Desktop sessions your credential and credential derivatives are never passed over the network to the target device. If the target device is compromised, your credentials are not exposed. | +| **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows ensures that shared resources are available to users and groups other than the resource's owner and are protected from unauthorized use. IT administrators can manage users', groups', and computers' access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions.

Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | +| **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | Enabled by default in Windows 11 Enterprise, Windows Credential Guard uses hardware-backed, Virtualization-based security (VBS) to protect against credential theft. With Windows Credential Guard, the Local Security Authority (LSA) stores and protects secrets in an isolated environment that isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.

By protecting the LSA process with Virtualization-based security, Windows Credential Guard shields systems from credential theft attack techniques like pass-the-hash or pass-the-ticket. It also helps prevent malware from accessing system secrets even if the process is running with admin privileges. | +| **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | Window Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that is requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.

Administrator credentials are highly privileged and must be protected. When you use Windows Defender Remote Credential Guard to connect during Remote Desktop sessions, your credential and credential derivatives are never passed over the network to the target device. If the target device is compromised, your credentials aren't exposed. | diff --git a/windows/security/includes/sections/operating-system.md b/windows/security/includes/sections/operating-system.md index 0f125c1107..32cc551e2d 100644 --- a/windows/security/includes/sections/operating-system.md +++ b/windows/security/includes/sections/operating-system.md @@ -22,7 +22,7 @@ ms.topic: include | **[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction (ASR) rules help to prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization.

Administrators can configure specific ASR rules to help block certain behaviors, such as launching executable files and scripts that attempt to download or run files, running obfuscated or otherwise suspicious scripts, performing behaviors that apps don't usually initiate during normal day-to-day work. | | **[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | Tamper protection is a capability in Microsoft Defender for Endpoint that helps protect certain security settings, such as virus and threat protection, from being disabled or changed. During some kinds of cyber attacks, bad actors try to disable security features on devices. Disabling security features provides bad actors with easier access to your data, the ability to install malware, and the ability to exploit your data, identity, and devices. Tamper protection helps guard against these types of activities. | | **[Microsoft Vulnerable Driver Blocklist](/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules#microsoft-vulnerable-driver-blocklist)** | The Windows kernel is the most privileged software and is therefore a compelling target for malware authors. Since Windows has strict requirements for code running in the kernel, cybercriminals commonly exploit vulnerabilities in kernel drivers to get access. Microsoft works with the ecosystem partners to constantly identify and respond to potentially vulnerable kernel drivers.

Prior to Windows 11, version 22H2, the operating system enforced a block policy when HVCI is enabled to prevent vulnerable versions of drivers from running. Starting in Windows 11, version 22H2, the block policy is enabled by default for all new Windows devices, and users can opt-in to enforce the policy from the Windows Security app. | -| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Commonly used folders, such as those used for documents, pictures, downloads, are typically included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.

Controlled folder access helps to protect user’s valuable data from malicious apps and threats, such as ransomware. | +| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Commonly used folders, such as those used for documents, pictures, downloads, are typically included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.

Controlled folder access helps to protect user's valuable data from malicious apps and threats, such as ransomware. | | **[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use MDM or group policy to distribute the configuration file to multiple devices. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | | **[Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their credentials into a potentially risky location. IT can customize which notifications appear via MDM or group policy. The protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. | | **[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams to detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents: endpoint behavioral sensors, cloud security analytics, threat intelligence and rich response capabilities. | From 367ea6d89fd6c6cc17003fb68f255fc648bf5785 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 6 Jun 2023 13:29:29 -0400 Subject: [PATCH 11/30] Update metadata --- windows/security/docfx.json | 8 ++++++++ windows/security/operating-system-security/index.md | 11 +---------- .../cryptography-certificate-mgmt.md | 5 ----- ...olling-the-health-of-windows-10-based-devices.md | 9 --------- .../secure-the-windows-10-boot-process.md | 12 ++---------- .../system-security/trusted-boot.md | 7 ++----- .../wdsc-account-protection.md | 7 ------- .../wdsc-app-browser-control.md | 8 -------- .../wdsc-customize-contact-information.md | 7 ------- .../wdsc-device-performance-health.md | 7 ------- .../wdsc-device-security.md | 8 -------- .../wdsc-family-options.md | 7 ------- .../wdsc-firewall-network-protection.md | 6 ------ .../wdsc-hide-notifications.md | 7 ------- .../wdsc-virus-threat-protection.md | 11 ----------- .../windows-defender-security-center.md | 13 ++----------- .../available-settings.md | 10 ---------- .../enhanced-phishing-protection.md | 10 +--------- .../microsoft-defender-smartscreen/index.md | 11 ++--------- 19 files changed, 18 insertions(+), 146 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index e079c36962..76aef6d940 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -77,6 +77,8 @@ "application-security/application-isolation/windows-sandbox/**/*.md": "vinaypamnani-msft", "identity-protection/**/*.md": "paolomatarazzo", "identity-protection/**/*.yml": "paolomatarazzo", + "operating-system-security/**/*.md": "vinaypamnani-msft", + "operating-system-security/**/*.yml": "vinaypamnani-msft", "operating-system-security/data-protection/**/*.md": "paolomatarazzo", "operating-system-security/data-protection/**/*.yml": "paolomatarazzo", "operating-system-security/network-security/**/*.md": "paolomatarazzo", @@ -90,6 +92,8 @@ "application-security/application-isolation/windows-sandbox/**/*.md": "vinpa", "identity-protection/**/*.md": "paoloma", "identity-protection/**/*.yml": "paoloma", + "operating-system-security/**/*.md": "vinpa", + "operating-system-security/**/*.yml": "vinpa", "operating-system-security/data-protection/**/*.md": "paoloma", "operating-system-security/data-protection/**/*.yml": "paoloma", "operating-system-security/network-security/**/*.md": "paoloma", @@ -134,6 +138,10 @@ "✅ Windows Server 2019", "✅ Windows Server 2016" ], + "operating-system-security/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10" + ], "operating-system-security/data-protection/**/*.md": [ "✅ Windows 11", "✅ Windows 10", diff --git a/windows/security/operating-system-security/index.md b/windows/security/operating-system-security/index.md index cb0887f0d5..7787d87aa3 100644 --- a/windows/security/operating-system-security/index.md +++ b/windows/security/operating-system-security/index.md @@ -1,17 +1,8 @@ --- title: Windows operating system security description: Securing the operating system includes system security, encryption, network security, and threat protection. -ms.reviewer: -ms.topic: article -manager: aaroncz -ms.author: vinpa -author: vinaypamnani-msft -ms.prod: windows-client -ms.technology: itpro-security ms.date: 09/21/2021 -appliesto: - - ✅ Windows 11 - - ✅ Windows 10 +ms.topic: article --- # Windows operating system security diff --git a/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md index 3002e2b481..b4e2ec7e0f 100644 --- a/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md +++ b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md @@ -1,13 +1,8 @@ --- title: Cryptography and Certificate Management description: Get an overview of cryptography and certificate management in Windows -author: vinaypamnani-msft -ms.author: vinpa -manager: aaroncz ms.topic: conceptual ms.date: 09/07/2021 -ms.prod: windows-client -ms.technology: itpro-security ms.reviewer: skhadeer, raverma --- diff --git a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 8e947b0cad..07b80452ad 100644 --- a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -1,17 +1,8 @@ --- title: Control the health of Windows devices description: This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows devices. -ms.prod: windows-client ms.date: 10/13/2017 -ms.localizationpriority: medium -ms.technology: itpro-security -author: vinaypamnani-msft -ms.author: vinpa -manager: aaroncz ms.topic: conceptual -appliesto: - - ✅ Windows 11 - - ✅ Windows 10 --- # Control the health of Windows devices diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index 517ff0f3be..f8d2fd035d 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -1,19 +1,11 @@ --- title: Secure the Windows boot process description: This article describes how Windows security features help protect your PC from malware, including rootkits and other applications. -ms.prod: windows-client -ms.author: paoloma -author: paolomatarazzo -manager: aaroncz +ms.topic: conceptual +ms.date: 03/09/2023 ms.collection: - highpri - tier1 -ms.topic: conceptual -ms.date: 03/09/2023 -ms.technology: itpro-security -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Secure the Windows boot process diff --git a/windows/security/operating-system-security/system-security/trusted-boot.md b/windows/security/operating-system-security/system-security/trusted-boot.md index 4cce0a44d5..a5b511cc48 100644 --- a/windows/security/operating-system-security/system-security/trusted-boot.md +++ b/windows/security/operating-system-security/system-security/trusted-boot.md @@ -1,14 +1,11 @@ --- title: Secure Boot and Trusted Boot description: Trusted Boot prevents corrupted components from loading during the boot-up process in Windows 11 -author: vinaypamnani-msft -ms.author: vinpa -manager: aaroncz ms.topic: conceptual ms.date: 09/21/2021 -ms.prod: windows-client -ms.technology: itpro-security ms.reviewer: jsuther +appliesto: + - "✅ Windows 11" --- # Secure Boot and Trusted Boot diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md index aa2c080f9e..f7347a47de 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md @@ -1,15 +1,8 @@ --- title: Account protection in the Windows Security app description: Use the Account protection section to manage security for your account and sign in to Microsoft. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md index 66f31a6cf3..a4e6a2916e 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-app-browser-control.md @@ -1,16 +1,8 @@ --- title: App & browser control in the Windows Security app description: Use the App & browser control section to see and configure Windows Defender SmartScreen and Exploit protection settings. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -manager: aaroncz -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # App and browser control diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md index 3ed5892096..d792fabd4f 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-customize-contact-information.md @@ -1,15 +1,8 @@ --- title: Customize Windows Security contact information description: Provide information to your employees on how to contact your IT department when a security issue occurs -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Customize the Windows Security app for your organization diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md index def0a10485..788b0eb298 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md @@ -2,14 +2,7 @@ title: Device & performance health in the Windows Security app description: Use the Device & performance health section to see the status of the machine and note any storage, update, battery, driver, or hardware configuration issues ms.date: 12/31/2018 -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md index 171cff5260..d8c7dc4704 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md @@ -1,16 +1,8 @@ --- title: Device security in the Windows Security app description: Use the Device security section to manage security built into your device, including virtualization-based security. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -manager: aaroncz -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Device security diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md index 0b4c5817bc..744a0a293c 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md @@ -1,15 +1,8 @@ --- title: Family options in the Windows Security app description: Learn how to hide the Family options section of Windows Security for enterprise environments. Family options aren't intended for business environments. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md index e19bcb596b..734193578c 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -1,14 +1,8 @@ --- title: Firewall and network protection in the Windows Security app description: Use the Firewall & network protection section to see the status of and make changes to firewalls and network connections for the machine. -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Firewall and network protection diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md index 6de436c17c..d21b237aae 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-hide-notifications.md @@ -1,15 +1,8 @@ --- title: Hide notifications from the Windows Security app description: Prevent Windows Security app notifications from appearing on user endpoints -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa ms.date: 12/31/2018 -ms.technology: itpro-security ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Hide Windows Security app notifications diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md index c52e5e7bed..852c8fc260 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -1,19 +1,8 @@ --- title: Virus and threat protection in the Windows Security app description: Use the Virus & threat protection section to see and configure Microsoft Defender Antivirus, Controlled folder access, and 3rd-party AV products. -keywords: wdav, smartscreen, antivirus, wdsc, exploit, protection, hide -ms.prod: windows-client -ms.localizationpriority: medium -author: vinaypamnani-msft -ms.author: vinpa -ms.reviewer: -manager: aaroncz -ms.technology: itpro-security ms.date: 12/31/2017 ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Virus and threat protection diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md index bafcbcac6d..039d7fc3a6 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md @@ -1,20 +1,11 @@ --- title: Windows Security app description: The Windows Security app brings together common Windows security features into one place. -ms.prod: windows-client -ms.localizationpriority: medium -author: vinaypamnani-msft -ms.author: vinpa -ms.reviewer: -manager: aaroncz +ms.date: 12/31/2017 +ms.topic: article ms.collection: - highpri - tier2 -ms.date: 12/31/2017 -ms.topic: article -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Windows Security app diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md index 18f1795945..1b896b0738 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/available-settings.md @@ -1,18 +1,8 @@ --- title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings. -ms.prod: windows-client -author: vinaypamnani-msft -ms.localizationpriority: medium ms.date: 05/31/2023 -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.technology: itpro-security ms.topic: reference -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 --- # Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 74a3cd15d9..f474a45688 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -1,18 +1,10 @@ --- title: Enhanced Phishing Protection in Microsoft Defender SmartScreen description: Learn how Enhanced Phishing Protection for Microsoft Defender SmartScreen helps protect Microsoft school or work passwords against phishing and unsafe usage on sites and apps. -ms.prod: windows-client -ms.technology: itpro-security -author: vinaypamnani-msft -ms.author: vinpa -ms.reviewer: paoloma -manager: aaroncz -ms.localizationpriority: medium ms.date: 05/31/2023 -adobe-target: true +ms.topic: conceptual appliesto: - ✅ Windows 11, version 22H2 -ms.topic: conceptual --- # Enhanced Phishing Protection in Microsoft Defender SmartScreen diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md index 8b326614fd..3940c5070c 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md @@ -1,19 +1,12 @@ --- title: Microsoft Defender SmartScreen overview description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. -ms.prod: windows-client -author: vinaypamnani-msft -ms.author: vinpa +ms.date: 05/31/2023 +ms.topic: article ms.localizationpriority: high -ms.reviewer: -manager: aaroncz -ms.technology: itpro-security -adobe-target: true ms.collection: - tier2 - highpri -ms.date: 05/31/2023 -ms.topic: article appliesto: - ✅ Windows 11 - ✅ Windows 10 From e7da3c2864926831cdd4c549126f9010c301b272 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 6 Jun 2023 13:57:34 -0400 Subject: [PATCH 12/30] More changes --- .../system-security/cryptography-certificate-mgmt.md | 4 ++-- ...by-controlling-the-health-of-windows-10-based-devices.md | 6 +++--- .../virus-and-threat-protection/toc.yml | 1 - 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md index b4e2ec7e0f..191b2d7c9c 100644 --- a/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md +++ b/windows/security/operating-system-security/system-security/cryptography-certificate-mgmt.md @@ -26,6 +26,6 @@ These modules are natively exposed on Windows through the Crypto API (CAPI) and ## Certificate management -Windows offers several APIs to operate and manage certificates. Certificates are crucial to public key infrastructure (PKI) as they provide the means for safeguarding and authenticating information. Certificates are electronic documents used to claim ownership of a public key. Public keys are used to prove server and client identity, validate code integrity, and used in secure emails. Windows offers users the ability to auto-enroll and renew certificates in Active Directory with Group Policy to reduce the risk of potential outages due to certificate expiration or misconfiguration. Windows validates certificates through an automatic update mechanism that downloads certificate trust lists (CTL) daily. Trusted root certificates are used by applications as a reference for trustworthy PKI hierarchies and digital certificates. The list of trusted and untrusted certificates are stored in the CTL and can be updated by administrators. In the case of certificate revocation, a certificate is added as an untrusted certificate in the CTL causing it to be revoked globally across user devices immediately. +Windows offers several APIs to operate and manage certificates. Certificates are crucial to public key infrastructure (PKI) as they provide the means for safeguarding and authenticating information. Certificates are electronic documents used to claim ownership of a public key. Public keys are used to prove server and client identity, validate code integrity, and used in secure emails. Windows offers users the ability to autoenroll and renew certificates in Active Directory with Group Policy to reduce the risk of potential outages due to certificate expiration or misconfiguration. Windows validates certificates through an automatic update mechanism that downloads certificate trust lists (CTL) daily. Trusted root certificates are used by applications as a reference for trustworthy PKI hierarchies and digital certificates. The list of trusted and untrusted certificates are stored in the CTL and can be updated by administrators. In the case of certificate revocation, a certificate is added as an untrusted certificate in the CTL causing it to be revoked globally across user devices immediately. -Windows also offers enterprise certificate pinning to help reduce man-in-the-middle attacks by enabling users to protect their internal domain names from chaining to unwanted certificates. A web application's server authentication certificate chain is checked to ensure it matches a restricted set of certificates. Any web application triggering a name mismatch will start event logging and prevent user access from Edge or Internet Explorer. +Windows also offers enterprise certificate pinning to help reduce man-in-the-middle attacks by enabling users to protect their internal domain names from chaining to unwanted certificates. A web application's server authentication certificate chain is checked to ensure it matches a restricted set of certificates. Any web application triggering a name mismatch starts event logging and prevents user access from Microsoft Edge. diff --git a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 07b80452ad..040f7b75d4 100644 --- a/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -325,9 +325,9 @@ The following table details the hardware requirements for both virtualization-ba |Hardware|Motivation| |--- |--- | -|UEFI 2.3.1 or later firmware with Secure Boot enabled|Required to support UEFI Secure Boot.

UEFI Secure Boot ensures that the device boots only authorized code.

Additionally, Boot Integrity (Platform Secure Boot) must be supported following the requirements in Hardware Compatibility Specification for Systems for Windows 10 under the subsection: "System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby"| -|Virtualization extensions, such as Intel VT-x, AMD-V, and SLAT must be enabled|Required to support virtualization-based security.

**Note:** Device Guard can be enabled without using virtualization-based security.
| -|X64 processor|Required to support virtualization-based security that uses Windows Hypervisor. Hyper-V is supported only on x64 processor (and not on x86).

Direct Memory Access (DMA) protection can be enabled to provide extra memory protection but requires processors to include DMA protection technologies.| +|UEFI 2.3.1 or later firmware with Secure Boot enabled|Required to support UEFI Secure Boot. UEFI Secure Boot ensures that the device boots only authorized code. Additionally, Boot Integrity (Platform Secure Boot) must be supported following the requirements in Hardware Compatibility Specification for Systems for Windows 10 under the subsection: "System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby"| +|Virtualization extensions, such as Intel VT-x, AMD-V, and SLAT must be enabled|Required to support virtualization-based security. **Note:** Device Guard can be enabled without using virtualization-based security.| +|X64 processor|Required to support virtualization-based security that uses Windows Hypervisor. Hyper-V is supported only on x64 processor (and not on x86). Direct Memory Access (DMA) protection can be enabled to provide extra memory protection but requires processors to include DMA protection technologies.| |IOMMU, such as Intel VT-d, AMD-Vi|Support for the IOMMU in Windows 10 enhances system resiliency against DMA attacks.| |Trusted Platform Module (TPM)|Required to support health attestation and necessary for other key protections for virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)| diff --git a/windows/security/operating-system-security/virus-and-threat-protection/toc.yml b/windows/security/operating-system-security/virus-and-threat-protection/toc.yml index fdd97bdff1..8e86c254c7 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/toc.yml +++ b/windows/security/operating-system-security/virus-and-threat-protection/toc.yml @@ -2,7 +2,6 @@ items: - name: Microsoft Defender Antivirus 🔗 href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows - name: Configuring LSA Protection - # href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection preserveContext: true - name: Attack surface reduction (ASR) 🔗 From 842451f707d9908e5e70290c482c6e4f0cf9d402 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Jun 2023 10:02:54 -0400 Subject: [PATCH 13/30] Removed alias as per-PG request. --- .../hello-for-business/passwordless-strategy.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 3ad9597e77..9dafd8be5b 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -337,6 +337,3 @@ In this configuration, passwords for SCRIL-configured users expire based on Acti > [!NOTE] > Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability by reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. -## The road ahead - -The information presented here is just the beginning. We'll update this guide with improved tools, methods, and scenarios, like Azure AD joined and MDM managed environments. As we continue to invest in a password-less future, we would love to hear from you. Your feedback is important. Send us an email at [pwdlessQA@microsoft.com](mailto:pwdlessQA@microsoft.com?subject=Passwordless%20Feedback). From 067405ac3b0e8fb41ce44ef36a97fdf17a7bf238 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 11:07:08 -0400 Subject: [PATCH 14/30] Refresh1 --- .../threat-protection/images/community.png | Bin 25079 -> 0 bytes .../applocker/applocker-overview.md | 26 ++---- .../get-support-for-security-baselines.md | 52 +++++------ .../security-compliance-toolkit-10.md | 87 ++++++++---------- .../windows-security-baselines.md | 9 +- 5 files changed, 72 insertions(+), 102 deletions(-) delete mode 100644 windows/security/threat-protection/images/community.png diff --git a/windows/security/threat-protection/images/community.png b/windows/security/threat-protection/images/community.png deleted file mode 100644 index 8d99720c6effdb42989a50fec4d14234f4c326ab..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25079 zcmbTec|6qn_Xln_B!(s?O$>! z5W&C2-XqVze<*Bav>gZtsGE=fA&k39eIA}9ca&9-BA=i{67#WD3;mY-_bDkYM{y@d za~pet+;?AP;3+CccuLaL!Pwry*3rVon&1ot%SCve^7#4NHnwi|77xuG3G!*a3c$0} z|2}JPYIyuotfR$aQ-T}YG!*b1isSFxvoUjYF|;=&cwl>U{PI)({&EWkV=F^=sXaki z{f9_+8gcxzrlGyHh4n*%`t!eo;5qXDe%{I6*py)N$Zz4~Ww&h}KQ^^?B-r};q7I%T zJARp(g`<@zLC*5`%LD|31hSIiYOcwPH8U=lezzU3Z0nV?RRr`kX95Uh#5fJkO34*F zMR4Ag<4kL|N!D!3`&IY(mg4C2zQ?4b9ZKp>gk)QcR5VJ)mqaXMo0`+PsAhX`@Jby+ zWT`%yGviXso5kJgaYC1e50}5zIIK9Ng@$AVv;E&A6|<98Nl5qK!^>J`GQj`eNAnqJ zI_{I#;A31_{(G$XM>n6M`1cWV`5Bv@%zqCdL$)=E{~nVRw?!6Dsi53aXWW>Y@V;0) z)fo~(5wF0G*rZ+$zsoPWfWdffM}H$++alZM~pCHR;mq*n8FC;6> z{1JXD{tYDQ|6PR=TDJPX5Jj!lh9{rIVrL2`s3*j^ ze*6FL{rLZU2iHaq2icMp>eh{2iRf$gtP+UZvlbfCO-Kn=Iugm4a=9z9-M#m!2bkBN zUb%dqBTnl@3;x*~ix>}j;_*&zd&9arn0mWpEJC>e-I{i<;Q^8)VoFk_*)Ex_ZKWkR zE-GqAWW852UY@V6_WZz_zkLO3gdsX2L`l0EDb>72Bs(7GY<%}=)<}j|u>-DiV_N-} z4|zS0-xR+%a{7plWbLwkJE=H=gy_^MJsvZwlUSU3^5hAbUwU3%-p7yhjJx5YoN;m) zI91dpf2*kYxJ6io43b1`W^Z|hM8$i?ZMM0!F7rV6$*W6LO;*;{%S%fZr9XfFHj8ch zb6K}yBAvy5d~AK-jMR0;@OOoU**$af^YefIx(7(CWm~@X_is+SspQgd_l^Db@BWo* zR=;_k`M$BEW00K4)uUzcH++f9U~PJ5{kPg@AmorwGwZCE#J#8Nv36A>aFK}g#6-sU z_AE7y_I^|CA2S;Tg@yl6P1#p4GBWZ<+<)*Oymd-lU43(NbK38SZO5awQ}k&6X5DVb zj~^PEnhdfrXV0GHh@%wN-DC|l;-vQrh&4oqwS14<#i*RbVt9DbQQ*qFc1{3)#L&pd z$nbD8KEJ4_sIoE#C@9_x8T-v)pEml3}wRt-d8BqOYQp~T`nRv&sYA|K#tj?wdTwynQK+E&8ph+UYS#Xp&oe3-7#iC9 z`KWO7&!2is$HxBOzkjFO{_f`_wHF0t}t42#1kWp2&7bLnr(Vcnc24lxX&+{RYwL6nx2?+_A zcOn_XKM_xonsYA?SH#L?ap_g>yj*hIH?Hj#Abu{F1-TF@^4HwR$kz}Z!$v9|)js|7 z=~J8PHEA0g8?N~KT3RoYlJW`*AEJMEKivD|ETR|-_4$y;Ep$?(|3lUAE0{-XIH~?edQ}nLq9|xKPgaV$M@NYX=?+ zmuBkAB1L4=l?Mg}wC>+88CnuOm{aoFpJKj;+MJHpS5#1d+gQE!>AYh0#$lSgf%D<`qY>>gO! zf(Nm}&oP$s_fFjP&oYoD06mJS_67SRz?@M7sZcUDGg z9u;XpIdDx)OH0$ge?QaWr*&BmuR_lUT<9wjcX=@saT?t$imEB~{t+DoMaYa#Hcs!? zOCxqo<-F;49C>=#jmSpYz~G0xm)dNL-+s3$F(+CD`> zZ@x}~ zfIjR>+?Tg+Ibz#L3f6Z$LL`ZFFUhmV_ROi_P|-3b4iE&y%X{TRq*_AGT$X1)qtG**bv3Dji;L^qw{Ksj*ULuTAKBX4y12NQnr3Nn(o>T9Bb)Fd zY1}AE3SR>}8qUif_ousCx6_e1v+5jiO%r&=@Ifm+4E05SE54)#0|RY76lGSAMYyyv zU(&6Juok0NUmt4o#kaHgKa-wTBwmg%GTb2FIKBSBeNS}hI(Q85RU(h*WnBtf3uQZa?zcF?2m~jv1sV(iqgn~ zqWR$d{n++txS$lpY}H(Oc4Is`U*oDcvPg>)L*3L!^*}bpoGdB(K2O+9uP=*myywEfUn0J zpg%2aLZh?8z{jZ%x}Ddjp{8bDsw3;f!osqKPt9=kVey|rGf0n9pTr{M41&dn0YNk) z*-R`lhlgWYcMm*Q56_UW#J8LBoO@vkS%5aPvRZ^9d+OAw3f*^ES<_2p zVhz z!Gn&DjtdtqSeE`Y=Y6A^+t${$&|m16-Z1CLB1O=b$u1{}nIzesL)}C{&vcvRS zmda)Eps76n&Sl@U86`Otppmzejzp zg>UjIJgFHito=*bED|8mJvMd(Eq>0ivZkhnyKdj!#DtA5B&TmaA|j&XVJFl@-~4-l zSVV%n8872`Mn(Za!JawC$B!R7IhBrBlUJN}q(Mn_^L7+3&d$!Rcy3p9bSS(qwZjzV z3D?TYX8FTI&1ql(GY%yn&Vz!gO$l6q^Qi?!U&s^$f!Ao!^9=7$M zxbal2w&JMzG2c7p7r8l21E{#a*jlg8{yfPGNh6sZotFf*{*wM$w9)9damJ51B(_KX zoW`_nR0mJ+D+(0}(|2wNb)FCZl$y%qi)CkLhwL&gLJw4*36Zq1DOAnHoIg)|+Kn|D z&CHyZoZM?!%3ZxG!A7?`?nlF=UyBKAG1z-4m!d3pkR7q*NQI;2{jEcbwNP^B-xNx ziCh-lux5?kF?u=zU{$4?ycYE1Bo^=B@#&LvxU>WGtL@PzG{eeB31eg9^XJd=D%Ab? zeiteM09hN6-Cwa{SZr*Y)(c^`b(37RpTooZa3ZdR&ci`)|6?wamiF@H&SFU?Pl7x^ z9D$Ttr-dIQRW9MunQ~ds;TXf&;czJ__3%F3Sv6E{!}@=p`}5<+i`J#$J~ zM$}WcK%;78`BDG7g8Y0mRbWrH(iDGfZSCRE*x?V$(yh%+3*JO1LvYsNt+y7TJM68s zG9LjV))YvwUgXu!Jc)&cg&jWzx?NI-?}cn-oU2f3X=$lZ(dP}JfnJ#ykE!sRaLE9T zK7S4#u`bgofY1OQcW`jPv}$wGhqds)RWDbqC@Lzxkh@eeXjQ6nE>M<@?xyvy>-LCC z|BoNI&`Ex4dwU)vVt?_Ws9!pwjAHE*Wq^^3%l3R<9-!LzcBoOeQob?hxi(DOKen>M zQ(X*Y%@L+&U>JL{QZshARmRyq?^r33UXOn^v;?1zflGH_c-R993_U%4WmVNR`u2kR zWq?V0e*XM9Hpac{FDD}-l$g!LL19UONzVv&Mo+jWpF&BU4w>C+K1Ibsn2w43#qZo0 ztl6$IEFf|ci?tP;p3rF$@o_h%Ry*jB(BCYbSfjP{^)++VCTz9XV{fG>B6R(Gi2$Xn zY_BXYLrJybtAZNJ$ESfqDW-{x^!2Ih>yHf&Q+1#75qqVKb98oQ5_bQPl_iy{MomK# z86JKG6$8U*4wC>`T~tCY+ZfxvU6gQ8=~Q@Hqzu0bTGUJZqhTQO{Sx4#Q0!wrav3 zaWzg31~&}#(9#x64IfKOZ($ibUhBVP!=>Ro z9G}ObGMltp4sVK!zfY|VS2|r~3_p%vdV0E*AW}*NC6)N5!>pvk>(Jqc*UduQUdX+jbtt?{5P=tm~`b?X#X1<8`7CYd3o(K z8&D0#s@)t63|nyf{nwgh3#O!+)>95Q65N+n^c?dt> zVzjouyK!)E0H-gWTR$~1F)<-wZed{v3a!%uy~OO!+7y&NY|M9FXj4z?OVokMnk4AN zo$(7shOlH~&Ua0O(8ZhyZtgnxO-Y!}8flJsq(1p`M(HEaNi}|kXiO{AqM@Ooncu%f zcE*WAGkhDy({BSb68KP2@$k;Y)st9IxD#n*m?vs*#JwtuY%$vPs4Xg5dnmd$2$Pi> z$61A*30wa7c0)9ow7;gFTZS$#F( zsX6?+0NCojp5Ext(8k^YjGAy6ozQ1jlxD^q1@zsf;~>|eI|l>=oWE(UTjdNfD#*wn z+E?$hbb9pY>gP*sCg06@U&v*d^CotfJ>cpWT&dnzZ|81Wx=cs$!qg&>tc|MGF7XYV zAC0`Y_UWie3JpH%mnX3>GKD_88Jo8M8XAf+&g$`F7|#;lJm!P?xG_7MqnN$0vf{P3 zRQAN(T~Y-`lzaE?L5v}3sDq}KN2(y?r%#_2-D#jnOiH40WGV7A}-c7QX5>M^TbWsqjbKPMWsA6==BTDikfFrmkLd zur+i%ar0vo*<&GHuzKk5PcL4)fXOFZI<^fk3RLF`U25MO=7}G*IPXMY+%`IHZo1d# za=~eaX$*QrTIZci6<@4ks?hE>OsH5E71WIzH_nDgx~94aqzDTO16H#=TcNu_?l5)| zi`ubHl&ZTe<{>X5kVk-P(Sa3qQ)EJEK0buy0{j-moae(@>??GEz8Tx^7)us(v3~sc z8eND7U`rn{Y<#;oc}Rv#3|r?0N=m!n2XI_LO>573(txz|SaGGF3dug)XJ$?{hn#^tu`UygZ9|2%6#EIk_9t?A`Z6DG^)-R=exLJo4F)-IdUJBb5KzHv zyMq=(-@g}6HWW#_gMdV=g{0$bZ{)(zTj9&c`MF@qOQ4IGis}vK>brFki@SM!mb{F< zSQKSIpCze{T!pS4M;y?qel(xy+f3}?j?#xgxdKER1_gF#a4;b$3GxD}gKc_o>1+Ul z9#*!vtW2{&BVO)O>I~f9%^L5>dwe*_}yyBE(cSq!9B9jwcy8`S!}(l~5kWaFoiva_=b_3HrYL?GSgvf_b(Lfl3@_2TI}?)Xnqqqm4|%Shr>>9*0=JHwirF3RBj zCD~s1j|uvSFe-{&qMbwJiw6jr48%GVx#EO6AC_njgfx-?=eYJM{Jbx=T=(6@I}rm` ze1V4bgi$lQs=3cQXYS>yiKLNtDkR9maJR*Lw8jjr%E`$IF5It%=OxAZu24QRuflmM zGI8Xm)>g0Gc6~lx-me`UJ_+@fL#G2lnE6j1DV^k}j>f`AhYB!g^$|WxW+w3m1azE( zGOxWdC|1xT0|H1(bxw;@hDfqT%ivI<^6Y-dM!Y;%JOE=sm*xHS__}I<0?@amq@>&$ zfM|&ykUXovBD*Ib403jjn6WV|7T3ZlVKKIO2pl|DlTQoPkb{ zCTqfHskRj_e*TP*l*S0V_nMWY2tRR#P7L4_s+)ZU%#^dxtES7f#j;f4z)(|Dd;aOZ z!|bstF0ez8*m)9*6cIqwK-c~JNk<}{-2-?S(+Ziv8eQ&rPze`q@%QiMf=C*TV#|h5 zd+{p+q!g_q9_H_rx+9U^uTQ2J`Dqa zY|NaaKx|tV@9EKUq@=^bk88eIAjEWZbRsafGSoN}*kf^_)@4teo#{Oszhn#@3Z5k) ze9j9W!>lC1@a6RMG+alYr8>vi9mdPCZMs}{VqSNfKW{T>Z*PYX7HVo}2r+d+oyQ{F zYxH1TEY->Gxy8rFcjE?WhzL|crBopbLr$7gA6|ecBGxHg?agyBKlp`1<4kl6N~UxD zBo=9Be#I(@9PMvROia|)iug6)`T5Ox z8Jz?!NU3nP`?^AkP&11NL1DjfV{`P$O0L>lM*-lffv|!?VahWIK$4uLr67IAfGtfVOH6cSC+YO5{o~7UdqGJ)YsE1*SErwaY+?WQ<|h2qaLto#KN^v7w^4xfoG)NpKgGbs33Omb$K2-M z!$VKo&4DoxCEoTn=mC40ONx2n@%Z-@6}v#l?|O(-jp*S}SSykye1XP-eFdcH&{9O}RIVB& zt3<=Tng-qT5*NRAYwEm{SdjY9xcN174GjsxC?G6+0CN^hhZ{4U0ILCy1G4`1^($Nr z3>5$mLNj0#g4qlPiLI-6=skLc`r6tR?wj-b`yRP!p{-N!iL#Z_-sR>Fj*MKArBlsm zn_h>He|UJI)ddw$lK}iP)SNmH=2%#O>h5j)`kxCWl~B7S-|_|GHrx^wjTa8 zOE3@6DuDl>5V6NP0j&bfG(duIc+FO`X)3rF~H~)r*19if}v$ZY)}=c4a#7_bl)kUjI2wwo2~T2CRapr|41N>bYHZ%`gQvih zMqCh-R#7uGoo;L-8h8oB^Z5Aq?#2u-5m-b#*8`Zrjf^DHl_9K9DOMYJlR8#i-BMQ; z7u7i8KqTAj*KfsJSy)g=VpLEUqh%gHE>O({`oK6@l;C~LxXu%pJgPoXsTj%isH=ZXsSf|`=KS2)H$lae;$5=e1z`B zMn@4P{+KUGB7I=Y6eZR7<43BX%Qq{&8T(tQGq)lZ78ix=e|-jt%%n&QX5UlX)d1x0 z>*(+@Dm;0zH)K->tRUabkCs2ctngn?y?Hl_P8uQ7 zZ#A~1*52M^6aVFQz0dEebv^#*3Vg3{ z*NCJD#lsI)d;kJU2J`if0pu$S#z|7wRQQTuvvh2QCO|?itGKur8dq9pe4EKvGY2Ut zK=2j1-xfB>hR9|Mm1MPw>cImhEP{igE<`2dWPmO zoGH|;ST8*KTgVhSlMNbMr`O>IF$>;2Encih>(8#ocxABROVEb$^GRe$SxD54Jw%uT z4Z9!#PHV=uPkYvhGDR*pR(|;+SKbO2Z_Cda-`=1Db3Vcs@@%!9*r!~j!Q~_tVuMP+ zxJa;aiX%Nl^ts|;E_bdXZ^9BVEtBrF_lCUmWKpd)qaqFR)3zt&u#G-R)o z{OJL;#tT#&m?FQy*`Hf;^;`?ne-;@DvQPWbPUO)*PtV4PJ`Uuzl`9ZDRRO>~w$B7@ z>;IwS{!7z$hJ=E_Pu zBcH9T0Ffv|#zP!86}jRjdD#`j>cnAZ1EmA@=+EKooi*2!Skz6Z?Uj9;t{olQIf&zRxdmv-Tg+MMatq58d2$^$(}@MW8`91<@S!h#vHGb#>jG zUs~}J*-P6$P%`$4%oJUGMSQwe^or|lk!XfGd8OHr@UjxF_Gsfya*0RxdX8Y!YmBhT zvn5f(Ts5H6=eZ#YphkdRajbbZ7_5pOZHU6$@43^&eApzqfBVjz)+Xya&`&y3ZBX2) z2`i+Zg3bBbAB3$`75I$Nfmj^bcghx?!1<1n#7uxJ8xxcFOZw<6Q8}* z#r$oAMmKa>|Lm9SO8xOC<8<~06*Wg0+hKm&WxryTu?;7&pj~p4JWu^$)$l52Yqb~^ zSw2jh^z`1` z-+p>^-=T`R!+V}ZQl%Go63;)G%sxsmLI7ee8d`!88B~5%b@jf?AuKTT4B!6Qs3AyG zkgu1dKGRaDdC;o6vo@ACesqDxfsLIN!(fYHc~-w%l7p0CixLYKifDdFFSPxBZqLUu zM0B1?$?uN-g5j8mrVC4GM$^PjcciBykh*Y`$=x3eAH@b;tBf2|7z?=5>fjmQdidI# zUPD8p7Q{CoR;|m<%M0DUeH*?6q-F4oedZx}(Eh8P$95)HbSG{lAXxI8M39<)KqHzk z8bM1Vm$xZ~pz7v#Hz1`GmlUEqOJbH~H~3Ug;Fbi>yVtnul+l+Dd%Jf#?H{{hQp>hH z9^t9}Ns#yR^E0sB{p6@LrkLUG>%pDspm1UM7YYO%=Hjd->g7^mk`j84oWv=TFf#Ur<6e!KMQ+kCB!oj*U-G->n%Eq5^D zHh*B-_1B-SQ{G_>3}L;LXh|vkq26#qZ>!Mi7tPn#34h<+>+{)tx33>)h%I?7k?#Fk z){FC)DImp-9E#o1rTF7ywCEv1bBl{5yzd`t;?9k(d&;SQs6!-(E3lLPnO=KWfKmZY##Sm`LKKdFIoPQ7I>RaXpBr6-i0oBBnycqM~4c zVjt&!7uCZmE$PrAnW3hT?s?k!P3?hPROgIwk(NM8U;;G@NkSbojRu2Y=}eGe_#?`I z@=f`6(2y2+>$&!e5s-OCMnLxk{w*>$nvBUVfsO~z^ez(ioNXzq9<~%^d3Gxz*Pd?8Rwl$_14B@G!+&p1oHZ~@X85J?(D!en+ zQiA$jJh%uv6Kix%em)3E2lVG@R8X1SIF!4w;{Rg74t#9ve4DI?{_(A+PUq$3$;e@g z_7Rht+-_h;2Wk6D=MQvVZwx27nMz+=odZw-dA&9m`L5NKtks_A zi#<7y%>k`gO;1Qj2_C*V zvdRZ`vAB4hb}|4LifIkWaP?{nX(gA-5PJV|kl4+jYcb6q)Fa^2YigeE@2o*tXhm@| z5t>V4HTw=sjcFyK4vTergdlp?u61;FGK+W&Oxwq`go!#Iqy4b3FnE^+gZFRW&I9HL z$}BR+=}_Wa8%67_LQ3f%5R_(cuP`v>Kv5QHQOTJNr%_DV z0rfC%m(*eQvgUbH`AIDFnaF+o>vXmz8*c1^ zG_((P1cwS;K<^rP0R4ey0_Axp7mBz4e|^AoVV$g}U! z&v?8*_=0zC-&6Fpy;pMDdrrWy4i(8TizUb-SON`Ua>!NlJ*dBDz1~AaCMJ^RqP~22 z@gx>iBP~WnZ{A3=$HITbu&=t!lND!-e?FB|@z=kCqWqk;x5RjlBd&46mW>YPV{i?s z=5L;v*`?=3vLb!sWyOMz{zeK#lK4~St}(xqJsI9Vr8?n;z)l)# zYjDK_0?zRYH$?YJc1+tNSimOJGshJ5`x)D`y<3H{;9s3nr*A02MB8A1MX;i&^s1b% zVW?@SsKhRv;y>GjS9U(j_Z-YI)dphc9CJh{<3|SufVkzh#fW+xdMGK;e86zg2<6%0W#BaiWDnHUlu3c2?$wi^UesCfmlRArGQ%6Vd>&i=@KhFV|MG(@_G zNSZu*`ecP%mT$)&A966G0Pqw@p_fw0>=q-g=QqWp0hzGJLMT^lzl4P!dkWa&Dx5Xqji>;n3=D@bRSzKlxZ$$(VZi58S+$X=%*o&RtLH0O{1+ z!h&!H?biU}q`_5ogs(>4wf@ShH(|yEFj}LhfB4p;9%vqr7&E(P$HxtTF9#a3bqYj- zFBNfeS-?xSnb=~+M0LimOK86Bv&5C%|6%5{1%R5BJ8)}G#O5RxhIoQ;f*e8S$kviU zPDdAB#u~e+PXL#Ju>ob$;2{;M6$=x2=(`5DFUG|%j5Hah&Oq7V)-5+E83Yq47$)of z&R@;>L{z1U>!4&5snM(R@;*yRI_sW8o6~LnYK1aDLWl__^1CBVL zZPbJU3;sz4Dg3qS6{@CJa<;ocz}>{RgH>Zgs5*qkv6^54IPc&L#3f5ROl0d6R5|Oi zJ(%P{V)ecW+`oidg$WNuD#r3c;Ht?$){soLtwgjZ`|_&FoGVaC%!&aZWz8OFKcHY#H_Y z%xr$~cUpGUSx7&^e(rlL}$-{^glvbt=119Wzv=|6lxAxLa7g?V{`_P>JrEH_<+ApSrbH5e$P zq;l>8!v-QESSlpaqa@OC`a~>1;7`o^h=~NQsM+gH!|?6H_F)WtOwcv6Z1Q03DcHSO_yMI0K;0#C-v4 zOK8ThHKcawpcPkqnBhxsU4YyO!6p3;+B~T5p0q%iRg5gdlwDIJ95Kal^{TZyf%r)* z_Wr^EIWKlyF~$Us#xTQKnF8w3*%`!kAZk=l2cAcZix4gMA}vRL49vZ7{UqYvp^a92 zz&}gWyfo*f3{3{z;Hu_3;2{mr&Y-ixZ!CTvBf|y;;$z#CmgsZ2OTFcqI28Cxjf{w1 zryUC!Th5>}d|I!lsDRnbL&THXQ-`q9@1VohXgQ*nOJ+y^Z{wqW{%qjcPj zj6q&{Td?K|mU}Hp!vtuUaKByTKN#OWiN*5pntP39>0hvfk%+qrG5IS$cmU;kW7mTz z@=jhK{Bp3h*iT&v^?h3btTlburKAoC6@bzP766~FUcH)>l$5I`m)Q;0Pmr~|=fHFX z&umodSBR2!Ixr63w0-5*}IaG{0(Yy zAo+hhc#g=P?*CyDHZ^!+U|ZijD%b)t%J| zsI5ps@Hs%nEH86?rGt!yv}-W}uea~Zh3!2l6#$zy;JrGvhF_nVnSq>!5UBn3lk=Rg zbp^^E05X|6SYe+&6&6Yc$8OvcP|7tmH60xOsSZhy|75}gP>e zg#NVT44Pqzq9&J9py5lsLeR_;l9Pu=Mo2f=oA6-D1m?W{8Cm_74$>cnosbX;EnPc| zzP^68MP+(AOPpN8$FD2fK~09rI#yOz@=8j;RmR zx|$8pKVTyRhl08djxI1oV-dTBbF;I!y`FJ?YWq$Aw&1Fxl>jL6HdJBeBoXMm&{54|{Bg>7XQQ zQFXPDpx~*NzT!d7>ML+LtM)#BUu$uK?-_FZw)+oT{(TVdZLF>59R(8K019WLn{e|q zFc8b@gGC=DMa91dp2|Mz%dm*}AD6S_ZHD+G4+RifmPlHpA=)4LIdLzn0#;wB$UtdM zX9mkaf6yBXP;bC!weh>dmR~*wXiTu`xYw1GoMHJ;UhWD{r=(m^P67)wAk`k;uV<$> zZfk*6?eZC1a?bA2=IgS>%xt=6zj*_}x)_a+XQU1yW{(9Elxy_e zEY%7#Lr{qXQc{zXtDo+DY@LG5h*wQ`G!=H((b2I!kCuweW~^2L**wt{1gjrAJFZw{ zoK?=JlUTgMeK9Hm3VOgA{Ccj|ugbt9CYRjlpaI@>>J#WUoyoU|omr0! z|1j<`{RC5}l9CdZ&Qb-ieI@kmyLZ50z!3^mK;Txt&wY?*&wKYyF-uh$ zU0hV8f@*=2)ZN`(<+1{&0sQ-YWYGFy!2r@0imX^)gPks%ASb6%Ha($4m{?t3$#`Fs zWNk*^>N9+Ubt&@|Bd)Dy;Eek0)$%0sgZHJ<>n~ComIpUqe&8sHB>DX)w1u_2#fSY? zY@2ta9`ODW=5}^=*4B#Y%3%6|;|dF!;IaGo5u6L`>5eu+C$YGE8Bp}bZnZ{U&Dc4n z=RWwhN&eBUE`m4!7&jl9nZe$LbmlF`S&;bPbA!kGcuZLWIsobd6s*{`ubrJ^6%OPq zzZ?bNk z$Cj4%{21{60y3uxJoxfSHJ9WCLwq~w{R}uY;3pJE8qg`R!!pwMX?ut;*hkApmLZW~ zy=&7QOyX}Xiu+DtVUZ{To=2U6(Vstkh3|k=%F8%1H1rRe%E0^cw7sC9AUGz#OaYQQ zSoI9>7_j(zpGws!0R9E=4|qVqfd?Pv{bOI&GGbz4pi02T299okRF+Y&C$uI6)`x!f7|kdITSJ$yq*u!p1x?GhW~xc%V=CQ0RB!W9uRx*dO_O3 zrC+#Ustubn#t_>lPoN$CoUr}1;YQU|PcpT!OBW&uTD!U5)Y=ZTc!eG~IR3q%p`l=q z1iay+2aw0RtE;#7xeObK#$r|D+k4_)b@cT+XEv&M`yxnAVo_BElLfECG&xbR6Hfw( zopxTIZ)oG3<4-F-e`UTT7?oemLviaicXV?*C#eoH?OjiBMu2w-l?1&BOe|pW1w$k( z7eLt4mCeDam{(Zqo1=)3y@Y^e*t)SgI2ii+kw{;=S}1p5++Y9IrkeZV{d@e)o8(eP zh65n)-@I`HCS})WzS!e5R#1T40r?qRLeNV4ENOD+ZbcARCBaox=z?n>MF|87m=9=4 zXsM5}P)7GGcn@F(e|~|9nVJ0YKCEyFF#($f96Zz?0BKmNB?fL#694@9)7y(u=(((v z`WgpYbA`*rtmuA>r`;(e_3KnaqoaDdy0AF|83$|` zyb$Ps?ChYKZWXE~fQyj3;ONWlUjSB%=7Ip6miEUo**(DNRY3_;&0UfE21Va>CMQQ1cfBqpJij-mF5f%TRb0v^U?{h?K0>X@ z%R5Cv^sjAb>(AVAR>97Vy**fDA#8B&VLs^k>%AU>4K^x5QwG4VPnTmUI=d#gBEJ8yiS+T~@=PrnN@MEa= zJZjh0>;etJ4*KmIjL!zT=fV7+k^(RqZdHp>^vtdaPn+E^NafJ_IO*HLic$Z=qHJh; z`%N>kTPTeTDjG-09~ez?_}WU1NP;BrIsc1aU7E7#5)qpgb}FymvG2qLE6#ME>G(5XfRH%G6cj4m`keGcvm`qnjQ)F9%g3OLCfyJByOh%9fwyADD<#wAP$gHZ~M z`-<5mTAZU^_O^zZ7BHSLnmop|rvKQ2i|#gu8NkZY5;l(TkLm*f<6fi>^ZChK-O)5* z`{2O^e?i|7##Xz$K1z-=d41W3cIqdwpxoGlj{|1gW`kVn}O^4prHgc!Rn)!qo3sp054c(g4O|G4a&D=DfAXIo&-P&0N8c8`oTlr zu2eCNY4uT4fel}%tgvmjLu4fB-~d~IHkOt@hlYp+1zPRaTrpeIUEMGh7mZEZ`#3lX zF#+J7;eQA92eevW0-Yde>~McaNQ8;Zp13NA={QyBu6~C}HMp0+5af60KJXcque^T; z#|h+X@1QeUT0mK=tAq4CB)X6A#h-RsUpa|If;=EkKobC6Yy7Si=jH;Z2i`SaMz90- zjg76Wxr+Rqy$A)cw6tZTx_<%I8fQAwTq<;(tAt@CBvw}I-Itjl7XT;B;Bkii4zSI^ zG~nv$>f!<-gQPeTkGWhM=OQe{ zdM?12pB<|riS~a!iBRDWEt#}T9lG`^O!}>q?524z9i5;$iBCx873*79U*CHD+AED^ zDx_-6JGR;9%hb3OP($@!zTuzAvu9c`O0%>VBde+1u^T-9(~4YEXTXs|JuuaN`Hucw zJf`&$+-e~(A!%#-oEDZ+SrzdUWt2d)t^tUNC%Ay^+&CUh)zu-JUd;v`JjEgjg1lBq zNQPPubVOdFz~ckj=|m~{p3C4A*yw!vfr*Fi2<5G)h?d?A*iiTz0+Fo^?NlruN=jfD z|9ZR`0Zs=fLvYmLoI?vskpJsZ3v&+iRNF6pWZuS_?6KhgBAw>LT{aA7K{T3`z{wN9 zfcpuYYde-jocB5D;n3(y?7;5sbt>XVbP7GN-LcH@OnH@C{$QNbt&W$foz3-$Py9Pv zC^&E6{6Zr%;P$Jn|6zWT7dP^Utv-j-hDZVt*J5O0Zaz@wBB|dm1_p8<2ITJD>-qfo zb8|C^#Al--WfaiL1|QyY!e42CotFB50%csiG2kuyXnjAR-^4d@a+kE8H@qSU2RkZc zJLu~gdBDxvu6RdNgj_;OjK2*;LIr_vLU)D-EGHFcykA?fxi!0#uki>rRlxuJ?07-< zfwuNJCZ<~Z=};^JunT|0o#V}V%Gyxynoi09m!-zh_w_54IT4W$!E9UlDX~XHzKHyX z@S6=T1pRJ!>cc}U00t;^4Gq|80m57b)u2Mm31*Hf^kLAm+m1~#mk~rVf%Fak(?|XR zBxkSy{R(;k3`bCc;WL2GuG*|Vpq>SWU?j=J#xA^J`Eyv{fP_$2C++V$ULPatmBI5- zk@*c;!Fmz=9Kb|CAjs{aqXVK&jrR;dN`(3v+hV{^gk`N?By0rh=Oge1gFrk+`lpoV z28KHR!Ub?K_gMx+QLggOEiN9PE2JrWXei_siF#1{!9^F;G#*YJtHcp!Uo`@6@akjt z!X`ev{t0lBVv>0|IY<&h6am&>JkJ2v$VNsV3WGZ26WaCtwJYR4v23~h3*piizXAjL z2sk}}T~D7r0Jd+**vtI<=j-DOj$7_0c~Ni3lVBh~L~OoWB#5DolY^}asHEaZ2r$4u z0AEs6+5go67~Ek32J&NM85Goi{paF=o`+KzM<0Zw z)+AUmLH6Zl+}OFe*~eF)L$PrsVuC+H*mh)w)MrM@9~r?yblVrvJydr@-zXwSRPLOS zDNub^0Y%EGN4M^a3&tt`I*t1A?vv7dNc3yvajA2GILrikGA)PNZ^rF2o7QNAcNj8f z*zl_zhJ4GOpTMK;8kAcj7TND+B|g~Vqf(z(Z@!mrED#T0rlbV4Tmd_l4>R3a*lktg zAXP-adPhJ*<~ol2f3>2USXu9$IjEC-Xe#`G zzu|Kd7s5u$9U0hE21l(jgK3F&aFq`_s5pu+gkeIwL7{b4Hw&bot_R>6lRw zY|+3DRA68rNYLvZBuo@Y8xXRN$@w8#Nl;tT`xn{+ErY$_SAyRQD|)SacH<;3d?+fk zI3;k%@*S~wi0`@4Ve6Y;W9qzCYN;=I`%p4VWDI~NCYOZ{^y!l-><2m4^)ud&Su24= z95^KbA~jmzmn=&qC^@?(l;q`IYes<#4Qo-|njudi=OlnyXs`%-1<%!&ybKc&31L=(#{YP5=>|#S7TNJ4t0k1ewbwY6 z4B%~JModcDM&DMw5ZdoxOe{7J&9Jy~tL}2hi2BpKd9ImMhr?{6Voum~VZG@8_$rS< z{q;{>2gn}(3vb?X&;^FJOoD9~CjP;jWA2fBj}pm*Nvm~j&#?}XxnKYF>~`V@2fWdG zgZ?X4C(hYy582s=xXBI}fv4LUVHtqeAIkzW6(p9Q6&&OJX$o9Oi|8}mroeqB; z1pfX5Kq4e!G3MDMj_nmFU_$1}`s#gGQI02h0ktqi@nL~RQ_dZE1$C$reaBl3luY#O zB=U|L6sL2n#`EfbD56@#uy`Jx4BVIA-d^A~!LSN{(PMa6=;_}-it$WqtYevOw93`O ztv#piw%otxP-*tsh-IYfbkpkRcam&K>c3XsnFXKbWr^x*>+5RY>wCdQ!8*frukiZB z^^F?}E!HIzU&p`l%4>8d)bF}U?GO3?Dx+Ya{8?IDJIbT*?I7dU?|4tt^Fyx38=*g2 zd_QJgPkTIsza@mPF$ydl9(n&N`nk3B-J1m!7Zc=-_96;O4AID|%gJ_l2`c*Y3^r>c>}H)mmsw#Xc8 z(Vn97e$ab>y>JzZ*xwbydSfg;G}Fbf)EkzP*L}McDV;e$BvD05!9@?sM1WODLBX}x zFiZzL>`ax7frSPb8tJNFjfJP8T94Z~LCYth{uF5Zrn z?Tgt;FHAu~ZkJ-4jPW>$MXxz8G$Cvo{IMc9+dwb_Hz33m{3zc_4sD{CeTIG>mZE|8 zTw6$d19IAz;$+2aK-)t9{BtpM^80r>jqT`YTG<#i^#V1HRf8t_hIQ`|OChG9?Y+Z; zJ!rQo&&9AHK_2{SJM;XKRQcnF?RG2xEMQB$=^T>{=J74!pSWkzD1eFh zS5mnc9lZG&{-6S9dvJ?ED>H%w02@q;*l!=+(Mr+6CiKKv*xrRTQar+-iG_zWiLSP$ zkMSfHzdcL;pPsHf9;)??cZI90iR`i^bz{cZCPbLA+>20zGL}$CWNWAhMVKsgnS`v_ zml3klAY>WI-hv@yi8RO(e$Uje>o1>~Ip&=AyytzN=ew~64Ok}c>!NlMdTCSsz&8*^ znlh&|xQ9{oQF(CoqC$untVc;32dJfO8x;{C?#>|T)zXr)S zq#hLG>W@b{08!93DT7YxnMs$POoph34M0IMGc)<~O`^rP|IlHi9rcrbeuA!_@bWTy zm~}-la-UR+F^m{iA`bc!n*uarDL`vbHo3ZX%&)$?`oa+vk$xK-Jg_$caaLUo3o+ov z=g!&QUX33sb6NNQJr+yhlJ2)}i|lZ-?2%VQE&>@Ws*c|?V*1QXYd}Nl3g8)F29_hj z54CyNJ6^2e46SLF#O~L4Hc$E5s6U?88Q%9iO2NCp><0R3j`0d1b%AxgL6p|*?6%oE z!FQ1J&^N3BkBFbCU0D6I3dUK}I-~A(W2*#fqrNw8%zXkv-@a)+&_DL)?stdz!^D*w z_C9fBtKop1twnhaW#{;{tYUmh|UXLGUQ^! znr8Iojx9m>2k@RlzASS5mtw5}Isa$5hrcYFndiI(j}s&#+}mGl+ZcV3@#@(oDyeVw z;?GbSRbtbBxYjcG%wh2c1ONK^I>28Ej#sUqc|f8-0*2q-T=l9x!4h(!6M(?g__%5) zsvo4ir0mK0cr6Aav91xKW%(YKmNjB*Gsp>8gVUi*jtBYD<~*{Zl*Mi@V~s(}6Ik^WNFV5&3J3_8SVo_Vg9i4Yla=|vrM75*2)mvFzpLUgTIcuW zNi&t6EgSNz3~RX zD!^xZ(-#oy6m3)@3>q})kQIZQx7pT=)35q?jfJmN5>gW)Gm_Q)z3lAvj68?c^5)9t zUcmGU2IgjG$+Gzt1#}$Ici!Te*#Uai+uF*?>8k|wZdkw5oka+1t+**Q4;e0<<8-qO%iP@v7`q)LP&>Px{&W;bIG4yBOelHmR3>Nhkt&S(Vq zrLJ5CB2)4=9Zqq!LgB2hS7GL8mUj+h2ZTD9SKtYsopo9NfxHT}m>f|@Yyq$m4=2fOe`fk8t%Mok+zPvlU^Yzc9?lrKu zQAfn>7;A%wT1d^2-}54y&$JAzEVyc~De&`yFB`xK7!J^eIXh27I)g}83Cw%40;W1Q z;TL`;+c*Zk5$McKWtem%dG4tqyoI!?{Cwb6^u4!Q%UGG?#vH3x zz$--Irv=noT94~nT3f&M6%jYbY%Zq&Pzarbp|pGwJqQB4_Z1aZQ~9ue_szCE`M28{ z5KZ7sj1k2{^CAKQ%Uj#I%VM41putC)lh1NTy~-b$gBleau4rLhZDGF+a0bOmxm^Aj z1@{GOI$n2xkqUVmkr{04?CIHO0rX%FU251WE}kDkT8;i53oybT7jcFM2^6m5t5~!@ zJer&gy~&>FTXX%#Y=)@5ch>ONu5ob4V%+^w4j$U$yaqHwZ?C+vvfsk6yi}rK*!3BT zi2fO>mmWXA3p=3{WPZjurkpwnQ@|(4oa~(PIvx)p9Vh%!VU>TFWnIL)_nv%$aZXQ) zTDX;Hlkf*i^!ri@0Km>=8xE(AjC)msFVi&ez?p-rxS$}-F3CQ{wzf7WD`>f#2~grl zEW{g1Qwv+!_ubQmb`K^oKk5ypi$Z~RYdkys4B!>FzmoqXC0u&3^r&ma!`Gkk&gO^-I}y@(_A4U+*PZgSik&>3nBq=&0p!7XuY-nX;xPC!z@uebqA zfQ9y=g*jix9lxOYdn_EiKqEsN1(z%jHu&wR*JCiGrv1^AstLj^U_Ai~W0@G|01gsr zWWY+R*le%zmp&pU6b|}|_{)cg*>z};HZz~O#Q&|M!ro{1=zHpq@A0*9u}efvwc95S zy5)8!o%P;b9XVIg%P%x5Dzdn8^JDfk!5S(TAyWKDTf$0`uf`a1n_I=m;;m&#_^zt^ z(hb(#@(-IcPDTor{gkW8*B>bvSzM8iE3?JE(u{g{c(8ly)4;|Pdz2hsO|c}YhQ<`8|54kI`_NvgDTvgqg~$PFRP+9Dvy*D9%~Y;>(p%|pm< zD)*L}6pUjE$-=JZ+6&liVA#0r&jAy_!k8A&mVA%slXmMMgYNKi(wB?}xxSO0Xdw0| zS(KF1QdV+A$nBKk4$gerv3QqQ3%~@{qvCLNFnkMn$L26EwD@_SJkiK0t3go>*eIbB z;AdOpekwqBuBU~uGcvIBIq&`nu1B-!%=wF4ypLB2)L zZZ^Y0+SLpYU41EsQvp@;fOWZ=rctE*YN{%$%ox+t;<1QVddP84-_Q7DZyp}KLP(2I zSA!OgY*{j7U!s#mbNH^~R0O)IvJox~ox7sPP7GSUskEie`=}mhf@Bn3axq3Cn6-s{ zES~LtFZ)bnhD-#eX+Psj9}9E92LFl-IdM>`*6y^p0uL?{Liu`TI;T+If*q}N$KM8| z6O>XH7JBff;gqvoAnVc*cukphdWAnk^k6Rj4wdY}W3dfeh_pYvec@G7infWS&1wa|IJ$O&pSdeEb zstwHE5T7B7K$H|0=jZQFEzOXD?Xz+Fiw6+CumVCR)G0Rab=w2au&Oz$qmz&nQB`Fr zN0cp52YIuB;jCQ`OQr;q)|FR0shLQGAId*yXCkLk=Z_6|)I`4CMA)Y8 ze4-sQ>KoHcxxM6AGO-m#$RH0l@;(T9?4dsVmcftQTJ1_QuKY@i{T#o3bbhlXfs#1; ziQsdbZY7Z#ZjS*7*ARhSEZO4LR8V>p1xy zD<7!+=oz&D-UQ8T*?q6NiP*ZbB((EH#XYqf|7`Kboz^;h{~wFYDA~0t&?-FlqX}r7%=fF3et-xQ(lLIen1M? zXph*t4H0#Q`9?kDp0Ps>eRb%!O=4l!6radyjf>_K;5@oD0@qWCjs3opM`v^?(*f$= zuH7_2CK81L;{>uvy$-n7K9P0#La7Ocp`}joLeg%DhJ04l)4#_;sgY7VPPk6tzsy-M zZHT@6q5Qh@4O`bZWlCf zYB@AR^4OIMO&A!lgN?MYQ70wE;_1SxLCQH$>FIozJ~saXqXlc-*Nm-yO2z? zLk^FP#mv=gsn0nDT~|%HKW9xY*)I2-xq+KKz@>K5n%1O<)r!UBks4NKE4I!M_dhh+ zT*mJv_TolXWj!>?y$2^JG&v#}F3mqVhRjy5P#I~ivFa00U~g>UtsTE}m$%Kc)o>8? z*cBD$o%7OK+D)La^GNd9mb;+=`?MCAny5h96G~I!)I!jL0UAdjF8SzUGBB&K# zxZbSekRw7OsrH`dhc6_eG12`HFx@*#8k(C6t!9c@Soos9?Re`-RmsO~_ZLi8ZbSr$ zPB!C8`yHe51KrQoo>%%uaL7pE(##C6OFtq&Y7jMi_=uCV!pX_$p%TGfLuusT^rvl6 zvWFxsL~Jd@8~iO-B%}jnVyC?uZFT{zHy#?lJ>kIFEK@K$JFviRBk^aN;z(}RV6COV;*DpD3K6B z7{N-%xzJOsxb&KOnf2Jtst`jbaj<5NhO3&-?<-8Ia@b*u#2~jx>VLTl_U}36<_3) zmWOT|V16W3$^I4fDduMyyGm?kcm25f0gDOo)Mopj0b(-snYazAr{je!=2>CVRftJv z3Bl`}G^1&ARdxEmG_(sY^Q&AhsN(w9GAZ<~Hk>)*^0Zgh^s9L>WI}mqRm%paZ4Lb( zvHSISw=UM!$M%nTKVId}KKn`3H0?7B{bK79>x`!F$#^1WL|f69&&`L^KR#+XDoqQK zmyT`wdGsj0o%J+*U|Pg!et3jot6^)^Ykr)yZtW)3>i4|(`Myxsdwbltdu|p#gb9e< zuVmOCO@E#7dV8$@&!KG**O_Me`CB+!A|L%NEnyTw2~k)X@MiuL90ON)1eY%?&(^GH zM5z{I$#$8mq3|nIo@_bnpMD%ewX~_9Zq@czV(QpTNc=I2OD73USLF_mVkSz^mU~ihgYqyN7Ir4)T1XpC-!$ zY5kJt-CuWAjDyLz7ewdqItO1z`LFk5#bM&ZEBAH6x_;h!F%AI~f_`WS+OfUv{~y}0 Y?a?kLxDJw_1K6|20BejX*0u}zA57EWmjD0& diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 238a5d1884..019f5a531b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -1,22 +1,16 @@ --- -title: AppLocker +title: AppLocker description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. -ms.assetid: 94b57864-2112-43b6-96fb-2863c985dc9a -ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 ms.topic: conceptual -ms.date: 10/16/2017 +ms.date: 06/07/2023 ms.technology: itpro-security --- @@ -100,7 +94,7 @@ AppLocker is included with enterprise-level editions of Windows. You can author > [!NOTE] > The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. - + ### Using AppLocker on Server Core AppLocker on Server Core installations isn't supported. @@ -132,16 +126,16 @@ For reference in your security planning, the following table identifies the base | Setting | Default value | | - | - | | Accounts created | None | -| Authentication method | Not applicable | +| Authentication method | Not applicable | | Management interfaces | AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell | -| Ports opened | None | +| Ports opened | None | | Minimum privileges required | Administrator on the local computer; Domain Admin, or any set of rights that allow you to create, edit and distribute Group Policy Objects. | -| Protocols used | Not applicable | +| Protocols used | Not applicable | | Scheduled Tasks | Appidpolicyconverter.exe is put in a scheduled task to be run on demand. | -| Security Policies | None required. AppLocker creates security policies. | +| Security Policies | None required. AppLocker creates security policies. | | System Services required |Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation. | -| Storage of credentials | None | - +| Storage of credentials | None | + ## In this section | Topic | Description | diff --git a/windows/security/threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md index 65d2045cbc..cb6fa4d054 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md @@ -24,10 +24,10 @@ More information about this change can be found on the [Microsoft Security Guida Any version of Windows baseline before Windows 10 1703 can still be downloaded using SCM. Any future versions of Windows baseline will be available through SCT. See the version matrix in this article to see if your version of Windows baseline is available on SCT. -- [SCM 4.0 Download](/previous-versions/tn-archive/cc936627(v=technet.10)) -- [SCM Frequently Asked Questions (FAQ)](https://social.technet.microsoft.com/wiki/contents/articles/1836.microsoft-security-compliance-manager-scm-frequently-asked-questions-faq.aspx) -- [SCM Release Notes](https://social.technet.microsoft.com/wiki/contents/articles/1864.microsoft-security-compliance-manager-scm-release-notes.aspx) -- [SCM baseline download help](https://social.technet.microsoft.com/wiki/contents/articles/1865.microsoft-security-compliance-manager-scm-baseline-download-help.aspx) +- [SCM 4.0 Download](/previous-versions/tn-archive/cc936627(v=technet.10)) +- [SCM Frequently Asked Questions (FAQ)](https://social.technet.microsoft.com/wiki/contents/articles/1836.microsoft-security-compliance-manager-scm-frequently-asked-questions-faq.aspx) +- [SCM Release Notes](https://social.technet.microsoft.com/wiki/contents/articles/1864.microsoft-security-compliance-manager-scm-release-notes.aspx) +- [SCM baseline download help](https://social.technet.microsoft.com/wiki/contents/articles/1865.microsoft-security-compliance-manager-scm-baseline-download-help.aspx) **What file formats are supported by the new SCT?** @@ -45,41 +45,31 @@ No. A potential alternative is Desired State Configuration (DSC), a feature of t No. SCM supported only SCAP 1.0, which wasn't updated as SCAP evolved. The new toolkit likewise doesn't include SCAP support. -
- ## Version Matrix -**Client Versions** +**Client Versions**: | Name | Build | Baseline Release Date | Security Tools | -| ---- | ----- | --------------------- | -------------- | -| Windows 11 | [22H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-22h2-security-baseline/ba-p/3632520)
| September 2022
|[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -| Windows 10 | [22H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-10-version-22h2-security-baseline/ba-p/3655724)
[21H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-windows-10-version-21h2/ba-p/3042703)
[20H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-and-windows-server/ba-p/1999393)
[1809](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1809-and-windows-server/ba-p/701082)
[1607](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016)
[1507](/archive/blogs/secguide/security-baseline-for-windows-10-v1507-build-10240-th1-ltsb-update)| October 2022
December 2021
December 2020
October 2018
October 2016
January 2016 |[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -Windows 8.1 |[9600 (April Update)](/archive/blogs/secguide/security-baselines-for-windows-8-1-windows-server-2012-r2-and-internet-explorer-11-final)| October 2013| [SCM 4.0](/previous-versions/tn-archive/cc936627(v=technet.10)) | +|--|--|--|--| +| Windows 11 | [22H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-22h2-security-baseline/ba-p/3632520)
| September 2022
| [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Windows 10 | [22H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-10-version-22h2-security-baseline/ba-p/3655724)
[21H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-windows-10-version-21h2/ba-p/3042703)
[20H2](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-and-windows-server/ba-p/1999393)
[1809](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1809-and-windows-server/ba-p/701082)
[1607](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016)
[1507](/archive/blogs/secguide/security-baseline-for-windows-10-v1507-build-10240-th1-ltsb-update) | October 2022
December 2021
December 2020
October 2018
October 2016
January 2016 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -
+**Server Versions**: -**Server Versions** +| Name | Build | Baseline Release Date | Security Tools | +|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------|---------------------------------------------------------------------| +| Windows Server 2022 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-server-2022-security-baseline/ba-p/2724685) | September 2021 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Windows Server 2019 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1809-and-windows-server/ba-p/701082) | November 2018 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Windows Server 2016 | [SecGuide](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016) | October 2016 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Windows Server 2012 R2 | [SecGuide](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016) | August 2014 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -| Name | Build | Baseline Release Date | Security Tools | -|---|---|---|---| -|Windows Server 2022 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-server-2022-security-baseline/ba-p/2724685) |September 2021 |[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -|Windows Server 2019 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1809-and-windows-server/ba-p/701082) |November 2018 |[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -|Windows Server 2016 | [SecGuide](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016) |October 2016 |[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -|Windows Server 2012 R2|[SecGuide](/archive/blogs/secguide/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016)|August 2014 | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319)| +**Microsoft Products**: -
+| Name | Details | Security Tools | +|-------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------| +| Microsoft 365 Apps for enterprise, version 2206 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-365-apps-for-enterprise-v2206/ba-p/3502714) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Microsoft Edge, version 107 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v98/ba-p/3165443) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -**Microsoft Products** - - -| Name | Details | Security Tools | -|---------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------| -| Microsoft 365 Apps for enterprise, version 2206 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-365-apps-for-enterprise-v2206/ba-p/3502714) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -| Microsoft Edge, version 107 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v98/ba-p/3165443) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | - -
- -## See also +## Related articles [Windows security baselines](windows-security-baselines.md) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md index 6f7eef0ed1..66e75d737f 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -1,94 +1,85 @@ --- -title: Microsoft Security Compliance Toolkit 1.0 Guide -description: This article describes how to use Security Compliance Toolkit 1.0 in your organization +title: Microsoft Security Compliance Toolkit Guide +description: This article describes how to use Security Compliance Toolkit in your organization ms.prod: windows-client ms.localizationpriority: medium ms.author: vinpa author: vinaypamnani-msft manager: aaroncz -ms.collection: +ms.collection: - highpri - tier3 ms.topic: conceptual -ms.date: 02/14/2022 +ms.date: 06/07/2023 ms.reviewer: rmunck ms.technology: itpro-security --- -# Microsoft Security Compliance Toolkit 1.0 - How to use +# Microsoft Security Compliance Toolkit - How to use ## What is the Security Compliance Toolkit (SCT)? The Security Compliance Toolkit (SCT) is a set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products. The SCT enables administrators to effectively manage their enterprise's Group Policy Objects (GPOs). Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them broadly through Active Directory or individually through local policy. -

The Security Compliance Toolkit consists of: -- Windows 11 security baseline - - Windows 11, version 22H2 - - Windows 11, version 21H2 -- Windows 10 security baselines - - Windows 10, version 22H2 - - Windows 10, version 21H2 - - Windows 10, version 20H2 - - Windows 10, version 1809 - - Windows 10, version 1607 - - Windows 10, version 1507 - -- Windows Server security baselines - - Windows Server 2022 - - Windows Server 2019 - - Windows Server 2016 - - Windows Server 2012 R2 - -- Microsoft Office security baseline - - Office 2016 - - Microsoft 365 Apps for Enterprise Version 2206 - -- Microsoft Edge security baseline - - Edge version 114 - -- Tools - - Policy Analyzer - - Local Group Policy Object (LGPO) - - Set Object Security - - GPO to Policy Rules - +- Windows 11 security baseline + - Windows 11, version 22H2 + - Windows 11, version 21H2 +- Windows 10 security baselines + - Windows 10, version 22H2 + - Windows 10, version 21H2 + - Windows 10, version 20H2 + - Windows 10, version 1809 + - Windows 10, version 1607 + - Windows 10, version 1507 +- Windows Server security baselines + - Windows Server 2022 + - Windows Server 2019 + - Windows Server 2016 + - Windows Server 2012 R2 +- Microsoft Office security baseline + - Office 2016 + - Microsoft 365 Apps for Enterprise Version 2206 +- Microsoft Edge security baseline + - Edge version 114 +- Tools + - Policy Analyzer + - Local Group Policy Object (LGPO) + - Set Object Security + - GPO to Policy Rules You can [download the tools](https://www.microsoft.com/download/details.aspx?id=55319) along with the baselines for the relevant Windows versions. For more information about security baseline recommendations, see the [Microsoft Security Guidance blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines). ## What is the Policy Analyzer tool? The Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). Its main features include: -- Highlight when a set of Group Policies has redundant settings or internal inconsistencies -- Highlight the differences between versions or sets of Group Policies -- Compare GPOs against current local policy and local registry settings -- Export results to a Microsoft Excel spreadsheet -Policy Analyzer lets you treat a set of GPOs as a single unit. This treatment makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values. Policy Analyzer also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set. +- Highlight when a set of Group Policies has redundant settings or internal inconsistencies +- Highlight the differences between versions or sets of Group Policies +- Compare GPOs against current local policy and local registry settings +- Export results to a Microsoft Excel spreadsheet + +Policy Analyzer lets you treat a set of GPOs as a single unit. This treatment makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values. Policy Analyzer also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set. More information on the Policy Analyzer tool can be found on the [Microsoft Security Guidance blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). ## What is the Local Group Policy Object (LGPO) tool? -LGPO.exe is a command-line utility that is designed to help automate management of Local Group Policy. -Using local policy gives administrators a simple way to verify the effects of Group Policy settings, and is also useful for managing non-domain-joined systems. -LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files, security templates, Advanced Auditing backup files, and from formatted "LGPO text" files. -It can export local policy to a GPO backup. -It can export the contents of a Registry Policy file to the "LGPO text" format that can then be edited, and can build a Registry Policy file from an LGPO text file. +`LGPO.exe` is a command-line utility that is designed to help automate management of Local Group Policy. Using local policy gives administrators a simple way to verify the effects of Group Policy settings, and is also useful for managing non-domain-joined systems. `LGPO.exe` can import and apply settings from Registry Policy (Registry.pol) files, security templates, Advanced Auditing backup files, and from formatted "LGPO text" files. It can export local policy to a GPO backup. It can export the contents of a Registry Policy file to the "LGPO text" format that can then be edited, and can build a Registry Policy file from an LGPO text file. Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). ## What is the Set Object Security tool? -SetObjectSecurity.exe enables you to set the security descriptor for just about any type of Windows securable object, such as files, directories, registry keys, event logs, services, and SMB shares. For file system and registry objects, you can choose whether to apply inheritance rules. You can also choose to output the security descriptor in a .reg-file-compatible representation of the security descriptor for a REG_BINARY registry value. +`SetObjectSecurity.exe` enables you to set the security descriptor for just about any type of Windows securable object, such as files, directories, registry keys, event logs, services, and SMB shares. For file system and registry objects, you can choose whether to apply inheritance rules. You can also choose to output the security descriptor in a .reg file compatible representation of the security descriptor for a REG_BINARY registry value. Documentation for the Set Object Security tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). ## What is the GPO to Policy Rules tool? -Automate the conversion of GPO backups to Policy Analyzer .PolicyRules files and skip the GUI. GPO2PolicyRules is a command-line tool that is included with the Policy Analyzer download. +Automate the conversion of GPO backups to Policy Analyzer .PolicyRules files and skip the GUI. GPO2PolicyRules is a command-line tool that is included with the Policy Analyzer download. Documentation for the GPO to PolicyRules tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md index b4829615f9..ea73545214 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.author: vinpa author: vinaypamnani-msft manager: aaroncz -ms.collection: +ms.collection: - highpri - tier3 ms.topic: conceptual @@ -70,12 +70,7 @@ There are several ways to get and use security baselines: 3. MDM security baselines can easily be configured in Microsoft Intune on devices that run Windows 10 and Windows 11. For more information, see [List of the settings in the Windows 10/11 MDM security baseline in Intune](/mem/intune/protect/security-baseline-settings-mdm-all). -## Community - -[![Microsoft Security Guidance Blog.](./../images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) - - -## See also +## Related articles - [Microsoft Security Baselines Blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) - [Microsoft Security Compliance Toolkit](https://www.microsoft.com/download/details.aspx?id=55319) From ea99de589091bad0a8837b2c7dc76276a794748b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 11:25:16 -0400 Subject: [PATCH 15/30] Refresh applocker --- windows/security/docfx.json | 7 + ...ged-apps-to-existing-applocker-rule-set.md | 17 +-- .../applocker/administer-applocker.md | 17 +-- .../applocker-architecture-and-components.md | 17 +-- .../applocker/applocker-functions.md | 16 +-- .../applocker/applocker-overview.md | 128 +++++++----------- .../applocker-policies-deployment-guide.md | 15 +- .../applocker-policies-design-guide.md | 16 +-- .../applocker-policy-use-scenarios.md | 15 +- .../applocker-processes-and-interactions.md | 13 +- .../applocker/applocker-settings.md | 13 +- .../applocker-technical-reference.md | 17 +-- ...gure-an-applocker-policy-for-audit-only.md | 15 +- ...e-an-applocker-policy-for-enforce-rules.md | 15 +- ...figure-exceptions-for-an-applocker-rule.md | 15 +- ...onfigure-the-appLocker-reference-device.md | 19 +-- ...figure-the-application-identity-service.md | 15 +- .../create-a-rule-for-packaged-apps.md | 15 +- ...-a-rule-that-uses-a-file-hash-condition.md | 17 +-- ...reate-a-rule-that-uses-a-path-condition.md | 17 +-- ...-a-rule-that-uses-a-publisher-condition.md | 13 +- .../create-applocker-default-rules.md | 13 +- ...cations-deployed-to-each-business-group.md | 15 +- .../create-your-applocker-policies.md | 17 +-- .../applocker/create-your-applocker-rules.md | 15 +- .../applocker/delete-an-applocker-rule.md | 13 +- ...cies-by-using-the-enforce-rules-setting.md | 17 +-- ...oy-the-applocker-policy-into-production.md | 13 +- ...p-policy-structure-and-rule-enforcement.md | 15 +- ...igitally-signed-on-a-reference-computer.md | 15 +- ...ine-your-application-control-objectives.md | 17 +-- ...-users-try-to-run-a-blocked-application.md | 15 +- .../applocker/dll-rules-in-applocker.md | 13 +- ...tructure-and-applocker-rule-enforcement.md | 18 +-- .../document-your-application-list.md | 15 +- .../document-your-applocker-rules.md | 13 +- .../applocker/edit-an-applocker-policy.md | 29 ++-- .../applocker/edit-applocker-rules.md | 14 +- .../enable-the-dll-rule-collection.md | 15 +- .../applocker/enforce-applocker-rules.md | 18 +-- .../executable-rules-in-applocker.md | 13 +- .../export-an-applocker-policy-from-a-gpo.md | 15 +- ...port-an-applocker-policy-to-an-xml-file.md | 13 +- .../applocker/how-applocker-works-techref.md | 13 +- ...-applocker-policy-from-another-computer.md | 15 +- .../import-an-applocker-policy-into-a-gpo.md | 17 +-- .../applocker/maintain-applocker-policies.md | 18 +-- .../manage-packaged-apps-with-applocker.md | 29 ++-- ...r-policies-by-using-set-applockerpolicy.md | 15 +- .../merge-applocker-policies-manually.md | 13 +- ...onitor-application-usage-with-applocker.md | 17 +-- .../optimize-applocker-performance.md | 15 +- ...ckaged-app-installer-rules-in-applocker.md | 15 +- .../plan-for-applocker-policy-management.md | 18 +-- .../applocker/refresh-an-applocker-policy.md | 19 +-- ...ements-for-deploying-applocker-policies.md | 13 +- .../requirements-to-use-applocker.md | 37 ++--- ...the-automatically-generate-rules-wizard.md | 15 +- .../applocker/script-rules-in-applocker.md | 13 +- .../security-considerations-for-applocker.md | 19 +-- .../select-types-of-rules-to-create.md | 13 +- ...er-policy-by-using-test-applockerpolicy.md | 21 +-- .../test-and-update-an-applocker-policy.md | 17 +-- .../applocker/tools-to-use-with-applocker.md | 15 +- ...derstand-applocker-enforcement-settings.md | 13 +- ...stand-applocker-policy-design-decisions.md | 18 +-- ...ent-setting-inheritance-in-group-policy.md | 15 +- ...the-applocker-policy-deployment-process.md | 15 +- ...plocker-allow-and-deny-actions-on-rules.md | 15 +- .../understanding-applocker-default-rules.md | 13 +- .../understanding-applocker-rule-behavior.md | 17 +-- ...nderstanding-applocker-rule-collections.md | 16 +-- ...standing-applocker-rule-condition-types.md | 19 +-- ...understanding-applocker-rule-exceptions.md | 13 +- ...e-file-hash-rule-condition-in-applocker.md | 13 +- ...ng-the-path-rule-condition-in-applocker.md | 14 +- ...e-publisher-rule-condition-in-applocker.md | 17 +-- ...-create-and-maintain-applocker-policies.md | 23 +--- ...restriction-policies-in-the-same-domain.md | 20 +-- ...he-applocker-windows-powershell-cmdlets.md | 17 +-- .../using-event-viewer-with-applocker.md | 14 +- ...riction-policies-and-applocker-policies.md | 25 +--- .../applocker/what-is-applocker.md | 15 +- .../windows-installer-rules-in-applocker.md | 15 +- .../working-with-applocker-policies.md | 16 +-- .../applocker/working-with-applocker-rules.md | 25 +--- 86 files changed, 259 insertions(+), 1249 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index e079c36962..829d50a638 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -98,6 +98,13 @@ "operating-system-security/network-security/windows-firewall/*.yml": "nganguly" }, "appliesto": { + "threat-protection/windows-defender-application-control/applocker/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], "application-security/application-isolation/windows-sandbox/**/*.md": [ "✅ Windows 11", "✅ Windows 10" diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index 0400b53abf..0af1870a2a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -1,17 +1,12 @@ --- -title: Add rules for packaged apps to existing AppLocker rule-set +title: Add rules for packaged apps to existing AppLocker rule-set description: This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). -ms.assetid: 758c2a9f-c2a3-418c-83bc-fd335a94097f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Add rules for packaged apps to existing AppLocker rule-set -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,6 +21,4 @@ This topic for IT professionals describes how to update your existing AppLocker You can create packaged app rules for the computers running Windows Server 2012 or Windows 8 and later in your domain by updating your existing AppLocker rule set. All you need is a computer running at least Windows 8. Download and install the Remote Server Administration Toolkit (RSAT) from the Microsoft Download Center. -RSAT comes with the Group Policy Management Console that allows you to edit the GPO or GPOs where your existing AppLocker policy is authored. RSAT has the necessary files required to author packaged app rules. Packaged app rules will be ignored on computers running Windows 7 and earlier but will be enforced on those computers in your domain running at least Windows Server 2012 and Windows 8. -  -  +RSAT comes with the Group Policy Management Console that allows you to edit the GPO or GPOs where your existing AppLocker policy is authored. RSAT has the necessary files required to author packaged app rules. Packaged app rules will be ignored on computers running Windows 7 and earlier but will be enforced on those computers in your domain running at least Windows Server 2012 and Windows 8. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md index 3746acc1c8..6e41e6c5e2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md @@ -1,17 +1,12 @@ --- -title: Administer AppLocker +title: Administer AppLocker description: This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. -ms.assetid: 511a3b6a-175f-4d6d-a6e0-c1780c02e818 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 02/28/2019 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Administer AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -62,7 +51,7 @@ You can administer AppLocker policies by using the Group Policy Management Conso ### Administer AppLocker using Group Policy -You must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. Also, the Group Policy Management feature must be installed on the computer. +You must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. Also, the Group Policy Management feature must be installed on the computer. 1. Open the Group Policy Management Console (GPMC). 2. Locate the GPO that contains the AppLocker policy to modify, right-click the GPO, and then click **Edit**. @@ -76,4 +65,4 @@ You must have Edit Setting permission to edit a GPO. By default, members of the ## Using Windows PowerShell to administer AppLocker -For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](/powershell/module/applocker/). \ No newline at end of file +For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](/powershell/module/applocker/). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md index fee5823096..37127bd09f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md @@ -1,17 +1,12 @@ --- -title: AppLocker architecture and components +title: AppLocker architecture and components description: This topic for IT professional describes AppLocker’s basic architecture and its major components. -ms.assetid: efdd8494-553c-443f-bd5f-c8976535135a ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,16 +14,10 @@ ms.technology: itpro-security # AppLocker architecture and components -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). -This topic for IT professional describes AppLocker’s basic architecture and its major components. +This topic for IT professional describes AppLocker's basic architecture and its major components. AppLocker relies on the Application Identity service to provide attributes for a file and to evaluate the AppLocker policy for the file. AppLocker policies are conditional access control entries (ACEs), and policies are evaluated by using the attribute-based access control **SeAccessCheckWithSecurityAttributes** or **AuthzAccessCheck** functions. @@ -49,5 +38,3 @@ Before a script file is run, the script host (for example, for .ps1 files, the s ## Related topics - [AppLocker technical reference](applocker-technical-reference.md) -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md index dccdeafe16..52acbce003 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md @@ -1,17 +1,12 @@ --- -title: AppLocker functions +title: AppLocker functions description: This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. -ms.assetid: bf704198-9e74-4731-8c5a-ee0512df34d2 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker functions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This article for the IT professional lists the functions and security levels for ## Functions -Here are the SRP functions beginning with Windows Server 2003 and AppLocker functions beginning with Windows Server 2008 R2: +Here are the SRP functions beginning with Windows Server 2003 and AppLocker functions beginning with Windows Server 2008 R2: - [SaferGetPolicyInformation Function](/windows/win32/api/winsafer/nf-winsafer-safergetpolicyinformation) - [SaferCreateLevel Function](/windows/win32/api/winsafer/nf-winsafer-safercreatelevel) @@ -61,4 +50,3 @@ AppLocker and SRP use the security level IDs to specify the access requirements ## Related articles - [AppLocker technical reference](applocker-technical-reference.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 019f5a531b..c13e82db76 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -1,87 +1,63 @@ --- title: AppLocker -description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. +description: This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.author: vinpa -ms.prod: windows-client -ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.collection: - - highpri - - tier3 +- highpri +- tier3 ms.topic: conceptual +ms.localizationpriority: medium ms.date: 06/07/2023 -ms.technology: itpro-security --- # AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). -This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. +This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. > [!NOTE] > AppLocker is unable to control processes running under the system account on any operating system. AppLocker can help you: -- Define rules based on file attributes that persist across app updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash. -- Assign a rule to a security group or an individual user. -- Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries, except the Registry Editor (regedit.exe). -- Use audit-only mode to deploy the policy and understand its impact before enforcing it. -- Create rules on a staging server, test them, then export them to your production environment and import them into a Group Policy Object. -- Simplify creating and managing AppLocker rules by using Windows PowerShell. +- Define rules based on file attributes that persist across app updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash. +- Assign a rule to a security group or an individual user. +- Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries, except the Registry Editor (regedit.exe). +- Use audit-only mode to deploy the policy and understand its impact before enforcing it. +- Create rules on a staging server, test them, then export them to your production environment and import them into a Group Policy Object. +- Simplify creating and managing AppLocker rules by using Windows PowerShell. AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of Help Desk calls that result from users running unapproved apps. AppLocker addresses the following app security scenarios: -- **Application inventory** - - AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis. Windows PowerShell cmdlets also help you analyze this data programmatically. - -- **Protection against unwanted software** - - AppLocker has the ability to deny apps from running when you exclude them from the list of allowed apps. When AppLocker rules are enforced in the production environment, any apps that aren't included in the allowed rules are blocked from running. - -- **Licensing conformance** - - AppLocker can help you create rules that preclude unlicensed software from running and restrict licensed software to authorized users. - -- **Software standardization** - - AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This configuration permits a more uniform app deployment. - -- **Manageability improvement** - - AppLocker includes many improvements in manageability as compared to its predecessor Software Restriction Policies. Importing and exporting policies, automatic generation of rules from multiple files, audit-only mode deployment, and Windows PowerShell cmdlets are a few of the improvements over Software Restriction Policies. - +- **Application inventory**: AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis. Windows PowerShell cmdlets also help you analyze this data programmatically. +- **Protection against unwanted software**: AppLocker has the ability to deny apps from running when you exclude them from the list of allowed apps. When AppLocker rules are enforced in the production environment, any apps that aren't included in the allowed rules are blocked from running. +- **Licensing conformance**: AppLocker can help you create rules that preclude unlicensed software from running and restrict licensed software to authorized users. +- **Software standardization**: AppLocker policies can be configured to allow only supported or approved apps to run on computers within a business group. This configuration permits a more uniform app deployment. +- **Manageability improvement**: AppLocker includes many improvements in manageability as compared to its predecessor Software Restriction Policies. Importing and exporting policies, automatic generation of rules from multiple files, audit-only mode deployment, and Windows PowerShell cmdlets are a few of the improvements over Software Restriction Policies. ## When to use AppLocker -In many organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. Access control technologies, such as Active Directory Rights Management Services (AD RMS) and access control lists (ACLs), help control what users are allowed to access. +In many organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. Access control technologies, such as Active Directory Rights Management Services (AD RMS) and access control lists (ACLs), help control what users are allowed to access. -However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software. AppLocker can help mitigate these types of security breaches by restricting the files that users or groups are allowed to run. -Software publishers are beginning to create more apps that can be installed by non-administrative users. This privilege could jeopardize an organization's written security policy and circumvent traditional app control solutions that rely on the inability of users to install apps. AppLocker creates an allowed list of approved files and apps to help prevent such per-user apps from running. Because AppLocker can control DLLs, it's also useful to control who can install and run ActiveX controls. +However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software. AppLocker can help mitigate these types of security breaches by restricting the files that users or groups are allowed to run. Software publishers are beginning to create more apps that can be installed by non-administrative users. This privilege could jeopardize an organization's written security policy and circumvent traditional app control solutions that rely on the inability of users to install apps. AppLocker creates an allowed list of approved files and apps to help prevent such per-user apps from running. Because AppLocker can control DLLs, it's also useful to control who can install and run ActiveX controls. AppLocker is ideal for organizations that currently use Group Policy to manage their PCs. The following are examples of scenarios in which AppLocker can be used: -- Your organization's security policy dictates the use of only licensed software, so you need to prevent users from running unlicensed software and also restrict the use of licensed software to authorized users. -- An app is no longer supported by your organization, so you need to prevent it from being used by everyone. -- The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. -- The license to an app has been revoked or it's expired in your organization, so you need to prevent it from being used by everyone. -- A new app or a new version of an app is deployed, and you need to prevent users from running the old version. -- Specific software tools aren't allowed within the organization, or only specific users should have access to those tools. -- A single user or small group of users needs to use a specific app that is denied for all others. -- Some computers in your organization are shared by people who have different software usage needs, and you need to protect specific apps. -- In addition to other measures, you need to control the access to sensitive data through app usage. +- Your organization's security policy dictates the use of only licensed software, so you need to prevent users from running unlicensed software and also restrict the use of licensed software to authorized users. +- An app is no longer supported by your organization, so you need to prevent it from being used by everyone. +- The potential that unwanted software can be introduced in your environment is high, so you need to reduce this threat. +- The license to an app has been revoked or it's expired in your organization, so you need to prevent it from being used by everyone. +- A new app or a new version of an app is deployed, and you need to prevent users from running the old version. +- Specific software tools aren't allowed within the organization, or only specific users should have access to those tools. +- A single user or small group of users needs to use a specific app that is denied for all others. +- Some computers in your organization are shared by people who have different software usage needs, and you need to protect specific apps. +- In addition to other measures, you need to control the access to sensitive data through app usage. > [!NOTE] > AppLocker is a defense-in-depth security feature and not a [security boundary](https://www.microsoft.com/msrc/windows-security-servicing-criteria). [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview) should be used when the goal is to provide robust protection against a threat and there are expected to be no by-design limitations that would prevent the security feature from achieving this goal. @@ -93,7 +69,7 @@ AppLocker can help you protect the digital assets within your organization, redu AppLocker is included with enterprise-level editions of Windows. You can author AppLocker rules for a single computer or for a group of computers. For a single computer, you can author the rules by using the Local Security Policy editor (secpol.msc). For a group of computers, you can author the rules within a Group Policy Object by using the Group Policy Management Console (GPMC). > [!NOTE] -> The GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. +> GPMC is available in client computers running Windows only by installing the Remote Server Administration Tools. On computer running Windows Server, you must install the Group Policy Management feature. ### Using AppLocker on Server Core @@ -105,42 +81,38 @@ You can administer AppLocker policies by using a virtualized instance of Windows ### Security considerations -Application control policies specify which apps are allowed to run on the local computer. - -The variety of forms that malicious software can take make it difficult for users to know what is safe to run. When activated, malicious software can damage content on a hard disk drive, flood a network with requests to cause a denial-of-service (DoS) attack, send confidential information to the Internet, or compromise the security of a computer. +Application control policies specify which apps are allowed to run on the local computer. The variety of forms that malicious software can take make it difficult for users to know what is safe to run. When activated, malicious software can damage content on a hard disk drive, flood a network with requests to cause a denial-of-service (DoS) attack, send confidential information to the Internet, or compromise the security of a computer. The countermeasure is to create a sound design for your application control policies on PCs in your organization, and then thoroughly test the policies in a lab environment before you deploy them in a production environment. AppLocker can be part of your app control strategy because you can control what software is allowed to run on your computers. A flawed application control policy implementation can disable necessary applications or allow malicious or unintended software to run. Therefore, it's important that organizations dedicate sufficient resources to manage and troubleshoot the implementation of such policies. -For more information about specific security issues, see [Security considerations for AppLocker](security-considerations-for-applocker.md). +For more information about specific security issues, see [Security considerations for AppLocker](security-considerations-for-applocker.md). When you use AppLocker to create application control policies, you should be aware of the following security considerations: -When you use AppLocker to create application control policies, you should be aware of the following security considerations: - -- Who has the rights to set AppLocker policies? -- How do you validate that the policies are enforced? -- What events should you audit? +- Who has the rights to set AppLocker policies? +- How do you validate that the policies are enforced? +- What events should you audit? For reference in your security planning, the following table identifies the baseline settings for a PC with AppLocker installed: -| Setting | Default value | -| - | - | -| Accounts created | None | -| Authentication method | Not applicable | -| Management interfaces | AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell | -| Ports opened | None | +| Setting | Default value | +|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| +| Accounts created | None | +| Authentication method | Not applicable | +| Management interfaces | AppLocker can be managed by using a Microsoft Management Console snap-in, Group Policy Management, and Windows PowerShell | +| Ports opened | None | | Minimum privileges required | Administrator on the local computer; Domain Admin, or any set of rights that allow you to create, edit and distribute Group Policy Objects. | -| Protocols used | Not applicable | -| Scheduled Tasks | Appidpolicyconverter.exe is put in a scheduled task to be run on demand. | -| Security Policies | None required. AppLocker creates security policies. | -| System Services required |Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation. | -| Storage of credentials | None | +| Protocols used | Not applicable | +| Scheduled Tasks | Appidpolicyconverter.exe is put in a scheduled task to be run on demand. | +| Security Policies | None required. AppLocker creates security policies. | +| System Services required | Application Identity service (appidsvc) runs under LocalServiceAndNoImpersonation. | +| Storage of credentials | None | ## In this section -| Topic | Description | -| - | - | -| [Administer AppLocker](administer-applocker.md) | This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. | -| [AppLocker design guide](applocker-policies-design-guide.md) | This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. | -| [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. | -| [AppLocker technical reference](applocker-technical-reference.md) | This overview topic for IT professionals provides links to the topics in the technical reference. | +| Article | Description | +|----------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| +| [Administer AppLocker](administer-applocker.md) | This article for IT professionals provides links to specific procedures to use when administering AppLocker policies. | +| [AppLocker design guide](applocker-policies-design-guide.md) | This article for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. | +| [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This article for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. | +| [AppLocker technical reference](applocker-technical-reference.md) | This overview article for IT professionals provides links to the articles in the technical reference. | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md index a651d67814..2c37794578 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md @@ -1,31 +1,19 @@ --- -title: AppLocker deployment guide +title: AppLocker deployment guide description: This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. -ms.assetid: 38632795-be13-46b0-a7af-487a4340bea1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security --- - # AppLocker deployment guide -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -63,4 +51,3 @@ This guide provides steps based on your design and planning investigation for de | [Use Software Restriction Policies and AppLocker policies](using-software-restriction-policies-and-applocker-policies.md) | This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. | | [Create Your AppLocker policies](create-your-applocker-policies.md) | This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. | | [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) | This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. | - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md index 6aff5add05..0953e691f1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md @@ -1,17 +1,12 @@ --- -title: AppLocker design guide +title: AppLocker design guide description: This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. -ms.assetid: 1c8e4a7b-3164-4eb4-9277-11b1d5a09c7b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker design guide -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,6 +35,5 @@ To understand if AppLocker is the correct application control solution for your | [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) | This overview topic describes the process to follow when you're planning to deploy AppLocker rules. | | [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) | This topic describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. | -  + After careful design and detailed planning, the next step is to deploy AppLocker policies. [AppLocker Deployment Guide](applocker-policies-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md index 46d2994927..e4b467ac07 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md @@ -1,17 +1,12 @@ --- -title: AppLocker policy use scenarios +title: AppLocker policy use scenarios description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. -ms.assetid: 33f71578-89f0-4063-ac04-cf4f4ca5c31f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker policy use scenarios -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -71,5 +60,3 @@ The following are examples of scenarios in which AppLocker can be used: ## Related topics - [AppLocker technical reference](applocker-technical-reference.md) -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md index 82be229c35..f9b3d75543 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md @@ -1,17 +1,12 @@ --- -title: AppLocker processes and interactions +title: AppLocker processes and interactions description: This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. -ms.assetid: 0beec616-6040-4be7-8703-b6c919755d8e ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker processes and interactions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md index 4d62e1248b..2371faff67 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md @@ -1,17 +1,12 @@ --- -title: AppLocker settings +title: AppLocker settings description: This topic for the IT professional lists the settings used by AppLocker. -ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker settings -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md index 24739dbfcd..a4e2b5c421 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md @@ -1,17 +1,12 @@ --- -title: AppLocker technical reference +title: AppLocker technical reference description: This overview topic for IT professionals provides links to the topics in the technical reference. -ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # AppLocker technical reference -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -39,9 +28,9 @@ AppLocker advances the application control features and functionality of Softwar | [Requirements to use AppLocker](requirements-to-use-applocker.md) | This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. | | [AppLocker policy use scenarios](applocker-policy-use-scenarios.md) | This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. | | [How AppLocker works](how-applocker-works-techref.md) | This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. | -| [AppLocker architecture and components](applocker-architecture-and-components.md) | This topic for IT professional describes AppLocker’s basic architecture and its major components. | +| [AppLocker architecture and components](applocker-architecture-and-components.md) | This topic for IT professional describes AppLocker's basic architecture and its major components. | | [AppLocker processes and interactions](applocker-processes-and-interactions.md) | This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. | | [AppLocker functions](applocker-functions.md) | This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. | | [Security considerations for AppLocker](security-considerations-for-applocker.md) | This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. | | [Tools to Use with AppLocker](tools-to-use-with-applocker.md) | This topic for the IT professional describes the tools available to create and administer AppLocker policies. | -| [AppLocker Settings](applocker-settings.md) | This topic for the IT professional lists the settings used by AppLocker. | +| [AppLocker Settings](applocker-settings.md) | This topic for the IT professional lists the settings used by AppLocker. | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index db47a41ae0..762f500737 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -1,17 +1,12 @@ --- -title: Configure an AppLocker policy for audit only +title: Configure an AppLocker policy for audit only description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker. -ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 06/08/2018 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Configure an AppLocker policy for audit only -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -33,7 +22,7 @@ This topic for IT professionals describes how to set AppLocker policies to **Aud After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**. When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log. -  + You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). **To audit rule collections** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md index 0eaf785afa..5677e08745 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md @@ -1,17 +1,12 @@ --- -title: Configure an AppLocker policy for enforce rules +title: Configure an AppLocker policy for enforce rules description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. -ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,18 +14,12 @@ ms.technology: itpro-security # Configure an AppLocker policy for enforce rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. ->**Note:**  When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. +>**Note:** When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. For info about how AppLocker policies are applied within a GPO structure, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md index 2f81ecf9ea..d7fb5a0851 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md @@ -1,17 +1,12 @@ --- -title: Add exceptions for an AppLocker rule +title: Add exceptions for an AppLocker rule description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. -ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Add exceptions for an AppLocker rule -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -45,5 +34,3 @@ You can perform this task by using the Group Policy Management Console for an Ap - For a path exception, choose the file or folder path to exclude, and then click **OK**. - For a file hash exception, edit the file hash rule, and click **Remove**. - For a packaged apps exception, click **Add** to create the exceptions based on reference app and rule scope. -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md index a9229d7b60..ad878e7040 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md @@ -1,17 +1,12 @@ --- -title: Configure the AppLocker reference device +title: Configure the AppLocker reference device description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. -ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Configure the AppLocker reference device -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -39,13 +28,13 @@ An AppLocker reference device that is used for the development and deployment of The reference device doesn't need to be joined to a domain, but it must be able to import and export AppLocker policies in XML format. The reference computer must be running one of the supported editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). ->**Warning:**  Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. +>**Warning:** Do not use operating system snapshots when creating AppLocker rules. If you take a snapshot of the operating system, install an app, create AppLocker rules, and then revert to a clean snapshot and repeat the process for another app, there is a chance that duplicate rule GUIDs can be created. If duplicate GUIDs are present, AppLocker policies will not work as expected. **To configure a reference device** 1. If the operating system isn't already installed, install one of the supported editions of Windows on the device. - >**Note:**  If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device + >**Note:** If you have the Group Policy Management Console (GPMC) installed on another device to test your implementation of AppLocker policies, you can export the policies to that device 2. Configure the administrator account. @@ -59,5 +48,3 @@ The reference device doesn't need to be joined to a domain, but it must be able - After you configure the reference computer, you can create the AppLocker rule collections. You can build, import, or automatically generate the rules. For procedures to do this task, see [Working with AppLocker rules](working-with-applocker-rules.md). - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md index 7b55776a9f..b9261a395b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md @@ -1,17 +1,12 @@ --- -title: Configure the Application Identity service +title: Configure the Application Identity service description: This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. -ms.assetid: dc469599-37fd-448b-b23e-5b8e4f17e561 ms.reviewer: ms.author: vinpa -ms.pagetype: security ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 07/01/2021 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Configure the Application Identity service -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals shows how to configure the Application Identity The Application Identity service determines and verifies the identity of an app. Stopping this service will prevent AppLocker policies from being enforced. ->**Important:**  When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. +>**Important:** When using Group Policy, you must configure it to start automatically in at least one Group Policy Object (GPO) that applies AppLocker rules. This is because AppLocker uses this service to verify the attributes of a file. **To start the Application Identity service automatically using Group Policy** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md index bda3579c22..357689283c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md @@ -1,17 +1,12 @@ --- -title: Create a rule for packaged apps +title: Create a rule for packaged apps description: This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. -ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule for packaged apps -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -63,7 +52,7 @@ You can perform this task by using the Group Policy Management Console for an Ap |Applies to a specific **Publisher** | This setting scopes the rule to all apps published by a particular publisher. | You want to allow all your users to install apps published by the publisher of Microsoft.BingMaps. You could select Microsoft.BingMaps as a reference and choose this rule scope. | |Applies to a **Package name** | This setting scopes the rule to all packages that share the publisher name and package name as the reference file. | You want to allow your Sales group to install any version of the Microsoft.BingMaps app. You could select the Microsoft.BingMaps app as a reference and choose this rule scope. | |Applies to a **Package version** | This setting scopes the rule to a particular version of the package. | You want to be selective in what you allow. You don't want to implicitly trust all future updates of the Microsoft.BingMaps app. You can limit the scope of your rule to the version of the app currently installed on your reference computer. | - |Applying custom values to the rule | Selecting the **Use custom values** check box allows you to adjust the scope fields for your particular circumstance. | You want to allow users to install all *Microsoft.Bing* applications, which include Microsoft.BingMaps, Microsoft.BingWeather, Microsoft.BingMoney. You can choose the Microsoft.BingMaps as a reference, select the **Use custom values** check box and edit the package name field by adding “Microsoft.Bing*” as the Package name. | + |Applying custom values to the rule | Selecting the **Use custom values** check box allows you to adjust the scope fields for your particular circumstance. | You want to allow users to install all *Microsoft.Bing* applications, which include Microsoft.BingMaps, Microsoft.BingWeather, Microsoft.BingMoney. You can choose the Microsoft.BingMaps as a reference, select the **Use custom values** check box and edit the package name field by adding "Microsoft.Bing*" as the Package name. | 6. Select **Next**. 7. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. These conditions allow you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md index f03d446082..592e0d0250 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md @@ -1,17 +1,12 @@ --- -title: Create a rule that uses a file hash condition +title: Create a rule that uses a file hash condition description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. -ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule that uses a file hash condition -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,7 +35,7 @@ AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins 5. On the **Conditions** page, select the **File hash** rule condition, and then click **Next**. 6. **Browse Files** to locate the targeted application file. - >**Note:**  You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. -   + >**Note:** You can also click **Browse Folders** which calculates the hash for all the appropriate files relative to the rule collection. To remove hashes individually, click the **Remove** button. + 7. Click **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then click **Create**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md index c79af9cb24..019d399434 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md @@ -1,17 +1,12 @@ --- -title: Create a rule that uses a path condition +title: Create a rule that uses a path condition description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. -ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule that uses a path condition -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals shows how to create an AppLocker rule with a pat The path condition identifies an app by its location in the file system of the computer or on the network. ->**Important:**  When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. +>**Important:** When creating a rule that uses a deny action, path conditions are less secure for preventing access to a file because a user could easily copy the file to a different location than what is specified in the rule. Because path rules correspond to locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file within C:\\ will be allowed to run, including users' profiles. For info about the path condition, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). @@ -47,7 +36,7 @@ You can perform this task by using the Group Policy Management Console for an Ap 5. On the **Conditions** page, select the **Path** rule condition, and then click **Next**. 6. Click **Browse Files** to locate the targeted folder for the app. - >**Note:**  When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). + >**Note:** When you browse to a file or folder location, the wizard automatically converts absolute file paths to use AppLocker path variables. You may edit the path after browsing to specify an absolute path, or you may type the path directly into the **Path** box. To learn more about AppLocker path variables, see [Understanding the path rule condition in AppLocker](understanding-the-path-rule-condition-in-applocker.md). 7. Click **Next**. 8. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. Click **Next**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md index 66440056c3..b7973d180c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md @@ -1,17 +1,12 @@ --- -title: Create a rule that uses a publisher condition +title: Create a rule that uses a publisher condition description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. -ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a rule that uses a publisher condition -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md index d9ad04fc74..a9b4962478 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md @@ -1,17 +1,12 @@ --- -title: Create AppLocker default rules +title: Create AppLocker default rules description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. -ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create AppLocker default rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md index 014f1edcd3..1811f0ba24 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md @@ -1,17 +1,12 @@ --- -title: Create a list of apps deployed to each business group +title: Create a list of apps deployed to each business group description: This topic describes the process of gathering app usage requirements from each business group to implement application control policies by using AppLocker. -ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create a list of apps deployed to each business group -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -81,5 +70,3 @@ For guidance, see the following topics: - [Select the types of rules to create](select-types-of-rules-to-create.md) - [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md index d632badeea..5de5930086 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Create Your AppLocker policies +title: Create Your AppLocker policies description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. -ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create Your AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -44,7 +33,6 @@ You can develop an application control policy plan to guide you in making succes 6. [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) 7. [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - ## Step 2: Create your rules and rule collections Each rule applies to one or more apps, and it imposes a specific rule condition on them. Rules can be created individually or they can be generated by the Automatically Generate Rules Wizard. For the steps to create the rules, see [Create Your AppLocker rules](create-your-applocker-rules.md). @@ -64,7 +52,7 @@ In a test environment or with the enforcement setting set at **Audit only**, ver ## Step 6: Implement the policy -Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value—**Enforce rules** or **Audit only**. +Depending on your deployment method, import the AppLocker policy to the GPO in your production environment, or if the policy is already deployed, change the enforcement setting to your production environment value-**Enforce rules** or **Audit only**. ## Step 7: Test the effect of the policy and adjust Validate the effect of the policy by analyzing the AppLocker logs for application usage, and then modify the policy as necessary. For information on how to do these tasks, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). @@ -80,4 +68,3 @@ Follow the steps described in the following topics to continue the deployment pr ## See also - [AppLocker deployment guide](applocker-policies-deployment-guide.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md index 7f416d3255..5e05fb2c6e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Create Your AppLocker rules +title: Create Your AppLocker rules description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. -ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Create Your AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -48,7 +37,7 @@ You can use a reference device to automatically create a set of default rules fo You can create rules and set the mode to **Audit only** for each installed app, test and update each rule as necessary, and then deploy the policies. Creating rules individually might be best when you're targeting a few applications within a business group. ->**Note:**  AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). +>**Note:** AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You can also edit the default rules. For information about creating the default rules for the Windows operating system, see [Create AppLocker default rules](create-applocker-default-rules.md). For information about performing this task, see: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md index 88f67e4728..e639e46f0b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md @@ -1,17 +1,12 @@ --- -title: Delete an AppLocker rule +title: Delete an AppLocker rule description: This article for IT professionals describes the steps to delete an AppLocker rule. -ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 03/10/2023 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Delete an AppLocker rule -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index 21b28d7b69..b01a4cb864 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -1,17 +1,12 @@ --- -title: Deploy AppLocker policies by using the enforce rules setting +title: Deploy AppLocker policies by using the enforce rules setting description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. -ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Deploy AppLocker policies by using the enforce rules setting -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -51,7 +40,7 @@ Rule enforcement is applied only to a collection of rules, not to individual rul You can edit an AppLocker policy by adding, changing, or removing rules. However, you can't specify a version for the AppLocker policy by importing more rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. An example of this type of software is the [Advanced Group Policy Management](https://go.microsoft.com/fwlink/p/?LinkId=145013) feature from the Microsoft Desktop Optimization Pack. ->**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. +>**Caution:** You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. For the procedure to update the GPO, see [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). @@ -64,5 +53,3 @@ When a policy is deployed, it's important to monitor the actual implementation o ## Other resources - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md index ae2ca63f83..bd454cbc25 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md @@ -1,17 +1,12 @@ --- -title: Deploy the AppLocker policy into production +title: Deploy the AppLocker policy into production description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. -ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Deploy the AppLocker policy into production -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md index 21bcfc2b31..75cb76fbb6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md @@ -1,17 +1,12 @@ --- -title: Determine the Group Policy structure and rule enforcement +title: Determine the Group Policy structure and rule enforcement description: This overview topic describes the process to follow when you're planning to deploy AppLocker rules. -ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Determine the Group Policy structure and rule enforcement -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -45,4 +34,4 @@ When you're determining how many Group Policy Objects (GPOs) to create when you - GPO naming conventions - GPO size limits ->**Note:**  There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. +>**Note:** There is no default limit on the number of AppLocker rules that you can create. However, in Windows Server 2008 R2, GPOs have a 2 MB size limit for performance. In subsequent versions, that limit is raised to 100 MB. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index 8308562822..aae68e89c5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -1,17 +1,12 @@ --- -title: Find digitally signed apps on a reference device +title: Find digitally signed apps on a reference device description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. -ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Determine which apps are digitally signed on a reference device -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,5 +35,3 @@ For command parameters, syntax, and examples, see [Get-AppLockerFileInformation] ## Related topics - [Use a reference device to create and maintain AppLocker policies](use-a-reference-computer-to-create-and-maintain-applocker-policies.md) -  -  \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index 84e059c69f..bd8cd14419 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -1,17 +1,12 @@ --- -title: Determine your application control objectives +title: Determine your application control objectives description: Determine which applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. -ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Determine your application control objectives -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -42,7 +31,7 @@ Use the following table to develop your own objectives and determine which appli |Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

AppLocker permits customization of error messages to direct users to a Web page for help.| |Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in, if the policies are created locally, or the GPMC, or the Windows PowerShell AppLocker cmdlets.| |Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| -|Enforcement mode|SRP works in the “blocklist mode” where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the files are allowed to run by default.

SRP can also be configured in the “allowlist mode” such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.|By default, AppLocker works in allowlist mode. Only those files are allowed to run for which there's a matching allow rule.| +|Enforcement mode|SRP works in the "blocklist mode" where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the files are allowed to run by default.

SRP can also be configured in the "allowlist mode" such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.|By default, AppLocker works in allowlist mode. Only those files are allowed to run for which there's a matching allow rule.| |File types that can be controlled|SRP can control the following file types:
  • Executables
  • DLLs
  • Scripts
  • Windows Installers

    SRP can't control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
  • Executables
  • DLLs
  • Scripts
  • Windows Installers
  • Packaged apps and installers

    AppLocker maintains a separate rule collection for each of the five file types.| |Designated file types|SRP supports an extensible list of file types that are considered executable. You can add extensions for files that should be considered executable.|AppLocker doesn't support this addition of extension. AppLocker currently supports the following file extensions:
  • Executables (.exe, .com)
  • DLLs (.ocx, .dll)
  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
  • Windows Installers (.msi, .mst, .msp)
  • Packaged app installers (.appx)| |Rule types|SRP supports four types of rules:
  • Hash
  • Path
  • Signature

    Internet zone|AppLocker supports three types of rules:
  • Hash
  • Path
  • Publisher| @@ -50,7 +39,7 @@ Use the following table to develop your own objectives and determine which appli |Support for different security levels|With SRP, you can specify the permissions with which an app can run. Then configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker doesn't support security levels.| |Manage Packaged apps and Packaged app installers.|Unable|.appx is a valid file type which AppLocker can manage.| |Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| -|Support for rule exceptions|SRP doesn't support rule exceptions|AppLocker rules can have exceptions that allow administrators to create rules such as “Allow everything from Windows except for Regedit.exe”.| +|Support for rule exceptions|SRP doesn't support rule exceptions|AppLocker rules can have exceptions that allow administrators to create rules such as "Allow everything from Windows except for Regedit.exe".| |Support for audit mode|SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode that allows administrators to test the effect of their policy in the real production environment without impacting the user experience. Once you're satisfied with the results, you can start enforcing the policy.| |Support for exporting and importing policies|SRP doesn't support policy import/export.|AppLocker supports the importing and exporting of policies. This support by AppLocker allows you to create AppLocker policy on a sample computer, test it out and then export that policy and import it back into the desired GPO.| |Rule enforcement|Internally, SRP rules enforcement happens in user-mode, which is less secure.|Internally, AppLocker rules for exes and dlls are enforced in kernel-mode, which is more secure than enforcing them in the user-mode.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index a06323374d..050d675248 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -1,17 +1,12 @@ --- -title: Display a custom URL message when users try to run a blocked app +title: Display a custom URL message when users try to run a blocked app description: This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. -ms.assetid: 9a2534a5-d1fa-48a9-93c6-989d4857cf85 ms.reviewer: ms.author: vinpa -ms.pagetype: security ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Display a custom URL message when users try to run a blocked app -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals describes the steps for displaying a customized With the help of Group Policy, AppLocker can be configured to display a message with a custom URL. You can use this URL to redirect users to a support site that contains info about why the user received the error and which apps are allowed. If you don't display a custom message when an app is blocked, the default access denied message is displayed. -To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **To display a custom URL message when users try to run a blocked app** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md index 46473d9aea..641ee98a64 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: DLL rules in AppLocker +title: DLL rules in AppLocker description: This topic describes the file formats and available default rules for the DLL rule collection. -ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # DLL rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md index 23268ed540..a99df09d89 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -1,30 +1,19 @@ --- -title: Document Group Policy structure & AppLocker rule enforcement +title: Document Group Policy structure & AppLocker rule enforcement description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. -ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual -ms.pagetype: security ms.date: 09/21/2017 ms.technology: itpro-security --- # Document the Group Policy structure and AppLocker rule enforcement -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -49,13 +38,10 @@ The following table includes the sample data that was collected when you determi ||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow|| |Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR-AppLockerHRRules| ||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File isn't signed; create a file hash condition|Allow|| -||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny|| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny|| ||||Windows files|C:\Windows|Use a default rule for the Windows path|Allow|| ## Next steps After you've determined the Group Policy structure and rule enforcement strategy for each business group's apps, the following tasks remain: - [Plan for AppLocker policy management](plan-for-applocker-policy-management.md) - - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md index 9748146d20..1e1cb3e944 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md @@ -1,17 +1,12 @@ --- -title: Document your app list +title: Document your app list description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. -ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Document your app list -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -48,7 +37,7 @@ The following table provides an example of how to list applications for each bus ||||Windows files|C:\Windows| |Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe| ||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe| -||||Internet Explorer 7|C:\Program Files\Internet Explorer

    | +||||Internet Explorer 7|C:\Program Files\Internet Explorer

    | ||||Windows files|C:\Windows| >[!NOTE] diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index e5f75fa28f..f2803a91f2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Document your AppLocker rules +title: Document your AppLocker rules description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation. -ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Document your AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md index b336d09cf5..0ebddf77d5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md @@ -1,17 +1,12 @@ --- -title: Edit an AppLocker policy +title: Edit an AppLocker policy description: This topic for IT professionals describes the steps required to modify an AppLocker policy. -ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Edit an AppLocker policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -55,8 +44,8 @@ AppLocker provides a feature to export and import AppLocker policies as an XML f After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For information on the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). ->**Caution:**  Importing a policy onto another PC will overwrite the existing policy on that PC. -  +>**Caution:** Importing a policy onto another PC will overwrite the existing policy on that PC. + ### Step 3: Use AppLocker to modify and test the rule AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. @@ -77,10 +66,10 @@ AppLocker provides ways to modify, delete, or add rules to a policy by modifying For procedures to export the updated policy from the reference computer back into the GPO, see [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) and [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md). ->**Caution:**  You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). -  ->**Note:**  If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy. -  +>**Caution:** You should never edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed run, making changes to a live policy can create unexpected behavior. For info about testing policies, see [Test and update an AppLocker policy](test-and-update-an-applocker-policy.md). + +>**Note:** If you are performing these steps by using Microsoft Advanced Group Policy Management (AGPM), check out the GPO before exporting the policy. + ## Editing an AppLocker policy by using the Local Security Policy snap-in The steps to edit an AppLocker policy distributed by using the Local Security Policy snap-in (secpol.msc) include the following tasks. @@ -91,8 +80,8 @@ On the PC where you maintain policies, open the AppLocker snap-in from the Local After exporting the AppLocker policy to an XML file, you should import the XML file onto a reference PC so that you can edit the policy. For information on the procedure to import an AppLocker policy, see [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md). ->**Caution:**  Importing a policy onto another PC will overwrite the existing policy on that PC. -  +>**Caution:** Importing a policy onto another PC will overwrite the existing policy on that PC. + ### Step 2: Identify and modify the rule to change, delete, or add AppLocker provides ways to modify, delete, or add rules to a policy by modifying the rules within the collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md index 46acb129b9..5c05fb3560 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Edit AppLocker rules +title: Edit AppLocker rules description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. -ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Edit AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -67,4 +56,3 @@ You can perform this task by using the Group Policy Management Console for an Ap - Click the **Path** tab to configure the path on the computer in which the rule should be enforced. - Click the **Exceptions** tab to create exceptions for specific files in a folder. - When you finish updating the rule, click **OK**. - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md index e38beaacec..a97f271c3d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md @@ -1,17 +1,12 @@ --- -title: Enable the DLL rule collection +title: Enable the DLL rule collection description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. -ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Enable the DLL rule collection -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -41,4 +30,4 @@ AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins 1. From the AppLocker console, right-click **AppLocker**, and then click **Properties.** 2. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. + >**Important:** Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md index 70a2dfe070..947a69a2ad 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md @@ -1,17 +1,12 @@ --- -title: Enforce AppLocker rules +title: Enforce AppLocker rules description: This topic for IT professionals describes how to enforce application control rules by using AppLocker. -ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Enforce AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -38,7 +27,4 @@ There is no audit mode for the DLL rule collection. DLL rules affect specific ap To enforce AppLocker rules by configuring an AppLocker policy to **Enforce rules**, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). ->**Caution:**  AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). -  -  -  +>**Caution:** AppLocker rules will be enforced immediately on the local device or when the Group Policy object (GPO) is updated by performing this procedure. If you want to see the effect of applying an AppLocker policy before setting the enforcement setting to **Enforce rules**, configure the policy to **Audit only**. For info about how to do this, see [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md)or [Test an AppLocker policy by Using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md index 1d3fbf552a..461262fab4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Executable rules in AppLocker +title: Executable rules in AppLocker description: This topic describes the file formats and available default rules for the executable rule collection. -ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Executable rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md index 7b838b91ae..bde1c865ad 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md @@ -1,17 +1,12 @@ --- -title: Export an AppLocker policy from a GPO +title: Export an AppLocker policy from a GPO description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. -ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Export an AppLocker policy from a GPO -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,7 +21,7 @@ This topic for IT professionals describes the steps to export an AppLocker polic Updating an AppLocker policy that is currently enforced in your production environment can have unintended results. Therefore, export the policy from the GPO and update the rule or rules by using AppLocker on your AppLocker reference device. -To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **Export the policy from the GPO** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md index 2dc105b517..93e466a216 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md @@ -1,17 +1,12 @@ --- -title: Export an AppLocker policy to an XML file +title: Export an AppLocker policy to an XML file description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. -ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Export an AppLocker policy to an XML file -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md index 40f88e9b91..e4168feaaa 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md @@ -1,17 +1,12 @@ --- -title: How AppLocker works +title: How AppLocker works description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. -ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # How AppLocker works -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md index 4ce5fe6eb6..c9eee9963c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md @@ -1,17 +1,12 @@ --- -title: Import an AppLocker policy from another computer +title: Import an AppLocker policy from another computer description: This topic for IT professionals describes how to import an AppLocker policy. -ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.technology: itpro-security ms.date: 12/31/2017 @@ -19,12 +14,6 @@ ms.date: 12/31/2017 # Import an AppLocker policy from another computer -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2012 R2 and later - > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -34,7 +23,7 @@ Before completing this procedure, you should have exported an AppLocker policy. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. -> **Caution:**  Importing a policy will overwrite the existing policy on that computer. +> **Caution:** Importing a policy will overwrite the existing policy on that computer. **To import an AppLocker policy** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md index 71fb649374..aa4be6cdf0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md @@ -1,17 +1,12 @@ --- -title: Import an AppLocker policy into a GPO +title: Import an AppLocker policy into a GPO description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). -ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,21 +14,15 @@ ms.technology: itpro-security # Import an AppLocker policy into a GPO -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). ->**Important:**  Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md). +>**Important:** Follow your organization's standard procedures for updating GPOs. For info about specific steps to follow for AppLocker policies, see [Maintain AppLocker policies](maintain-applocker-policies.md). -To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have the **Edit Setting** permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **To import an AppLocker policy into a GPO** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md index 551719338a..e9d52b57ce 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Maintain AppLocker policies +title: Maintain AppLocker policies description: Learn how to maintain rules within AppLocker policies. View common AppLocker maintenance scenarios and see the methods to use to maintain AppLocker policies. -ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.technology: itpro-security ms.date: 12/31/2017 @@ -19,12 +14,6 @@ ms.date: 12/31/2017 # Maintain AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -50,7 +39,6 @@ Using the AppLocker configuration service provider, you can select which apps ar For more information, see the [AppLocker CSP](/windows/client-management/mdm/applocker-csp). - ## Maintaining AppLocker policies by using Group Policy For every scenario, the steps to maintain an AppLocker policy distributed by Group Policy include the following tasks. @@ -60,7 +48,7 @@ As new apps are deployed or existing apps are removed by your organization or up You can edit an AppLocker policy by adding, changing, or removing rules. However, you can't specify a version for the AppLocker policy by importing more rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of GPOs. ->**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. +>**Caution:** You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. ### Step 1: Understand the current behavior of the policy @@ -119,4 +107,4 @@ After deploying a policy, evaluate the policy's effectiveness. ## Other resources -- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). \ No newline at end of file +- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md index 1f192ee5b6..d04546c8ee 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Manage packaged apps with AppLocker +title: Manage packaged apps with AppLocker description: Learn concepts and lists procedures to help you manage packaged apps with AppLocker as part of your overall application control strategy. -ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Manage packaged apps with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -38,16 +27,16 @@ With packaged apps, it's possible to control the entire app by using a single Ap > [!NOTE] > AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps. -Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software’s publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. +Typically, an app consists of multiple components: the installer that is used to install the app, and one or more exes, dlls, or scripts. With classic Windows apps, not all these components always share common attributes such as the software's publisher name, product name, and product version. Therefore, AppLocker controls each of these components separately through different rule collections, such as exe, dll, script, and Windows Installer rules. In contrast, all the components of a packaged app share the same publisher name, package name, and package version attributes. Therefore, you can control an entire app with a single rule. ### Comparing classic Windows apps and packaged apps -AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server -2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: +AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server +2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include: -- **Installing the apps**   All packaged apps can be installed by a standard user, whereas many classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps. -- **Changing the system state**   Classic Windows apps can be written to change the system state if they're run with administrative privileges. Most packaged apps can't change the system state because they run with limited privileges. When you design your AppLocker policies, it's important to understand whether an app that you're allowing can make system-wide changes. -- **Acquiring the apps**   Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means. +- **Installing the apps** All packaged apps can be installed by a standard user, whereas many classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps. +- **Changing the system state** Classic Windows apps can be written to change the system state if they're run with administrative privileges. Most packaged apps can't change the system state because they run with limited privileges. When you design your AppLocker policies, it's important to understand whether an app that you're allowing can make system-wide changes. +- **Acquiring the apps** Packaged apps can be acquired through the Store, or by loading using Windows PowerShell cmdlets (which requires a special enterprise license). Classic Windows apps can be acquired through traditional means. AppLocker uses different rule collections to control packaged apps and classic Windows apps. You have the choice to control one type, the other type, or both. @@ -60,7 +49,7 @@ For more info about packaged apps, see [Packaged apps and packaged app installer You can use two methods to create an inventory of packaged apps on a computer: the AppLocker console or the **Get-AppxPackage** Windows PowerShell cmdlet. > [!NOTE] -> Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). +> Not all packaged apps are listed in AppLocker's application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md). For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](/powershell/module/applocker/). @@ -85,4 +74,4 @@ Just as there are differences in managing each rule collection, you need to mana 3. Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this update, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md). -4. Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this monitoring, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). \ No newline at end of file +4. Continue to monitor your environment to verify the effectiveness of the rules that are deployed in AppLocker policies. To do this monitoring, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md index f800cda2fe..f9ff7dc54d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -1,17 +1,12 @@ --- -title: Merge AppLocker policies by using Set-ApplockerPolicy +title: Merge AppLocker policies by using Set-ApplockerPolicy description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. -ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Merge AppLocker policies by using Set-ApplockerPolicy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -48,4 +37,4 @@ Gets the local AppLocker policy, and then merges the policy with the existing Ap ```powershell C:\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP://DC13.Contoso.com/CN={31B2F340-016D-11D2-945F-00C044FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Merge -``` \ No newline at end of file +``` diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md index 07851d0989..41657a25bd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md @@ -1,17 +1,12 @@ --- -title: Merge AppLocker policies manually +title: Merge AppLocker policies manually description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). -ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Merge AppLocker policies manually -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md index c0e644de33..32c0267869 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Monitor app usage with AppLocker +title: Monitor app usage with AppLocker description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. -ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Monitor app usage with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -75,13 +64,13 @@ Membership in the local **Administrators** group, or equivalent, is the minimum 2. Run the following command to review how many times a file would have been blocked from running if rules were enforced: ```powershell - Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics + Get-AppLockerFileInformation -EventLog -EventType Audited -Statistics ``` 3. Run the following command to review how many times a file has been allowed to run or prevented from running: ```powershell - Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics + Get-AppLockerFileInformation -EventLog -EventType Allowed -Statistics ``` ### View the AppLocker Log in Event Viewer diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md index cca5552fbb..ef107acf59 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md @@ -1,17 +1,12 @@ --- -title: Optimize AppLocker performance +title: Optimize AppLocker performance description: This topic for IT professionals describes how to optimize AppLocker policy enforcement. -ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Optimize AppLocker performance -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -43,4 +32,4 @@ condition. ### Using the DLL rule collection -When the DLL rule collection is enabled, AppLocker must check each DLL that an application loads. The more DLLs, the longer AppLocker requires to complete the evaluation. \ No newline at end of file +When the DLL rule collection is enabled, AppLocker must check each DLL that an application loads. The more DLLs, the longer AppLocker requires to complete the evaluation. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index 3c367e9dad..48e94f6635 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Packaged apps and packaged app installer rules in AppLocker +title: Packaged apps and packaged app installer rules in AppLocker description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps. -ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 10/13/2017 ms.technology: itpro-security @@ -19,19 +14,13 @@ ms.technology: itpro-security # Packaged apps and packaged app installer rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the AppLocker rule collection for packaged app installers and packaged apps. Universal Windows apps can be installed through the Microsoft Store or can be sideloaded using the Windows PowerShell cmdlets. Universal Windows apps can be installed by a standard user unlike some Classic Windows applications that sometimes require administrative privileges for installation. -Typically, an app consists of multiple components – the installer used to install the app and one or more exes, dlls or scripts. With Classic Windows applications, not all those components always share common attributes such as the publisher name, product name and product version. Therefore, AppLocker has to control each of these components separately through different rule collections – exe, dll, script and Windows Installers. In contrast, all the components of a Universal Windows app share the same attributes: Publisher name, Package name and Package version. It's therefore possible to control an entire app with a single rule. +Typically, an app consists of multiple components - the installer used to install the app and one or more exes, dlls or scripts. With Classic Windows applications, not all those components always share common attributes such as the publisher name, product name and product version. Therefore, AppLocker has to control each of these components separately through different rule collections - exe, dll, script and Windows Installers. In contrast, all the components of a Universal Windows app share the same attributes: Publisher name, Package name and Package version. It's therefore possible to control an entire app with a single rule. AppLocker enforces rules for Universal Windows apps separately from Classic Windows applications. A single AppLocker rule for a Universal Windows app can control both the installation and the running of an app. Because all Universal Windows apps are signed, AppLocker supports only publisher rules for Universal Windows apps. A publisher rule for a Universal Windows app is based on the following attributes of the app: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index 8384c7debf..f2e8463f25 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -1,17 +1,12 @@ --- -title: Plan for AppLocker policy management +title: Plan for AppLocker policy management description: This topic describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. -ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Plan for AppLocker policy management -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -91,7 +80,7 @@ You can edit an AppLocker policy by adding, changing, or removing rules. However **New version of a supported app** -When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you're using publisher conditions and the version isn't specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app hasn't altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied. +When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you're using publisher conditions and the version isn't specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app hasn't altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version-the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied. To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version. @@ -149,7 +138,7 @@ The following table contains the added sample data that was collected when deter ||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow||Help desk| |Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR-AppLockerHRRules|Web help| ||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File isn't signed; create a file hash condition|Allow||Web help| -||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny||Web help| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

    |File is signed; create a publisher condition|Deny||Web help| ||||Windows files|C:\Windows|Use the default rule for the Windows path|Allow||Help desk| The following two tables illustrate examples of documenting considerations to maintain and manage AppLocker policies. @@ -173,4 +162,3 @@ The following table is an example of what to consider and record. |--- |--- |--- |--- |--- | |Bank Tellers|Planned: Monthly through business office triage

    Emergency: Request through help desk|Through business office triage

    30-day notice required|General policy: Keep past versions for 12 months

    List policies for each application|Coordinated through business office

    30-day notice required| |Human Resources|Planned: Monthly through HR triage

    Emergency: Request through help desk|Through HR triage

    30-day notice required|General policy: Keep past versions for 60 months

    List policies for each application|Coordinated through HR

    30-day notice required| - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md index 5aa365b37a..06168d1e9a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md @@ -1,17 +1,12 @@ --- -title: Refresh an AppLocker policy +title: Refresh an AppLocker policy description: This topic for IT professionals describes the steps to force an update for an AppLocker policy. -ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Refresh an AppLocker policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -36,7 +25,7 @@ To use Group Policy to distribute the AppLocker policy change, you need to retri [Edit an AppLocker policy](edit-an-applocker-policy.md) and [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md). -To complete this procedure, you must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. +To complete this procedure, you must have Edit Setting permission to edit a GPO. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. **To manually refresh the AppLocker policy by using Group Policy** @@ -65,6 +54,6 @@ To make the same change on another device, you can use any of the following meth - From the device that you made the change on, export the AppLocker policy, and then import the policy onto the other device. To do these tasks, use the AppLocker **Export Policy** and **Import Policy** features to copy the rules from the changed computer. - >**Caution:**  When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied. -   + >**Caution:** When importing rules from another computer, all the rules will be applied, not just the one that was updated. Merging policies allows both existing and updated (or new) rules to be applied. + - Merge AppLocker policies. For information on the procedures to do this merging, see [Merge AppLocker policies manually](merge-applocker-policies-manually.md) and [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md index 5df2060dbd..40579e3963 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Requirements for deploying AppLocker policies +title: Requirements for deploying AppLocker policies description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. -ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Requirements for deploying AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md index 23c6363413..47b2d12aba 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md @@ -1,17 +1,12 @@ --- -title: Requirements to use AppLocker +title: Requirements to use AppLocker description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. -ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Requirements to use AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -47,21 +36,21 @@ The following table shows the Windows versions on which AppLocker features are s | Version | Can be configured | Can be enforced | Available rules | Notes | | - | - | - | - | - | -| Windows 10 and Windows 11| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

    Windows versions older than version 2004, including Windows Server 2019:

    • Policies deployed through GP are only supported on Enterprise and Server editions.
    • Policies deployed through MDM are supported on all editions.
    | -| Windows Server 2019
    Windows Server 2016
    Windows Server 2012 R2
    Windows Server 2012| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | +| Windows 10 and Windows 11| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

    Windows versions older than version 2004, including Windows Server 2019:
    • Policies deployed through GP are only supported on Enterprise and Server editions.
    • Policies deployed through MDM are supported on all editions.
    | +| Windows Server 2019
    Windows Server 2016
    Windows Server 2012 R2
    Windows Server 2012| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | | Windows 8.1 Pro| Yes| No| N/A|| -| Windows 8.1 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | +| Windows 8.1 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL| | | Windows RT 8.1| No| No| N/A|| | Windows 8 Pro| Yes| No| N/A|| -| Windows 8 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL|| +| Windows 8 Enterprise| Yes| Yes| Packaged apps
    Executable
    Windows Installer
    Script
    DLL|| | Windows RT| No| No| N/A| | -| Windows Server 2008 R2 Standard| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows 7 Ultimate| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows 7 Enterprise| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| -| Windows 7 Professional| Yes| No| Executable
    Windows Installer
    Script
    DLL| No AppLocker rules are enforced.| +| Windows Server 2008 R2 Standard| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows 7 Ultimate| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows 7 Enterprise| Yes| Yes| Executable
    Windows Installer
    Script
    DLL| Packaged app rules won't be enforced.| +| Windows 7 Professional| Yes| No| Executable
    Windows Installer
    Script
    DLL| No AppLocker rules are enforced.| AppLocker isn't supported on versions of the Windows operating system not listed above. Software Restriction Policies can be used with those versions. However, the SRP Basic User feature isn't supported on the above operating systems. @@ -75,4 +64,4 @@ AppLocker isn't supported on versions of the Windows operating system not listed - [Optimize AppLocker performance](optimize-applocker-performance.md) - [Use AppLocker and Software Restriction Policies in the same domain](use-applocker-and-software-restriction-policies-in-the-same-domain.md) - [Manage packaged apps with AppLocker](manage-packaged-apps-with-applocker.md) -- [AppLocker Design Guide](applocker-policies-design-guide.md) \ No newline at end of file +- [AppLocker Design Guide](applocker-policies-design-guide.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md index f02e55d1b8..d6ba932c98 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md @@ -1,17 +1,12 @@ --- -title: Run the Automatically Generate Rules wizard +title: Run the Automatically Generate Rules wizard description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. -ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Run the Automatically Generate Rules wizard -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -52,4 +41,4 @@ You can perform this task by using the Group Policy Management Console for an Ap 8. Review the files that were analyzed and the rules that will be automatically created. To make changes, click **Previous** to return to the page where you can change your selections. After reviewing the rules, click **Create**. ->**Note:**  If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. +>**Note:** If you are running the wizard to create your first rules for a GPO, you will be prompted to create the default rules, which allow critical system files to run, after completing the wizard. You may edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after replacing them with your custom rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md index 77e77e2f49..bee1694c3a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Script rules in AppLocker +title: Script rules in AppLocker description: This article describes the file formats and available default rules for the script rule collection. -ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 06/15/2022 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Script rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - This article describes the file formats and available default rules for the script rule collection. AppLocker defines script rules to include only the following file formats: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md index ddcf98dc38..f32ff85c69 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md @@ -1,17 +1,12 @@ --- -title: Security considerations for AppLocker +title: Security considerations for AppLocker description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. -ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Security considerations for AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -43,9 +32,9 @@ AppLocker runs in the context of Administrator or LocalSystem, which is the high When files are being secured in a directory with a rule of the path condition type, whether using the allow or deny action on the rule, it's still necessary and good practice to restrict access to those files by setting the access control lists (ACLs) according to your security policy. -AppLocker doesn't protect against running 16-bit DOS binaries in the Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or later when there's already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it's a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the executable rule collection for NTVDM.exe. +AppLocker doesn't protect against running 16-bit DOS binaries in the Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or later when there's already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it's a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the executable rule collection for NTVDM.exe. -You can't use AppLocker (or Software Restriction Policies) to prevent code from running outside the Win32 subsystem. In particular, this rule applies to the (POSIX) subsystem in Windows NT. If it's a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. +You can't use AppLocker (or Software Restriction Policies) to prevent code from running outside the Win32 subsystem. In particular, this rule applies to the (POSIX) subsystem in Windows NT. If it's a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. AppLocker can only control VBScript, JScript, .bat files, .cmd files, and Windows PowerShell scripts. It doesn't control all interpreted code that runs within a host process, for example, Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To control interpreted code by using AppLocker, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision returned by AppLocker. Not all host processes call into AppLocker and, therefore, AppLocker can't control every kind of interpreted code, such as Microsoft Office macros. @@ -61,4 +50,4 @@ You can block the Windows Subsystem for Linux by blocking LxssManager.dll. ## Related topics -- [AppLocker technical reference](applocker-technical-reference.md) \ No newline at end of file +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md index 43ddf77312..7776bf7386 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md @@ -1,17 +1,12 @@ --- -title: Select the types of rules to create +title: Select the types of rules to create description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker. -ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Select the types of rules to create -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md index 44df75bc53..0c029929bf 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -1,17 +1,12 @@ --- -title: Test an AppLocker policy by using Test-AppLockerPolicy +title: Test an AppLocker policy by using Test-AppLockerPolicy description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. -ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Test an AppLocker policy by using Test-AppLockerPolicy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -41,17 +30,17 @@ Any user account can be used to complete this procedure. 1. Open a Windows PowerShell command prompt window as an administrator. 2. Use the **Get-AppLockerPolicy** cmdlet to export the effective AppLocker policy to an XML file: - `Get-AppLockerPolicy –Effective –XML > ` + `Get-AppLockerPolicy -Effective -XML > ` 2. Use the **Get-ChildItem** cmdlet to specify the directory that you want to test, specify the **Test-AppLockerPolicy** cmdlet with the XML file from the previous step to test the policy, and use the **Export-CSV** cmdlet to export the results to a file to be analyzed: - `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy -User -Filter | Export-CSV ` + `Get-ChildItem -Filter -Recurse | Convert-Path | Test-AppLockerPolicy -XMLPolicy -User -Filter | Export-CSV ` The following shows example input for **Test-AppLockerPolicy**: ```syntax -PS C:\ Get-AppLockerPolicy –Effective –XML > C:\Effective.xml -PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' –filter *.exe –Recurse | Convert-Path | Test-AppLockerPolicy –XMLPolicy C:\Effective.xml –User contoso\zwie –Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv +PS C:\ Get-AppLockerPolicy -Effective -XML > C:\Effective.xml +PS C:\ Get-ChildItem 'C:\Program Files\Microsoft Office\' -filter *.exe -Recurse | Convert-Path | Test-AppLockerPolicy -XMLPolicy C:\Effective.xml -User contoso\zwie -Filter Denied,DeniedByDefault | Export-CSV C:\BlockedFiles.csv ``` In the example, the effective AppLocker policy is exported to the file C:\\Effective.xml. The **Get-ChildItem** cmdlet is used to recursively gather path names for the .exe files in C:\\Program Files\\Microsoft Office\\. The XMLPolicy parameter specifies that the C:\\Effective.xml file is an XML AppLocker policy file. By specifying the User parameter, you can test the rules for specific users, and the **Export-CSV** cmdlet allows the results to be exported to a comma-separated file. In the example, `-FilterDenied,DeniedByDefault` displays only those files that will be blocked for the user under the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md index 9a6dd54ca3..71815be79b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md @@ -1,17 +1,12 @@ --- -title: Test and update an AppLocker policy +title: Test and update an AppLocker policy description: This topic discusses the steps required to test an AppLocker policy prior to deployment. -ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Test and update an AppLocker policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -67,10 +56,8 @@ After you've identified which rules need to be edited or added to the policy, yo ## Step 6: Repeat policy testing, analysis, and policy modification -Repeat the previous steps 3–5 until all the rules perform as intended before applying enforcement. +Repeat the previous steps 3-5 until all the rules perform as intended before applying enforcement. ## Other resources - For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md index 9ce6b9e70c..9fcea89142 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Tools to use with AppLocker +title: Tools to use with AppLocker description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. -ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Tools to use with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -64,4 +53,4 @@ The following tools can help you administer the application control policies cre ## Related topics -- [AppLocker technical reference](applocker-technical-reference.md) \ No newline at end of file +- [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md index 9b4ba84412..9b5abb0b0b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md @@ -1,17 +1,12 @@ --- -title: Understand AppLocker enforcement settings +title: Understand AppLocker enforcement settings description: This topic describes the AppLocker enforcement settings for rule collections. -ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand AppLocker enforcement settings -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md index 7fb08dd316..d61a4fdf98 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md @@ -1,17 +1,12 @@ --- -title: Understand AppLocker policy design decisions +title: Understand AppLocker policy design decisions description: Review some common considerations while you're planning to use AppLocker to deploy application control policies within a Windows environment. -ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 10/13/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand AppLocker policy design decisions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -107,7 +96,7 @@ If your organization supports multiple Windows operating systems, app control po ### Are there specific groups in your organization that need customized application control policies? -Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. +Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group's priorities before you deploy application control policies for the entire organization. | Possible answers | Design considerations | | - | - | @@ -132,7 +121,6 @@ Preventing your users from accessing known, deployed, or personal applications w | Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. | | No | Invest time in developing online support processes and documentation before deployment. | - ### Do you know what applications require restrictive policies? Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data. @@ -151,7 +139,6 @@ Implementing a successful application control policy is based on your knowledge | Strict written policy or guidelines to follow | You need to develop AppLocker rules that reflect those policies, and then test and maintain the rules. | | No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. | - ### Does your organization already have SRP deployed? Although SRP and AppLocker have the same goal, AppLocker is a major revision of SRP. @@ -196,4 +183,3 @@ Because the effectiveness of application control policies is dependent on the ab The next step in the process is to record and analyze your answers to the preceding questions. If AppLocker is the right solution for your goals, you can set your application control policy objectives and plan your AppLocker rules. This process culminates in creating your planning document. - For info about setting your policy goals, see [Determine your application control objectives](determine-your-application-control-objectives.md). - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index e0f5c0575d..fc99a9815b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -1,17 +1,12 @@ --- -title: Understand AppLocker rules and enforcement setting inheritance in Group Policy +title: Understand AppLocker rules and enforcement setting inheritance in Group Policy description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. -ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand AppLocker rules and enforcement setting inheritance in Group Policy -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -42,7 +31,7 @@ Group Policy merges AppLocker policy in two ways: 1. **Explicit deny.** An administrator created a rule to deny a file. 2. **Explicit allow.** An administrator created a rule to allow a file. 3. **Implicit deny.** This is also called the default deny because all files that are not affected by an allow rule are automatically blocked. -   + - **Enforcement settings.** The last write to the policy is applied. For example, if a higher-level GPO has the enforcement setting configured to **Enforce rules** and the closest GPO has the setting configured to **Audit only**, **Audit only** is enforced. If enforcement is not configured on the closest GPO, the setting from the closest linked GPO will be enforced. Because a computer's effective policy includes rules from each linked GPO, duplicate rules or conflicting rules could be enforced on a user's computer. Therefore, you should carefully plan your deployment to ensure that only rules that are necessary are present in a GPO. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index 82fc009a1b..ab1522f49e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -1,17 +1,12 @@ --- -title: Understand the AppLocker policy deployment process +title: Understand the AppLocker policy deployment process description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. -ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understand the AppLocker policy deployment process -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -44,5 +33,3 @@ The following topics contain information about designing, planning, deploying, a - For info about the AppLocker policy deployment requirements and process, see [AppLocker deployment guide](applocker-policies-deployment-guide.md). - For info about AppLocker policy maintenance and monitoring, see [Administer AppLocker](administer-applocker.md). - For info about AppLocker policy architecture, components, and processing, see [AppLocker technical reference](applocker-technical-reference.md). -  -  diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md index 1e8aee1c7e..cec55e8e38 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker allow and deny actions on rules +title: Understanding AppLocker allow and deny actions on rules description: This topic explains the differences between allow and deny actions on AppLocker rules. -ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker allow and deny actions on rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,7 +35,7 @@ Although you can use AppLocker to create a rule to allow all files to run and th | File hash | A user could modify the hash for a file.| | Path | A user could move the denied file to a different location and run it from there.| ->**Important:**  If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. +>**Important:** If you choose to use the deny action on rules, you must ensure that you first create rules that allow the Windows system files to run. AppLocker enforces rules for allowed applications by default, so after one or more rules have been created for a rule collection (affecting the Windows system files), only the apps that are listed as being allowed will be permitted to run. Therefore, creating a single rule in a rule collection to deny a malicious file from running will also deny all other files on the computer from running. ## Related topics diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md index d15cdff954..606e9924ec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker default rules +title: Understanding AppLocker default rules description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. -ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker default rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md index a54b284804..377eb5019a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule behavior +title: Understanding AppLocker rule behavior description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. -ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule behavior -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -37,8 +26,8 @@ A rule can be configured to use either an allow or deny action: - **Allow**. You can specify which files are allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. - **Deny**. You can specify which files aren't allowed to run in your environment and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. ->**Important:**  You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. -  +>**Important:** You can use a combination of allow actions and deny actions. However, we recommend using allow actions with exceptions because deny actions override allow actions in all cases. Deny actions can also be circumvented. For example, if you configure a deny action for a file or folder path, the user can still run the file from any other path. + ## Related topics - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md index 94c277a12b..1787c045ef 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule collections +title: Understanding AppLocker rule collections description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. -ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule collections -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -40,7 +29,7 @@ An AppLocker rule collection is a set of rules that apply to one of five types: If you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps. ->**Important:**  Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. +>**Important:** Each app can load several DLLs, and AppLocker must check each DLL before it is allowed to run. Therefore, creating DLL rules might cause performance problems on some computers. Denying some DLLs from running can also create app compatibility problems. As a result, the DLL rule collection is not enabled by default. For info about how to enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md). @@ -48,4 +37,3 @@ For info about how to enable the DLL rule collection, see [Enable the DLL rule c - [How AppLocker works](how-applocker-works-techref.md) - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md index 7bdf8b04f3..b26445b191 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule condition types +title: Understanding AppLocker rule condition types description: This topic for the IT professional describes the three types of AppLocker rule conditions. -ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule condition types -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -58,15 +47,15 @@ Selecting the appropriate condition for each rule depends on the overall applica > [!NOTE] > To determine how many applications on a reference computer are digitally signed, you can use the **Get-AppLockerFileInformation** Windows PowerShell cmdlet for a directory of files. For example, - `Get-AppLockerFileInformation –Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. -   + `Get-AppLockerFileInformation -Directory C:\Windows\ -FileType EXE -recurse` displays the properties for all .exe and .com files within the Windows directory. + 2. What rule condition type does your organization prefer? If your organization is already using Software Restriction Policies (SRP) to restrict what files users can run, rules using file hash or path conditions are probably already in place. > [!NOTE] > For a list of supported operating system versions and editions to which SRP and AppLocker rules can be applied, see [Requirements to use AppLocker](requirements-to-use-applocker.md). -   + ## Related topics - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md index 4ac6b603d7..71ae842b65 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md @@ -1,17 +1,12 @@ --- -title: Understanding AppLocker rule exceptions +title: Understanding AppLocker rule exceptions description: This topic describes the result of applying AppLocker rule exceptions to rule collections. -ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding AppLocker rule exceptions -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md index 0582d50ebd..6e13561e2c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Understanding the file hash rule condition in AppLocker +title: Understanding the file hash rule condition in AppLocker description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it's applied. -ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding the file hash rule condition in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md index 2e970ac2c4..5d3e6d2d29 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Understanding the path rule condition in AppLocker +title: Understanding the path rule condition in AppLocker description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it's applied. -ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding the path rule condition in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -44,7 +33,6 @@ The asterisk (\*) wildcard character can be used within **Path** field. The aste AppLocker uses path variables for well-known directories in Windows. Path variables aren't environment variables. The AppLocker engine can only interpret AppLocker path variables. The following table details these path variables. - | Windows directory or drive | AppLocker path variable | Windows environment variable | |---------------------------------------------------------|-------------------------|----------------------------------------| | Windows | %WINDIR% | %SystemRoot% | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md index 76fed21426..dbc7fe282d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Understanding the publisher rule condition in AppLocker +title: Understanding the publisher rule condition in AppLocker description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it's applied. -ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Understanding the publisher rule condition in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -42,7 +31,7 @@ Wildcard characters can be used as values in the publisher rule fields according - **Publisher** - The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name “\*x\*”. A question mark (?) isn't a valid wildcard character in this field. + The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name "\*x\*". A question mark (?) isn't a valid wildcard character in this field. - **Product name** @@ -62,7 +51,7 @@ Wildcard characters can be used as values in the publisher rule fields according The following table describes how a publisher condition is applied. -| Option | The publisher condition allows or denies…| +| Option | The publisher condition allows or denies...| | - | - | | **All signed files** | All files that are signed by a publisher.| | **Publisher only** | All files that are signed by the named publisher.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index e63ab0e64b..eb14fbd674 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -1,16 +1,11 @@ --- -title: Use a reference device to create and maintain AppLocker policies +title: Use a reference device to create and maintain AppLocker policies description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. -ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.reviewer: @@ -19,12 +14,6 @@ ms.technology: itpro-security # Use a reference device to create and maintain AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -36,7 +25,7 @@ An AppLocker reference device is a baseline device you can use to configure poli An AppLocker reference device that is used to create and maintain AppLocker policies should contain the corresponding apps for each organizational unit (OU) to mimic your production environment. ->**Important:**  The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). +>**Important:** The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement setting or Windows PowerShell cmdlets. You can also use the reference device as part of a testing configuration that includes policies that are created by using Software Restriction Policies. @@ -44,13 +33,13 @@ You can perform AppLocker policy testing on the reference device by using the ** With AppLocker, you can automatically generate rules for all files within a folder. AppLocker scans the specified folder and creates the condition types that you choose for each file in that folder. For information on how to automatically generate rules, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). ->**Note:**  If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. +>**Note:** If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. ## Step 2: Create the default rules on the reference device AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You must run the default rules for each rule collection. For info about default rules and considerations for using them, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md). For the procedure to create default rules, see [Create AppLocker default rules](create-applocker-default-rules.md). ->**Important:**  You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. +>**Important:** You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. ## Step 3: Modify rules and the rule collection on the reference device @@ -72,7 +61,7 @@ You should test each set of rules to ensure that they perform as intended. The * - [Test an AppLocker Policy with Test-AppLockerPolicy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791772(v=ws.10)) - [Discover the Effect of an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791823(v=ws.10)) ->**Caution:**  If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. +>**Caution:** If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. ## Step 5: Export and import the policy into production @@ -94,4 +83,4 @@ If more refinements or updates are necessary after a policy is deployed, use the ## See also -- [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) \ No newline at end of file +- [Deploy the AppLocker policy into production](deploy-the-applocker-policy-into-production.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md index 1cfb01105a..9415499e71 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -1,17 +1,12 @@ --- -title: Use AppLocker and Software Restriction Policies in the same domain +title: Use AppLocker and Software Restriction Policies in the same domain description: This article for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. -ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 11/07/2022 ms.technology: itpro-security @@ -19,11 +14,6 @@ ms.technology: itpro-security # Use AppLocker and Software Restriction Policies in the same domain -**Applies to** - -- Windows 10 -- Windows Server 2016 - This article for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. > [!IMPORTANT] @@ -31,7 +21,7 @@ This article for IT professionals describes concepts and procedures to help you ## Using AppLocker and Software Restriction Policies in the same domain -AppLocker is supported on systems running Windows 8.1. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It's recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. +AppLocker is supported on systems running Windows 8.1. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It's recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. @@ -41,15 +31,15 @@ The following table compares the features and functions of Software Restriction |Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

    AppLocker permits customization of error messages to direct users to a Web page for help.| |Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in (if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.| |Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| -|Enforcement mode|SRP works in the “blocklist mode” where administrators can create rules for files that they don't want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

    SRP can also be configured in the “allowlist mode” so that by default all files are blocked. In "allowlist mode", administrators need to create allow rules for files that they want to run.|AppLocker by default works in the “allowlist mode” where only those files are allowed to run for which there's a matching allow rule.| +|Enforcement mode|SRP works in the "blocklist mode" where administrators can create rules for files that they don't want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

    SRP can also be configured in the "allowlist mode" so that by default all files are blocked. In "allowlist mode", administrators need to create allow rules for files that they want to run.|AppLocker by default works in the "allowlist mode" where only those files are allowed to run for which there's a matching allow rule.| |File types that can be controlled|SRP can control the following file types:
  • Executables
  • Dlls
  • Scripts
  • Windows Installers

    SRP can't control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
  • Executables
  • Dlls
  • Scripts
  • Windows Installers
  • Packaged apps and installers

    AppLocker maintains a separate rule collection for each of the five file types.| |Designated file types|SRP supports an extensible list of file types that are considered executable. Administrators can add extensions for files that should be considered executable.|AppLocker currently supports the following file extensions:
  • Executables (.exe, .com)
  • Dlls (.ocx, .dll)
  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
  • Windows Installers (.msi, .mst, .msp)
  • Packaged app installers (.appx)| |Rule types|SRP supports four types of rules:
  • Hash
  • Path
  • Signature
  • Internet zone|AppLocker supports three types of rules:
  • File hash
  • Path
  • Publisher| -|Editing the hash value|In Windows XP, you could use SRP to provide custom hash values.

    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, and not provide the hash value.|AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.| +|Editing the hash value|In Windows XP, you could use SRP to provide custom hash values.

    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, and not provide the hash value.|AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.| |Support for different security levels|With SRP, you can specify the permissions with which an app can run. So, you can configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker doesn't support security levels.| |Manage Packaged apps and Packaged app installers.|Not supported|.appx is a valid file type which AppLocker can manage.| |Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| -|Support for rule exceptions|SRP doesn't support rule exceptions.|AppLocker rules can have exceptions, which allow you to create rules such as “Allow everything from Windows except for regedit.exe”.| +|Support for rule exceptions|SRP doesn't support rule exceptions.|AppLocker rules can have exceptions, which allow you to create rules such as "Allow everything from Windows except for regedit.exe".| |Support for audit mode|SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode, which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you're satisfied with the results, you can start enforcing the policy.| |Support for exporting and importing policies|SRP doesn't support policy import/export.|AppLocker supports the importing and exporting of policies. This support by AppLocker allows you to create AppLocker policy on a sample device, test it out and then export that policy and import it back into the desired GPO.| |Rule enforcement|Internally, SRP rules enforcement happens in the user-mode, which is less secure.|Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode, which is more secure than enforcing them in the user-mode.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md index 6c0c369c78..155e3e6d17 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md @@ -1,17 +1,12 @@ --- -title: Use the AppLocker Windows PowerShell cmdlets +title: Use the AppLocker Windows PowerShell cmdlets description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. -ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Use the AppLocker Windows PowerShell cmdlets -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -35,7 +24,7 @@ This topic for IT professionals describes how each AppLocker Windows PowerShell The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. -To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the +To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. ### Retrieve application information @@ -63,4 +52,4 @@ The [Test-AppLockerPolicy](/powershell/module/applocker/test-applockerpolicy) cm ## Other resources -- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). \ No newline at end of file +- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md index c7de76bb21..2aedf66058 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md @@ -1,17 +1,12 @@ --- -title: Using Event Viewer with AppLocker +title: Using Event Viewer with AppLocker description: This article lists AppLocker events and describes how to use Event Viewer with AppLocker. -ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.technology: itpro-security ms.date: 02/02/2023 @@ -19,12 +14,6 @@ ms.date: 02/02/2023 # Using Event Viewer with AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -89,4 +78,3 @@ The following table contains information about the events that you can use to de ## Related articles - [Tools to use with AppLocker](tools-to-use-with-applocker.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md index b7aec02c5b..d8b071c1c2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Use Software Restriction Policies and AppLocker policies +title: Use Software Restriction Policies and AppLocker policies description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. -ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Use Software Restriction Policies and AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -32,23 +21,23 @@ This topic for the IT professional describes how to use Software Restriction Pol ## Understand the difference between SRP and AppLocker -You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). +You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). ## Use SRP and AppLocker in the same domain SRP and AppLocker use Group Policy for domain management. However, when policies are generated by SRP and AppLocker exist in the same domain, and they're applied through Group Policy, AppLocker policies take precedence over policies generated by SRP on computers that are running an operating system that supports AppLocker. For info about how inheritance in Group Policy applies to AppLocker policies and policies generated by SRP, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). ->**Important:**  As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. +>**Important:** As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. The following scenario provides an example of how each type of policy would affect a bank teller software app, where the app is deployed on different Windows desktop operating systems and managed by the Tellers GPO. | Operating system | Tellers GPO with AppLocker policy | Tellers GPO with SRP | Tellers GPO with AppLocker policy and SRP | | - | - | - | - | -| Windows 10, Windows 8.1, Windows 8, and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| -| Windows Vista| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| -| Windows XP| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| +| Windows 10, Windows 8.1, Windows 8, and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| +| Windows Vista| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| +| Windows XP| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| ->**Note:**  For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). +>**Note:** For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). ## Test and validate SRPs and AppLocker policies that are deployed in the same environment diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md index 3a6fb08e52..68586393f4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md @@ -1,17 +1,12 @@ --- -title: What Is AppLocker +title: What Is AppLocker description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. -ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # What Is AppLocker? -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -83,5 +72,3 @@ The following table compares the application control functions of Software Restr ## Related topics - [AppLocker technical reference](applocker-technical-reference.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md index 43981062e8..9a410a20af 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md @@ -1,17 +1,12 @@ --- -title: Windows Installer rules in AppLocker +title: Windows Installer rules in AppLocker description: This topic describes the file formats and available default rules for the Windows Installer rule collection. -ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Windows Installer rules in AppLocker -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -47,5 +36,3 @@ The purpose of this collection is to allow you to control the installation of fi ## Related topics - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) - - diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md index ca6e21acbd..8e4a0a0395 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md @@ -1,17 +1,12 @@ --- -title: Working with AppLocker policies +title: Working with AppLocker policies description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. -ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d ms.reviewer: ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro ms.topic: conceptual ms.date: 09/21/2017 ms.technology: itpro-security @@ -19,12 +14,6 @@ ms.technology: itpro-security # Working with AppLocker policies -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -46,5 +35,4 @@ This topic for IT professionals provides links to procedural topics about creati | [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) | This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.| | [Merge AppLocker policies manually](merge-applocker-policies-manually.md) | This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).| | [Refresh an AppLocker policy](refresh-an-applocker-policy.md) | This topic for IT professionals describes the steps to force an update for an AppLocker policy.| -| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| - +| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md index 2cec2568d1..8d170ef5ed 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md @@ -1,14 +1,10 @@ --- -title: Working with AppLocker rules +title: Working with AppLocker rules description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. -ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security author: vinaypamnani-msft ms.localizationpriority: medium msauthor: v-anbic @@ -19,12 +15,6 @@ ms.topic: conceptual # Working with AppLocker rules -**Applies to** - -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). @@ -67,7 +57,7 @@ The AppLocker console is organized into rule collections, which are executable f | Packaged apps and packaged app installers | .appx| | DLL files | .dll
    .ocx| ->**Important:**  If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. +>**Important:** If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. @@ -93,7 +83,7 @@ This condition identifies an app based on its digital signature and extended att When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving up the slider or by using a wildcard character (\*) in the product, file name, or version number fields. ->**Note:**  To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. +>**Note:** To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. The **File version** and **Package version** control whether a user can run a specific version, earlier versions, or later versions of the app. You can choose a version number and then configure the following options: @@ -103,8 +93,7 @@ The **File version** and **Package version** control whether a user can run a sp The following table describes how a publisher condition is applied. - -| Option | The publisher condition allows or denies… | +| Option | The publisher condition allows or denies... | |---|---| | **All signed files** | All files that are signed by any publisher.| | **Publisher only**| All files that are signed by the named publisher.| @@ -132,7 +121,7 @@ The following table details these path variables. | Removable media (for example, a CD or DVD)| %REMOVABLE%| | | Removable storage device (for example, a USB flash drive)| %HOT% | | ->**Important:**  Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. +>**Important:** Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. ### File hash @@ -202,7 +191,7 @@ Membership in the local **Administrators** group, or equivalent, is the minimum 3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then click **Properties**. 4. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. - >**Important:**  Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. + >**Important:** Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. ## AppLocker wizards @@ -221,7 +210,7 @@ You can create rules by using two AppLocker wizards: - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule can't persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. - If an app isn't digitally signed, you can't use a publisher rule condition for that app. -- AppLocker rules can't be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. +- AppLocker rules can't be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. - The packaged apps and packaged apps installer rule collection is available on devices running at least Windows Server 2012 and Windows 8. - When the rules for the executable rule collection are enforced and the packaged apps and packaged app installers rule collection doesn't contain any rules, no packaged apps and packaged app installers are allowed to run. In order to allow any packaged apps and packaged app installers, you must create rules for the packaged apps and packaged app installers rule collection. - When an AppLocker rule collection is set to **Audit only**, the rules aren't enforced. When a user runs an application that is included in the rule, the app is opened and runs normally, and information about that app is added to the AppLocker event log. From 746c4aa58d6b49148d5034c76ce86cbdb7315aec Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 7 Jun 2023 08:36:19 -0700 Subject: [PATCH 16/30] Re-wrote section on the SpecificFileNameLevel option --- .../select-types-of-rules-to-create.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 35749e24f5..1c867e7010 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -13,7 +13,7 @@ author: jgeurten ms.reviewer: jsuther1974 ms.author: vinpa manager: aaroncz -ms.date: 06/06/2023 +ms.date: 06/07/2023 ms.technology: itpro-security ms.topic: article --- @@ -80,17 +80,17 @@ Each file rule level has advantages and disadvantages. Use Table 2 to select the | Rule level | Description | |----------- | ----------- | | **Hash** | Specifies individual [Authenticode/PE image hash values](#more-information-about-hashes) for each discovered binary. This level is the most specific level, and requires more effort to maintain the current product versions' hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | -| **FileName** | Specifies the original filename for each binary. Although the hash values for an application are modified when updated, the file names are typically not. This level offers less specific security than the hash level, but it doesn't typically require a policy update when any binary is modified. | +| **FileName** | Specifies the original filename for each binary. Although the hash values for an application are modified when updated, the file names are typically not. This level offers less specific security than the hash level, but it doesn't typically require a policy update when any binary is modified. By default, this level uses the OriginalFileName attribute of the file's resource header. Use [-SpecificFileNameLevel](#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) to choose an alternative attribute, such as ProductName. | | **FilePath** | Beginning with Windows 10 version 1903, this level allows binaries to run from specific file path locations. FilePath rules only apply to user mode binaries and can't be used to allow kernel mode drivers. More information about FilePath level rules can be found later in this article. | | **SignedVersion** | This level combines the publisher rule with a version number. It allows anything to run from the specified publisher with a version at or above the specified version number. | | **Publisher** | This level combines the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. You can use this rule level to trust a certificate issued by a particular CA and issued to a specific company you trust (such as Intel, for device drivers). | -| **FilePublisher** | This level combines the "FileName" attribute of the signed file, plus "Publisher" (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. | +| **FilePublisher** | This level combines the "FileName" attribute of the signed file, plus "Publisher" (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. By default, this level uses the OriginalFileName attribute of the file's resource header. Use [-SpecificFileNameLevel](#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) to choose an alternative attribute, such as ProductName. | | **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product have different hash values but typically the same signing certificate. When this level is used, no policy update would be needed to run the new version of the application. However, leaf certificates typically have shorter validity periods than other certificate levels, so the WDAC policy must be updated whenever these certificates change. | | **PcaCertificate** | Adds the highest available certificate in the provided certificate chain to signers. This level is typically one certificate below the root because the scan doesn't resolve the complete certificate chain via the local root stores or with an online check. | | **RootCertificate** | Not supported. | | **WHQL** | Only trusts binaries that have been submitted to Microsoft and signed by the Windows Hardware Qualification Lab (WHQL). This level is primarily for kernel binaries. | | **WHQLPublisher** | This level combines the WHQL level and the CN on the leaf certificate, and is primarily for kernel binaries. | -| **WHQLFilePublisher** | This level combines the "FileName" attribute of the signed file, plus "WHQLPublisher", plus a minimum version number. This level is primarily for kernel binaries. | +| **WHQLFilePublisher** | This level combines the "FileName" attribute of the signed file, plus "WHQLPublisher", plus a minimum version number. This level is primarily for kernel binaries. By default, this level uses the OriginalFileName attribute of the file's resource header. Use [-SpecificFileNameLevel](#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) to choose an alternative attribute, such as ProductName. | > [!NOTE] > When you create WDAC policies with [New-CIPolicy](/powershell/module/configci/new-cipolicy), you can specify a primary file rule level, by including the **-Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **-Fallback** parameter. For example, if the primary file rule level is PCACertificate, but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. @@ -122,6 +122,22 @@ WDAC has a built-in file rule conflict logic that translates to precedence order > [!NOTE] > To make it easier to reason over your WDAC policies, we recommend maintaining separate ALLOW and DENY policies on Windows versions that support [multiple WDAC policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies). +## Use -SpecificFileNameLevel with FileName, FilePublisher, or WHQLFilePublisher level rules + +By default, the FileName, FilePublisher, and WHQLFilePublisher rule levels will use the OriginalFileName attribute from the file's resource header. You can use an alternative resource header attribute for your rules by setting the **-SpecificFileNameLevel**. For instance, a software developer may use the same ProductName for all binaries that are part of an app. Using -SpecificFileNameLevel, you can create a single rule to cover all of those binaries in your policy rather than individual rules for every file. + +Table 3 describes the available resource header attribute options you can set with -SpecificFileNameLevel. + +### Table 3. -SpecificFileNameLevel options + +| SpecificFileNameLevel value | Description | +|----------- | ----------- | +| **FileDescription** | Specifies the file description provided by the developer of the binary. | +| **InternalName** | Specifies the internal name of the binary. | +| **OriginalFileName** | Specifies the original file name, or the name with which the file was first created, of the binary. | +| **PackageFamilyName** | Specifies the package family name of the binary. The package family name consists of two parts: the name of the file and the publisher ID. | +| **ProductName** | Specifies the name of the product with which the binary ships. | + ## More information about filepath rules Filepath rules don't provide the same security guarantees that explicit signer rules do, since they're based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. Path rules are best suited to allow paths that you expect to remain admin-writeable only. You may want to avoid path rules for directories where standard users can modify ACLs on the folder. @@ -187,19 +203,3 @@ Separate rules are created for UMCI and KMCI. If the cmdlets can't determine tha ### When does WDAC use the flat file hash value? There are some rare cases where a file's format doesn't conform to the Authenticode spec and so WDAC falls back to use the flat file hash. This can occur for a number of reasons, such as if changes are made to the in-memory version of the file at runtime. In such cases, you'll see that the hash shown in the correlated 3089 signature information event matches the flat file hash from the 3076/3077 block event. To create rules for files with an invalid format, you can add hash rules to the policy for the flat file hash using the WDAC Wizard or by editing the policy XML directly. - -## Windows Defender Application Control filename rules - -File name rule levels let you specify file attributes to base a rule on. File name rules provide the same security guarantees that explicit signer rules do, as they're based on non-mutable file attributes. Specification of the file name level occurs when creating new policy rules. - -Use Table 3 to select the appropriate file name level for your use cases. For instance, an LOB or production application and its binaries may all share the same product name. This option lets you easily create targeted policies based on the Product Name filename rule level. - -### Table 3. Windows Defender Application Control policy - filename levels - -| Rule level | Description | -|----------- | ----------- | -| **File Description** | Specifies the file description provided by the developer of the binary. | -| **Internal Name** | Specifies the internal name of the binary. | -| **Original File Name** | Specifies the original file name, or the name with which the file was first created, of the binary. | -| **Package Family Name** | Specifies the package family name of the binary. The package family name consists of two parts: the name of the file and the publisher ID. | -| **Product Name** | Specifies the name of the product with which the binary ships. | From 0a782b349c3bddc5baf7f87241dda4f115ac2739 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 11:45:54 -0400 Subject: [PATCH 17/30] Refresh security baseline --- ...w-to-configure-security-policy-settings.md | 106 ++++++++---------- ...sword-must-meet-complexity-requirements.md | 78 ++++++------- 2 files changed, 81 insertions(+), 103 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md index 8d0ace0072..6dcfe5687d 100644 --- a/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md @@ -1,93 +1,81 @@ --- -title: Configure security policy settings +title: Configure security policy settings description: Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. -ms.assetid: 63b0967b-a9fe-4d92-90af-67469ee20320 -ms.reviewer: ms.author: vinpa -ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro -ms.collection: - - highpri - - tier3 +ms.collection: +- highpri +- tier3 ms.topic: conceptual -ms.date: 04/19/2017 -ms.technology: itpro-security +ms.date: 06/07/2023 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 --- + # Configure security policy settings -**Applies to** -- Windows 11 -- Windows 10 - -Describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. - -You must have Administrators rights on the local device, or you must have the appropriate permissions to update a Group Policy Object (GPO) on the domain controller to perform these procedures. +This article describes steps to configure a security policy setting on the local device, on a domain-joined device, and on a domain controller. You must have Administrators rights on the local device, or you must have the appropriate permissions to update a Group Policy Object (GPO) on the domain controller to perform these procedures. When a local setting is inaccessible, it indicates that a GPO currently controls that setting. -## To configure a setting using the Local Security Policy console +## To configure a setting using the Local Security Policy console -1. To open Local Security Policy, on the **Start** screen, type **secpol.msc**, and then press ENTER. -2. Under **Security Settings** of the console tree, do one of the following: +1. To open Local Security Policy, on the **Start** screen, type **secpol.msc**, and then press ENTER. +1. Under **Security Settings** of the console tree, do one of the following: + - Select **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. + - Select **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. +1. When you find the policy setting in the details pane, double-click the security policy that you want to modify. +1. Modify the security policy setting, and then select **OK**. - - Click **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. - - Click **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. +> [!NOTE] +> +> - Some security policy settings require that the device be restarted before the setting takes effect. +> - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. -3. When you find the policy setting in the details pane, double-click the security policy that you want to modify. -4. Modify the security policy setting, and then click **OK**. - - > [!NOTE] - > - Some security policy settings require that the device be restarted before the setting takes effect. - > - Any change to the user rights assignment for an account becomes effective the next time the owner of the account logs on. - -## To configure a security policy setting using the Local Group Policy Editor console +## To configure a security policy setting using the Local Group Policy Editor console You must have the appropriate permissions to install and use the Microsoft Management Console (MMC), and to update a Group Policy Object (GPO) on the domain controller to perform these procedures. -1. Open the Local Group Policy Editor (gpedit.msc). -2. In the console tree, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. -3. Do one of the following: +1. Open the Local Group Policy Editor (gpedit.msc). +1. In the console tree, click **Computer Configuration**, select **Windows Settings**, and then select **Security Settings**. +1. Do one of the following: + - Select **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. + - Select **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. +1. In the details pane, double-click the security policy setting that you want to modify. - - Click **Account Policies** to edit the **Password Policy** or **Account Lockout Policy**. - - Click **Local Policies** to edit an **Audit Policy**, a **User Rights Assignment**, or **Security Options**. + > [!NOTE] + > If this security policy has not yet been defined, select the **Define these policy settings** check box. -4. In the details pane, double-click the security policy setting that you want to modify. - - > [!NOTE] - > If this security policy has not yet been defined, select the **Define these policy settings** check box. - -5. Modify the security policy setting, and then click **OK**. +1. Modify the security policy setting, and then select **OK**. > [!NOTE] > If you want to configure security settings for many devices on your network, you can use the Group Policy Management Console. - -## To configure a setting for a domain controller + +## To configure a setting for a domain controller The following procedure describes how to configure a security policy setting for only a domain controller (from the domain controller). -1. To open the domain controller security policy, in the console tree, locate *GroupPolicyObject \[ComputerName\]* Policy, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. -2. Do one of the following: +1. To open the domain controller security policy, in the console tree, locate *GroupPolicyObject \[ComputerName\]* Policy, click **Computer Configuration**, click **Windows Settings**, and then click **Security Settings**. +1. Do one of the following: - - Double-click **Account Policies** to edit the **Password Policy**, **Account Lockout Policy**, or **Kerberos Policy**. - - Click **Local Policies** to edit the **Audit Policy**, a **User Rights Assignment**, or **Security Options**. + - Double-click **Account Policies** to edit the **Password Policy**, **Account Lockout Policy**, or **Kerberos Policy**. + - Select **Local Policies** to edit the **Audit Policy**, a **User Rights Assignment**, or **Security Options**. -3. In the details pane, double-click the security policy that you want to modify. +1. In the details pane, double-click the security policy that you want to modify. - > [!NOTE] - > If this security policy has not yet been defined, select the **Define these policy settings** check box. - -4. Modify the security policy setting, and then click **OK**. + > [!NOTE] + > If this security policy has not yet been defined, select the **Define these policy settings** check box. + +1. Modify the security policy setting, and then select **OK**. > [!IMPORTANT] -> - Always test a newly created policy in a test organizational unit before you apply it to your network. -> - When you change a security setting through a GPO and click **OK**, that setting will take effect the next time you refresh the settings. - -## Related topics +> +> - Always test a newly created policy in a test organizational unit before you apply it to your network. +> - When you change a security setting through a GPO and click **OK**, that setting will take effect the next time you refresh the settings. + +## Related articles - [Security policy settings reference](security-policy-settings-reference.md) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index a8b2882f5b..5829e660c8 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -1,30 +1,22 @@ --- -title: Password must meet complexity requirements +title: Password must meet complexity requirements description: Describes the best practices, location, values, and security considerations for the Password must meet complexity requirements security policy setting. -ms.assetid: 94482ae3-9dda-42df-9782-2f66196e6afe -ms.reviewer: ms.author: vinpa -ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -audience: ITPro -ms.collection: - - highpri - - tier3 +ms.collection: + - highpri + - tier3 ms.topic: conceptual -ms.technology: itpro-security -ms.date: 12/31/2017 +ms.date: 06/07/2023 --- # Password must meet complexity requirements **Applies to** -- Windows 11 -- Windows 10 +- Windows 11 +- Windows 10 Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting. @@ -32,41 +24,39 @@ Describes the best practices, location, values, and security considerations for The **Passwords must meet complexity requirements** policy setting determines whether passwords must meet a series of strong-password guidelines. When enabled, this setting requires passwords to meet the following requirements: -1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Neither of these checks is case-sensitive. +1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Neither of these checks is case-sensitive. - The samAccountName is checked in its entirety only to determine whether it's part of the password. If the samAccountName is fewer than three characters long, this check is skipped. - The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens aren't checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it's ignored. So, this user couldn't have a password that included either "erin" or "hagens" as a substring anywhere in the password. + The samAccountName is checked in its entirety only to determine whether it's part of the password. If the samAccountName is fewer than three characters long, this check is skipped. The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens aren't checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it's ignored. So, this user couldn't have a password that included either "erin" or "hagens" as a substring anywhere in the password. -2. The password contains characters from three of the following categories: +2. The password contains characters from three of the following categories: - - Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters) - - Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters) - - Base 10 digits (0 through 9) - - Non-alphanumeric characters (special characters): - (~!@#$%^&*_-+=`|\\(){}\[\]:;"'<>,.?/) - Currency symbols such as the Euro or British Pound aren't counted as special characters for this policy setting. - - Any Unicode character that's categorized as an alphabetic character but isn't uppercase or lowercase. This group includes Unicode characters from Asian languages. + - Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters) + - Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters) + - Base 10 digits (0 through 9) + - Non-alphanumeric characters (special characters): ``(~!@#$%^&*_-+=`|\\(){}\[\]:;"'<>,.?/)`` + Currency symbols such as the Euro or British Pound aren't counted as special characters for this policy setting. + - Any Unicode character that's categorized as an alphabetic character but isn't uppercase or lowercase. This group includes Unicode characters from Asian languages. Complexity requirements are enforced when passwords are changed or created. -The rules that are included in the Windows Server password complexity requirements are part of Passfilt.dll, and they can't be directly modified. +The rules that are included in the Windows Server password complexity requirements are part of `Passfilt.dll`, and they can't be directly modified. When enabled, the default Passfilt.dll may cause some more Help Desk calls for locked-out accounts, because users are used to passwords that contain only characters that are in the alphabet. But this policy setting is liberal enough that all users should get used to it. -Other settings that can be included in a custom Passfilt.dll are the use of non–upper-row characters. To type upper-row characters, you hold the SHIFT key and press one of any of the keys on the number row of the keyboard (from 1 through 9 and 0). +Other settings that can be included in a custom `Passfilt.dll` are the use of non-upper-row characters. To type upper-row characters, you hold the SHIFT key and press one of any of the keys on the number row of the keyboard (from 1 through 9 and 0). ### Possible values -- Enabled -- Disabled -- Not defined +- Enabled +- Disabled +- Not defined ### Best practices > [!TIP] > For the latest best practices, see [Password Guidance](https://www.microsoft.com/research/publication/password-guidance). -Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 159,238,157,238,528 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible. +Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 159,238,157,238,528 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible. The use of ALT key character combinations may greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements might result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that don't add more complexity to the password.) @@ -74,21 +64,21 @@ Short passwords that contain only alphanumeric characters are easy to compromise ### Location -**Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** +`Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy` ### Default values The following table lists the actual and effective default policy values. Default values are also listed on the policy's property page. -| Server type or Group Policy Object (GPO) | Default value | -|---|---| -| Default domain policy | Enabled | -| Default domain controller policy | Enabled | -| Stand-alone server default settings | Disabled | -| Domain controller effective default settings | Enabled | -| Member server effective default settings | Enabled| -| Effective GPO default settings on client computers | Disabled | - +| Server type or Group Policy Object (GPO) | Default value | +|----------------------------------------------------|---------------| +| Default domain policy | Enabled | +| Default domain controller policy | Enabled | +| Stand-alone server default settings | Disabled | +| Domain controller effective default settings | Enabled | +| Member server effective default settings | Enabled | +| Effective GPO default settings on client computers | Disabled | + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. @@ -107,9 +97,9 @@ When combined with a [Minimum password length](minimum-password-length.md) of 8, If the default configuration for password complexity is kept, more Help Desk calls for locked-out accounts could occur because users might not be used to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to follow the complexity requirement with minimal difficulty. -If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those symbols that require you to press and hold the SHIFT key and then press any of the keys on the number row of the keyboard, from 1 through 9 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password doesn't contain common dictionary words or fragments. +If your organization has more stringent security requirements, you can create a custom version of the `Passfilt.dll` file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those symbols that require you to press and hold the SHIFT key and then press any of the keys on the number row of the keyboard, from 1 through 9 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password doesn't contain common dictionary words or fragments. -The use of ALT key character combinations may greatly enhance the complexity of a password. However, such stringent password requirements might result in more Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that wouldn't add more complexity to the password.) +The use of ALT key character combinations may greatly enhance the complexity of a password. However, such stringent password requirements might result in more Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128-0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that wouldn't add more complexity to the password.) ## Related articles From 29f96bd6cad228094c64bf0f377470c72b8fca77 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 7 Jun 2023 08:47:54 -0700 Subject: [PATCH 18/30] Fixed links --- .../wdac-wizard-create-base-policy.md | 28 +++++++++---------- .../wdac-wizard-create-supplemental-policy.md | 27 ++++++++---------- 2 files changed, 25 insertions(+), 30 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 73c7ef9d1e..de1fe5bc9a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -14,7 +14,7 @@ ms.reviewer: jsuther1974 ms.author: vinpa manager: aaroncz ms.topic: conceptual -ms.date: 10/14/2020 +ms.date: 06/07/2023 ms.technology: itpro-security --- @@ -29,15 +29,13 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -When creating policies for use with Windows Defender Application Control (WDAC), it's recommended to start with a template policy, and then add or remove rules to suit your application control scenario. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. - +When creating policies for use with Windows Defender Application Control (WDAC), it's recommended to start with a template policy, and then add or remove rules to suit your application control scenario. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. ## Template Base Policies Each of the template policies has a unique set of policy allowlist rules that will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy will have a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility. - -| Template Base Policy | Description | +| Template Base Policy | Description | |---------------------------------|-------------------------------------------------------------------| | **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    | | **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | @@ -45,7 +43,7 @@ Each of the template policies has a unique set of policy allowlist rules that wi *Italicized content denotes the changes in the current policy with respect to the policy prior.* -More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example Windows Defender Application Control base policies article](example-wdac-base-policies.md). +More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example Windows Defender Application Control base policies article](example-wdac-base-policies.md). ![Selecting a base template for the policy.](images/wdac-wizard-template-selection.png) @@ -53,11 +51,11 @@ Once the base template is selected, give the policy a name and choose where to s ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule will appear at the bottom of the page when the mouse hovers over the rule title. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule will appear at the bottom of the page when the mouse hovers over the rule title. ### Policy Rules Description -A description of each policy rule, beginning with the left-most column, is provided below. The [Policy rules article](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) provides a full description of each policy rule. +A description of each policy rule, beginning with the left-most column, is provided below. The [Policy rules article](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) provides a full description of each policy rule. | Rule option | Description | |------------ | ----------- | @@ -77,7 +75,7 @@ A description of each policy rule, beginning with the left-most column, is provi ### Advanced Policy Rules Description -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. | Rule option | Description | |------------ | ----------- | @@ -91,15 +89,15 @@ Selecting the **+ Advanced Options** label will show another column of policy ru ![Rule options UI for Windows Allowed mode.](images/wdac-wizard-rule-options-UI.png) > [!NOTE] -> We recommend that you **enable Audit Mode** initially because it allows you to test new Windows Defender Application Control policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. +> We recommend that you **enable Audit Mode** initially because it allows you to test new Windows Defender Application Control policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. ## Creating custom file rules -[File rules](select-types-of-rules-to-create.md#windows-defender-application-control-file-rule-levels) in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: +[File rules](select-types-of-rules-to-create.md#windows-defender-application-control-file-rule-levels) in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | @@ -113,11 +111,11 @@ The Publisher file rule type uses properties in the code signing certificate cha ### Filepath Rules -Filepath rules don't provide the same security guarantees that explicit signer rules do, as they're based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. +Filepath rules don't provide the same security guarantees that explicit signer rules do, as they're based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -135,7 +133,7 @@ Lastly, the Wizard supports creating file rules using the hash of the file. Alth #### Deleting Signing Rules -The policy signing rules list table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You'll be prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The policy signing rules list table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You'll be prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 53a8d5c954..28e3589713 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -14,7 +14,7 @@ ms.reviewer: isbrahm ms.author: vinpa manager: aaroncz ms.topic: conceptual -ms.date: 10/14/2020 +ms.date: 06/07/2023 ms.technology: itpro-security --- @@ -35,7 +35,7 @@ Prerequisite information about application control can be accessed through the [ ## Expanding a Base Policy -Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. +Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. ![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) @@ -49,14 +49,13 @@ Policies that can't be supplemented, for instance, a supplemental policy, will b ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules must be inherited from the base policy. The Wizard will automatically parse the base policy and set the required supplemental policy rules to match the base policy rules. Inherited policy rules will be grayed out and won't be modifiable in the user interface. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules must be inherited from the base policy. The Wizard will automatically parse the base policy and set the required supplemental policy rules to match the base policy rules. Inherited policy rules will be grayed out and won't be modifiable in the user interface. -A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. +A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. ### Configurable Supplemental Policy Rules Description -There are only three policy rules that can be configured by the supplemental policy. A description of each policy rule, beginning with the left-most column, is provided below. Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. - +There are only three policy rules that can be configured by the supplemental policy. A description of each policy rule, beginning with the left-most column, is provided below. Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. | Rule option | Description | |------------ | ----------- | @@ -68,11 +67,11 @@ There are only three policy rules that can be configured by the supplemental pol ## Creating custom file rules -File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: +File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | @@ -86,11 +85,11 @@ The Publisher file rule type uses properties in the code signing certificate cha ### Filepath Rules -Filepath rules don't provide the same security guarantees that explicit signer rules do, as they're based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. +Filepath rules don't provide the same security guarantees that explicit signer rules do, as they're based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -99,17 +98,15 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Product name** | Specifies the name of the product with which the binary ships. | | **Internal name** | Specifies the internal name of the binary. | - ![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules -Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule can't be created using the specified file rule level. +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule can't be created using the specified file rule level. - -#### Deleting Signing Rules +#### Deleting Signing Rules -The table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you'll be prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you'll be prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next From 2f7bdaadb00702cc07cb3b8f7e6cbb5aa822b2a1 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 7 Jun 2023 09:10:20 -0700 Subject: [PATCH 19/30] Fixed passive voice issues --- .../wdac-wizard-create-base-policy.md | 36 +++++++++---------- .../wdac-wizard-create-supplemental-policy.md | 28 +++++++-------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index de1fe5bc9a..6913539635 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -33,13 +33,13 @@ When creating policies for use with Windows Defender Application Control (WDAC), ## Template Base Policies -Each of the template policies has a unique set of policy allowlist rules that will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy will have a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility. +Each of the template policies has a unique set of policy allowlist rules that affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy has a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility. | Template Base Policy | Description | |---------------------------------|-------------------------------------------------------------------| -| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    | -| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | -| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph.md)*
    | +| **Default Windows Mode** | Default Windows mode authorizes the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    | +| **Allow Microsoft Mode** | Allow mode authorizes the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | +| **Signed and Reputable Mode** | Signed and Reputable mode authorizes the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph.md)*
    | *Italicized content denotes the changes in the current policy with respect to the policy prior.* @@ -51,11 +51,11 @@ Once the base template is selected, give the policy a name and choose where to s ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule will appear at the bottom of the page when the mouse hovers over the rule title. +Upon page launch, policy rules are automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule appears at the bottom of the page when the mouse hovers over the rule title. ### Policy Rules Description -A description of each policy rule, beginning with the left-most column, is provided below. The [Policy rules article](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) provides a full description of each policy rule. +The following table has a description of each policy rule, beginning with the left-most column. The [Policy rules article](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) provides a fuller description of each policy rule. | Rule option | Description | |------------ | ----------- | @@ -75,16 +75,16 @@ A description of each policy rule, beginning with the left-most column, is provi ### Advanced Policy Rules Description -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. +Selecting the **+ Advanced Options** label shows another column of policy rules, advanced policy rules. The following table provides a description of each advanced policy rule. | Rule option | Description | |------------ | ----------- | -| **Boot Audit on Failure** | Used when the Windows Defender Application Control (WDAC) policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **Disable Flight Signing** | If enabled, WDAC policies won't trust flightroot-signed binaries. This option would be used in the scenario in which organizations only want to run released binaries, not flight/preview-signed builds. | -| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that's only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Boot Audit on Failure** | Used when the Windows Defender Application Control (WDAC) policy is in enforcement mode. When a driver fails during startup, the WDAC policy is placed in audit mode so that Windows loads. Administrators can validate the reason for the failure in the CodeIntegrity event log. | +| **Disable Flight Signing** | If enabled, WDAC policies block flightroot-signed binaries. This option would be used in the scenario in which organizations only want to run released binaries, not flight/preview-signed builds. | +| **Disable Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. | | **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries (DLLs). | -| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| -| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later, or Windows 11 drivers will meet this requirement. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option causes WDAC to periodically revalidate the reputation for files authorized by the ISG.| +| **Require EV Signers** | This option isn't currently supported. | ![Rule options UI for Windows Allowed mode.](images/wdac-wizard-rule-options-UI.png) @@ -93,15 +93,15 @@ Selecting the **+ Advanced Options** label will show another column of policy ru ## Creating custom file rules -[File rules](select-types-of-rules-to-create.md#windows-defender-application-control-file-rule-levels) in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: +[File rules](select-types-of-rules-to-create.md#windows-defender-application-control-file-rule-levels) in an application control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting **+ Custom Rules** opens the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The following table shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | -| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate is affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example, a device driver corp, is affected. | | **File version** | SignedVersion | This rule is a combination of PCACertificate, publisher, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | @@ -115,7 +115,7 @@ Filepath rules don't provide the same security guarantees that explicit signer r ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The following table describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -129,11 +129,11 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c ### File Hash Rules -Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product version's hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule can't be created using the specified file rule level. +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product version's hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard uses file hash as the fallback in case a file rule can't be created using the specified file rule level. #### Deleting Signing Rules -The policy signing rules list table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You'll be prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The policy signing rules list table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You're then prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 28e3589713..a37f25ff34 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -29,53 +29,53 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When supplemental policies are being used, applications allowed by the base or its supplemental policy/policies will be allowed to execute. +Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When supplemental policies are used, applications allowed by the base or any of its supplemental policies are allowed to run. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. ## Expanding a Base Policy -Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. +Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard verifies if the base policy allows supplementals and shows the following confirmation. ![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) -If the base policy isn't configured for supplemental policies, the Wizard will attempt to convert the policy to one that can be supplemented. Once successful, the Wizard will show a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. +If the base policy isn't configured for supplemental policies, the Wizard attempts to convert the policy to one that can be supplemented. Once successful, the Wizard shows a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. ![Wizard confirms modification of base policy.](images/wdac-wizard-confirm-base-policy-modification.png) -Policies that can't be supplemented, for instance, a supplemental policy, will be detected by the Wizard and will show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). +Policies that can't be supplemented, for instance another supplemental policy, are detected by the Wizard and show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). ![Wizard detects a bad base policy.](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules must be inherited from the base policy. The Wizard will automatically parse the base policy and set the required supplemental policy rules to match the base policy rules. Inherited policy rules will be grayed out and won't be modifiable in the user interface. +Upon page launch, policy rules are automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules are inherited from the base policy. The Wizard automatically parses the base policy and sets the required supplemental policy rules to match the base policy rules. Inherited policy rules are grayed out and aren't modifiable in the user interface. -A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. +A short description of the rule is shown at the bottom of the page when the cursor is placed on the rule title. ### Configurable Supplemental Policy Rules Description -There are only three policy rules that can be configured by the supplemental policy. A description of each policy rule, beginning with the left-most column, is provided below. Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. +Supplemental policies can only configure three policy rules. The following table describes each policy rule, beginning with the left-most column. Selecting the **+ Advanced Options** label shows another column of policy rules, the advanced policy rules. | Rule option | Description | |------------ | ----------- | | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Configuration Manager, that has been defined as a managed installer. | -| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Disable Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. | ![Rule options UI for Windows Allowed mode.](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules -File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: +File rules in an application control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting **+ Custom Rules** opens the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The following table shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | -| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate is affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example, a device driver publisher, is affected. | | **File version** | SignedVersion | This rule is a combination of the PCACertificate and Publisher rule, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | @@ -89,7 +89,7 @@ Filepath rules don't provide the same security guarantees that explicit signer r ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The following table describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -102,11 +102,11 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c ### File Hash Rules -Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule can't be created using the specified file rule level. +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard uses file hash as the fallback in case a file rule can't be created using the specified file rule level. #### Deleting Signing Rules -The table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you'll be prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You're again prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next From fb6a8ee415538c8ea78da7d7fcc55406434a2a21 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 12:15:26 -0400 Subject: [PATCH 20/30] Update wdac-wizard-create-supplemental-policy.md Improve acrolinx scores --- .../wdac-wizard-create-supplemental-policy.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index a37f25ff34..dd7f7465ba 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -29,7 +29,7 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When supplemental policies are used, applications allowed by the base or any of its supplemental policies are allowed to run. +Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When supplemental policies are being used, applications allowed by the base or its supplemental policy/policies are allowed to execute. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. @@ -39,43 +39,43 @@ Once the Supplemental Policy type is chosen on the New Policy page, policy name ![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) -If the base policy isn't configured for supplemental policies, the Wizard attempts to convert the policy to one that can be supplemented. Once successful, the Wizard shows a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. +If the base policy isn't configured for supplemental policies, the Wizard attempts to convert the policy to one that can be supplemented. Once successful, the Wizard shows a dialog demonstrating that the addition of the Allow Supplemental Policy rule is completed. ![Wizard confirms modification of base policy.](images/wdac-wizard-confirm-base-policy-modification.png) -Policies that can't be supplemented, for instance another supplemental policy, are detected by the Wizard and show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). +Policies that can't be supplemented, for instance, a supplemental policy, are detected by the Wizard and show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). ![Wizard detects a bad base policy.](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules -Upon page launch, policy rules are automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules are inherited from the base policy. The Wizard automatically parses the base policy and sets the required supplemental policy rules to match the base policy rules. Inherited policy rules are grayed out and aren't modifiable in the user interface. +Upon page launch, policy rules are automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules must be inherited from the base policy. The Wizard automatically parses the base policy and sets the required supplemental policy rules to match the base policy rules. Inherited policy rules are grayed out and can't be modified in the user interface. -A short description of the rule is shown at the bottom of the page when the cursor is placed on the rule title. +A short description of the rule is displayed at the bottom of the page when the cursor is placed on the rule title. ### Configurable Supplemental Policy Rules Description -Supplemental policies can only configure three policy rules. The following table describes each policy rule, beginning with the left-most column. Selecting the **+ Advanced Options** label shows another column of policy rules, the advanced policy rules. +There are only three policy rules that can be configured by the supplemental policy. A description of each policy rule, beginning with the left-most column, is provided below. Selecting the **+ Advanced Options** label shows another column of policy rules; advanced policy rules. | Rule option | Description | |------------ | ----------- | -| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | -| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Configuration Manager, that has been defined as a managed installer. | -| **Disable Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. | +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft's Intelligent Security Graph (ISG). | +| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution that have been defined as a managed installer, such as Microsoft Configuration Manager. | +| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that's only writable by an administrator) for any FileRule that allows a file based on FilePath. | ![Rule options UI for Windows Allowed mode.](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules -File rules in an application control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting **+ Custom Rules** opens the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: +File rules in an application control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** opens the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The following table shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | -| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate is affected. | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate are affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example, a device driver publisher, is affected. | | **File version** | SignedVersion | This rule is a combination of the PCACertificate and Publisher rule, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | @@ -89,7 +89,7 @@ Filepath rules don't provide the same security guarantees that explicit signer r ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The following table describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -105,8 +105,8 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard uses file hash as the fallback in case a file rule can't be created using the specified file rule level. #### Deleting Signing Rules - -The table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You're again prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. + +The table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table to see the confirmation dialog. Select `Yes` to remove the rule from the policy and the rules table. ## Up next From 8fc01b6aa4466614aa1f32f33b98567c1f7af5d0 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 12:23:20 -0400 Subject: [PATCH 21/30] Update wdac-wizard-create-supplemental-policy.md Revert to previous commit --- .../wdac-wizard-create-supplemental-policy.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index dd7f7465ba..a37f25ff34 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -29,7 +29,7 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When supplemental policies are being used, applications allowed by the base or its supplemental policy/policies are allowed to execute. +Beginning in Windows 10 version 1903, Windows Defender Application Control (WDAC) supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When supplemental policies are used, applications allowed by the base or any of its supplemental policies are allowed to run. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. @@ -39,43 +39,43 @@ Once the Supplemental Policy type is chosen on the New Policy page, policy name ![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) -If the base policy isn't configured for supplemental policies, the Wizard attempts to convert the policy to one that can be supplemented. Once successful, the Wizard shows a dialog demonstrating that the addition of the Allow Supplemental Policy rule is completed. +If the base policy isn't configured for supplemental policies, the Wizard attempts to convert the policy to one that can be supplemented. Once successful, the Wizard shows a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. ![Wizard confirms modification of base policy.](images/wdac-wizard-confirm-base-policy-modification.png) -Policies that can't be supplemented, for instance, a supplemental policy, are detected by the Wizard and show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). +Policies that can't be supplemented, for instance another supplemental policy, are detected by the Wizard and show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). ![Wizard detects a bad base policy.](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules -Upon page launch, policy rules are automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules must be inherited from the base policy. The Wizard automatically parses the base policy and sets the required supplemental policy rules to match the base policy rules. Inherited policy rules are grayed out and can't be modified in the user interface. +Upon page launch, policy rules are automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules are inherited from the base policy. The Wizard automatically parses the base policy and sets the required supplemental policy rules to match the base policy rules. Inherited policy rules are grayed out and aren't modifiable in the user interface. -A short description of the rule is displayed at the bottom of the page when the cursor is placed on the rule title. +A short description of the rule is shown at the bottom of the page when the cursor is placed on the rule title. ### Configurable Supplemental Policy Rules Description -There are only three policy rules that can be configured by the supplemental policy. A description of each policy rule, beginning with the left-most column, is provided below. Selecting the **+ Advanced Options** label shows another column of policy rules; advanced policy rules. +Supplemental policies can only configure three policy rules. The following table describes each policy rule, beginning with the left-most column. Selecting the **+ Advanced Options** label shows another column of policy rules, the advanced policy rules. | Rule option | Description | |------------ | ----------- | -| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft's Intelligent Security Graph (ISG). | -| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution that have been defined as a managed installer, such as Microsoft Configuration Manager. | -| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that's only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | +| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Configuration Manager, that has been defined as a managed installer. | +| **Disable Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. | ![Rule options UI for Windows Allowed mode.](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules -File rules in an application control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** opens the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: +File rules in an application control policy specify the level at which applications are identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting **+ Custom Rules** opens the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The following table shows the relationship between the slider placement, the corresponding Windows Defender Application Control (WDAC) rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | -| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate are affected. | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate is affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example, a device driver publisher, is affected. | | **File version** | SignedVersion | This rule is a combination of the PCACertificate and Publisher rule, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | @@ -89,7 +89,7 @@ Filepath rules don't provide the same security guarantees that explicit signer r ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The following table describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -105,8 +105,8 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard uses file hash as the fallback in case a file rule can't be created using the specified file rule level. #### Deleting Signing Rules - -The table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table to see the confirmation dialog. Select `Yes` to remove the rule from the policy and the rules table. + +The table on the left of the page documents the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. You're again prompted for another confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next From 1e1275bd607c38aada63f3830dad3119e3a44e33 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 7 Jun 2023 15:22:50 -0400 Subject: [PATCH 22/30] Fix "blocking" issues --- windows/security/includes/sections/identity.md | 2 +- windows/security/introduction/index.md | 2 +- ..._process(en-us,MSDN.10).png => boot_process.png} | Bin ...re_boot(en-us,MSDN.10).png => measured_boot.png} | Bin .../secure-the-windows-10-boot-process.md | 4 ++-- ...ings-windows-defender-security-center-areas.png} | Bin .../wdsc-account-protection.md | 2 +- .../wdsc-device-performance-health.md | 2 +- .../wdsc-device-security.md | 2 +- .../wdsc-family-options.md | 2 +- .../wdsc-firewall-network-protection.md | 2 +- .../wdsc-virus-threat-protection.md | 2 +- .../security/zero-trust-windows-device-health.md | 2 +- 13 files changed, 11 insertions(+), 11 deletions(-) rename windows/security/operating-system-security/system-security/images/{dn168167.boot_process(en-us,MSDN.10).png => boot_process.png} (100%) rename windows/security/operating-system-security/system-security/images/{dn168167.measure_boot(en-us,MSDN.10).png => measured_boot.png} (100%) rename windows/security/operating-system-security/system-security/windows-defender-security-center/images/{settings-windows-defender-security-center-areas.PNG => settings-windows-defender-security-center-areas.png} (100%) diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md index 61ad10748b..b31aaf1ca9 100644 --- a/windows/security/includes/sections/identity.md +++ b/windows/security/includes/sections/identity.md @@ -22,7 +22,7 @@ ms.topic: include |:---|:---| | **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Azure Active Directory-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it. | | **[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | -| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take pre-emptive action before their password is used against them or their organization. | +| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take preemptive action before their password is used against them or their organization. | | **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows ensures that shared resources are available to users and groups other than the resource's owner and are protected from unauthorized use. IT administrators can manage users', groups', and computers' access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions.

    Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | | **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | Enabled by default in Windows 11 Enterprise, Windows Credential Guard uses hardware-backed, Virtualization-based security (VBS) to protect against credential theft. With Windows Credential Guard, the Local Security Authority (LSA) stores and protects secrets in an isolated environment that isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.

    By protecting the LSA process with Virtualization-based security, Windows Credential Guard shields systems from credential theft attack techniques like pass-the-hash or pass-the-ticket. It also helps prevent malware from accessing system secrets even if the process is running with admin privileges. | | **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | Window Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that is requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.

    Administrator credentials are highly privileged and must be protected. When you use Windows Defender Remote Credential Guard to connect during Remote Desktop sessions, your credential and credential derivatives are never passed over the network to the target device. If the target device is compromised, your credentials aren't exposed. | diff --git a/windows/security/introduction/index.md b/windows/security/introduction/index.md index 10953d2fbe..2389e3b4da 100644 --- a/windows/security/introduction/index.md +++ b/windows/security/introduction/index.md @@ -34,7 +34,7 @@ Windows 11 is a natural evolution of its predecessor, Windows 10. We have collab With hardware-based isolation security that begins at the chip, Windows 11 stores sensitive data behind other barriers separated from the operating system. As a result, information including encryption keys and user credentials are protected from unauthorized access and tampering. -In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](/windows/security/operating-system-security/system-security/trusted-boot.md) built-in and enabled by default to contain and limit malware exploits. +In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](../operating-system-security/system-security/trusted-boot.md) built-in and enabled by default to contain and limit malware exploits. ### Robust application security and privacy controls diff --git a/windows/security/operating-system-security/system-security/images/dn168167.boot_process(en-us,MSDN.10).png b/windows/security/operating-system-security/system-security/images/boot_process.png similarity index 100% rename from windows/security/operating-system-security/system-security/images/dn168167.boot_process(en-us,MSDN.10).png rename to windows/security/operating-system-security/system-security/images/boot_process.png diff --git a/windows/security/operating-system-security/system-security/images/dn168167.measure_boot(en-us,MSDN.10).png b/windows/security/operating-system-security/system-security/images/measured_boot.png similarity index 100% rename from windows/security/operating-system-security/system-security/images/dn168167.measure_boot(en-us,MSDN.10).png rename to windows/security/operating-system-security/system-security/images/measured_boot.png diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index f8d2fd035d..3b84d75971 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -42,7 +42,7 @@ Windows supports four features to help prevent rootkits and bootkits from loadin Figure 1 shows the Windows startup process. -![Windows startup process.](./images/dn168167.boot_process(en-us,MSDN.10).png) +![Windows startup process.](./images/boot_process.png) *Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage*: @@ -117,7 +117,7 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. -![Measured Boot and remote attestation process.](./images/dn168167.measure_boot(en-us,MSDN.10).png) +![Measured Boot and remote attestation process.](./images/measured_boot.png) *Figure 2. Measured Boot proves the PC's health to a remote server*: diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.png similarity index 100% rename from windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.png diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md index f7347a47de..86a18cc532 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md @@ -34,4 +34,4 @@ You can only configure these settings by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md index 788b0eb298..f3c57f4410 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md @@ -32,4 +32,4 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md index d8c7dc4704..35915c9351 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md @@ -27,7 +27,7 @@ You can choose to hide the entire section by using Group Policy. The section won > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Disable the Clear TPM button diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md index 744a0a293c..df1907c2a3 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md @@ -32,4 +32,4 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md index 734193578c..0d538dcab3 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -29,4 +29,4 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md index 852c8fc260..f17c9907ba 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -40,7 +40,7 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Hide the Ransomware protection area diff --git a/windows/security/zero-trust-windows-device-health.md b/windows/security/zero-trust-windows-device-health.md index 248d3513f5..83f888b82d 100644 --- a/windows/security/zero-trust-windows-device-health.md +++ b/windows/security/zero-trust-windows-device-health.md @@ -42,7 +42,7 @@ Attestation helps verify the identity and status of essential components and tha These determinations are made with the help of a secure root of trust using the Trusted Platform Module (TPM). Devices can attest that the TPM is enabled, and that the device hasn't been tampered with. -Windows includes many security features to help protect users from malware and attacks. However, trusting the Windows security components can only be achieved if the platform boots as expected and wasn't tampered with. Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, Early-launch antimalware (ELAM), Dynamic Root of Trust for Measurement (DRTM), Trusted Boot, and other low-level hardware and firmware security features. When you power on your PC until your anti-malware starts, Windows is backed with the appropriate hardware configuration to help keep you safe. [Measured and Trusted boot](/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md), implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to a security coprocessor (TPM) that acts as the Root of Trust. Remote Attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper resilient report. Remote attestation is the trusted auditor of your system's boot, allowing specific entities to trust the device. +Windows includes many security features to help protect users from malware and attacks. However, trusting the Windows security components can only be achieved if the platform boots as expected and wasn't tampered with. Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, Early-launch antimalware (ELAM), Dynamic Root of Trust for Measurement (DRTM), Trusted Boot, and other low-level hardware and firmware security features. When you power on your PC until your anti-malware starts, Windows is backed with the appropriate hardware configuration to help keep you safe. [Measured and Trusted boot](operating-system-security/system-security/secure-the-windows-10-boot-process.md), implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to a security coprocessor (TPM) that acts as the Root of Trust. Remote Attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper resilient report. Remote attestation is the trusted auditor of your system's boot, allowing specific entities to trust the device. A summary of the steps involved in attestation and Zero Trust on the device side are as follows: From 0c1200032a1b478e4cdd09188591fb83dfea8c63 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Wed, 7 Jun 2023 15:28:47 -0500 Subject: [PATCH 23/30] Apply suggestions from code review Alt text edit. --- .../system-security/secure-the-windows-10-boot-process.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index 3b84d75971..1383de920b 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -42,7 +42,7 @@ Windows supports four features to help prevent rootkits and bootkits from loadin Figure 1 shows the Windows startup process. -![Windows startup process.](./images/boot_process.png) +![Screenshot that shows the Windows startup process.](./images/boot_process.png) *Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage*: @@ -117,7 +117,7 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. -![Measured Boot and remote attestation process.](./images/measured_boot.png) +![Screenshot that shows the Measured Boot and remote attestation process.](./images/measured_boot.png) *Figure 2. Measured Boot proves the PC's health to a remote server*: From 24ed137305b42c6f4fcadfc5a4e569dc99657c15 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Wed, 7 Jun 2023 15:34:04 -0500 Subject: [PATCH 24/30] Update windows/security/includes/sections/operating-system.md --- windows/security/includes/sections/operating-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/includes/sections/operating-system.md b/windows/security/includes/sections/operating-system.md index 32cc551e2d..9cc73a7b96 100644 --- a/windows/security/includes/sections/operating-system.md +++ b/windows/security/includes/sections/operating-system.md @@ -10,7 +10,7 @@ ms.topic: include | Security Measures | Features & Capabilities | |:---|:---| | **[Secure Boot and Trusted Boot](/windows/security/trusted-boot)** | Secure Boot and Trusted Boot help to prevent malware and corrupted components from loading when a device starts.

    Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure the system boots up safely and securely. | -| **[Measured boot](/windows/compatibility/measured-boot)** | Measured Boot measures all important code and configuration settings during the boot of Windows. This includes: the firmware, boot manager, hypervisor, kernel, secure kernel and operating system. Measured Boot stores the measurements in the TPM on the machine, and makes them available in a log that can be tested remotely to verify the boot state of the client.

    The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components that started before it. The antimalware software can use the log to determine whether components that ran before it are trustworthy, or if they are infected with malware. The antimalware software on the local machine can send the log to a remote sever for evaluation. The remote server may initiate remediation actions, either by interacting with software on the client, or through out-of-band mechanisms, as appropriate. | +| **[Measured boot](/windows/compatibility/measured-boot)** | Measured Boot measures all important code and configuration settings during the boot of Windows. This includes: the firmware, boot manager, hypervisor, kernel, secure kernel and operating system. Measured Boot stores the measurements in the TPM on the machine, and makes them available in a log that can be tested remotely to verify the boot state of the client.

    The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components that started before it. The antimalware software can use the log to determine whether components that ran before it are trustworthy, or if they are infected with malware. The antimalware software on the local machine can send the log to a remote server for evaluation. The remote server may initiate remediation actions, either by interacting with software on the client, or through out-of-band mechanisms, as appropriate. | | **[Device health attestation service](/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters, to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. The determinations are made with data stored in the TPM, which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Intune reviews device health and connects this information with Azure Active Directory for conditional access. | ## Virus And Threat Protection From 23d3cfad085b751bc93fb1d987146ed779cc39fd Mon Sep 17 00:00:00 2001 From: FernandoVSantos <135148766+FernandoVSantos@users.noreply.github.com> Date: Wed, 7 Jun 2023 15:31:26 -0700 Subject: [PATCH 25/30] Learn Editor: Update windows-sandbox-configure-using-wsb-file.md --- .../windows-sandbox-configure-using-wsb-file.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index a0d3dc4bea..ddc72d42ee 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -156,14 +156,16 @@ Supported values: ### Protected client -Applies more security settings to the sandbox Remote Desktop client, decreasing its attack surface. +When Protected Mode is enabled, Sandbox adds a new layer of security boundary by running in an [AppContainer Isolation](/windows/win32/secauthz/appcontainer-isolation) execution environment. + +The AppContainer Isolation provides isolation of Credentil, Device, File, Network, Process, and Window. `value` Supported values: -- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. -- *Disable*: Runs the sandbox in standard mode without extra security mitigations. +- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the Sandbox runs in AppContainer Isolation. +- *Disable*: Runs the Sandbox in the standard mode without extra security mitigations. - *Default*: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode. > [!NOTE] @@ -190,7 +192,7 @@ Enables or disables sharing of the host clipboard with the sandbox. Supported values: - *Enable*: Enables sharing of the host clipboard with the sandbox. -- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted. +- - *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted. - *Default*: This value is the default value for clipboard redirection. Currently, copy/paste between the host and sandbox are permitted under *Default*. ### Memory in MB @@ -303,3 +305,4 @@ $SwapButtons::SwapMouseButton(!([System.Windows.Forms.SystemInformation]::MouseB ``` + From 4a9f1d63b9c904ecd68300a92214f38027c0cf07 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 8 Jun 2023 10:48:58 -0400 Subject: [PATCH 27/30] Update windows-sandbox-configure-using-wsb-file.md --- .../windows-sandbox-configure-using-wsb-file.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index ddc72d42ee..888bca39ce 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -156,9 +156,9 @@ Supported values: ### Protected client -When Protected Mode is enabled, Sandbox adds a new layer of security boundary by running in an [AppContainer Isolation](/windows/win32/secauthz/appcontainer-isolation) execution environment. +When Protected Client mode is enabled, Sandbox adds a new layer of security boundary by running inside an [AppContainer Isolation](/windows/win32/secauthz/appcontainer-isolation) execution environment. -The AppContainer Isolation provides isolation of Credentil, Device, File, Network, Process, and Window. +AppContainer Isolation provides Credential, Device, File, Network, Process, and Window isolation. `value` @@ -192,7 +192,7 @@ Enables or disables sharing of the host clipboard with the sandbox. Supported values: - *Enable*: Enables sharing of the host clipboard with the sandbox. -- - *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted. +- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted. - *Default*: This value is the default value for clipboard redirection. Currently, copy/paste between the host and sandbox are permitted under *Default*. ### Memory in MB @@ -305,4 +305,3 @@ $SwapButtons::SwapMouseButton(!([System.Windows.Forms.SystemInformation]::MouseB ``` - From 3f7d0e4ebdaa49ee6ab48c199bce0a76dbc2802e Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Thu, 8 Jun 2023 11:04:05 -0400 Subject: [PATCH 28/30] Remove dead links Remove dead links #Fixes https://github.com/MicrosoftDocs/windows-itpro-docs/issues/11561 --- .../planning/windows-to-go-overview.md | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index 29746b5180..4332f5785a 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -94,22 +94,6 @@ As of the date of publication, the following are the USB drives currently certif - IronKey Workspace W500 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w500.html](https://www.kingston.com/support/technical/products?model=dtws)) - IronKey Workspace W300 ([http://www.ironkey.com/windows-to-go-drives/ironkey-workspace-w300.html](https://www.kingston.com/support/technical/products?model=dtws)) - Kingston DataTraveler Workspace for Windows To Go ([http://www.kingston.com/wtg/](https://go.microsoft.com/fwlink/p/?LinkId=618719)) -- Spyrus Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - We recommend that you run the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Portable Workplace. - -- Spyrus Secure Portable Workplace ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - > [!IMPORTANT] - > You must use the Spyrus Deployment Suite for Windows To Go to provision the Spyrus Secure Portable Workplace. For more information about the Spyrus Deployment Suite for Windows To Go, see [http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720). - - -- Spyrus Worksafe ([http://www.spyruswtg.com/](https://go.microsoft.com/fwlink/p/?LinkId=618720)) - - > [!TIP] - > This device contains an embedded smart card. - - - Super Talent Express RC4 for Windows To Go @@ -168,4 +152,4 @@ In addition to the USB boot support in the BIOS, the Windows 10 image on your Wi [Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
    [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
    [Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
    -[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) \ No newline at end of file +[Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) From 1522b1304a12994b14900ca8d39ae88893c01322 Mon Sep 17 00:00:00 2001 From: Samuel Yun Date: Thu, 8 Jun 2023 10:11:51 -0700 Subject: [PATCH 29/30] Update eap-configuration.md Redirect to updated link --- windows/client-management/mdm/eap-configuration.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 9b4bb74c16..926d63ac80 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -145,7 +145,7 @@ EAP XML must be updated with relevant information for your environment. This tas - For Wi-Fi, look for the `` section of your current WLAN Profile XML. (This section is what you specify for the WLanXml node in the Wi-Fi CSP.) Within these tags, you'll find the complete EAP configuration. Replace the section under `` with your updated XML and update your Wi-Fi profile. You can refer to your MDM’s guidance on how to deploy a new Wi-Fi profile. - For VPN, EAP configuration is a separate field in the MDM configuration. Work with your MDM provider to identify and update the appropriate field. -For information about EAP settings, see . +For information about EAP settings, see [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For information about generating an EAP XML, see the EAP configuration article. @@ -297,7 +297,7 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Continue following the procedure in the EAP configuration article from step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] -> You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)) article. +> You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access) article. ## Related topics From 9b78f5711ca21cf415c221d084db5034d84c647a Mon Sep 17 00:00:00 2001 From: Samuel Yun Date: Thu, 8 Jun 2023 10:13:41 -0700 Subject: [PATCH 30/30] Update mdm-known-issues.md Redirect to updated link --- windows/client-management/mdm-known-issues.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 8c3dc27e89..63895b5917 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -68,7 +68,7 @@ EAP XML must be updated with relevant information for your environment. This tas - For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This detail is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags, you'll find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM's guidance on how to deploy a new Wi-Fi profile. - For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field. -For information about EAP Settings, see . +For information about EAP Settings, see [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). For information about generating an EAP XML, see [EAP configuration](mdm/eap-configuration.md). @@ -225,7 +225,7 @@ Alternatively you can use the following procedure to create an EAP Configuration 1. Continue following the procedure in [EAP configuration](mdm/eap-configuration.md) from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] -> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)). +> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) for network access](/windows-server/networking/technologies/extensible-authentication-protocol/network-access). ## MDM client will immediately check in with the MDM server after client renews WNS channel URI