mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 04:43:37 +00:00
Merge branch 'master' into MDBranchAdd20H2DownloadLink
This commit is contained in:
Thomas Raya
GitHub
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/21/2020
|
||||
ms.date: 11/03/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -461,11 +461,6 @@ Enables the IT admin to manage automatic update behavior to scan, download, and
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This option should be used only for systems under regulatory compliance, as you will not get security updates as well.
|
||||
|
||||
|
||||
If the policy is not configured, end-users get the default behavior (Auto install and restart).
|
||||
|
||||
<!--/Description-->
|
||||
@ -488,6 +483,11 @@ The following list shows the supported values:
|
||||
- 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only.
|
||||
- 5 – Turn off automatic updates.
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This option should be used only for systems under regulatory compliance, as you will not get security updates as well.
|
||||
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
itproauthor: jaimeo
|
||||
author: jaimeo
|
||||
ms.localizationprioauthor: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.audience: itpro
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
|
||||
@ -42,7 +42,7 @@ landingContent:
|
||||
links:
|
||||
- text: Configure Windows 10
|
||||
url: /windows/configuration/index
|
||||
- text: Accesasibility information for IT Pros
|
||||
- text: Accessibility information for IT Pros
|
||||
url: /windows/configuration/windows-10-accessibility-for-itpros
|
||||
- text: Configure access to Microsoft Store
|
||||
url: /windows/configuration/stop-employees-from-using-microsoft-store
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: #medium
|
||||
ms.localizationpriority: medium
|
||||
ms.author: v-maave
|
||||
author: martyav
|
||||
manager: dansimp
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Schedule regular quick and full scans with Microsoft Defender AV
|
||||
title: Schedule regular quick and full scans with Microsoft Defender Antivirus
|
||||
description: Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans
|
||||
keywords: quick scan, full scan, quick vs full, schedule scan, daily, weekly, time, scheduled, recurring, regular
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 10/26/2020
|
||||
ms.date: 11/02/2020
|
||||
ms.reviewer: pauhijbr
|
||||
manager: dansimp
|
||||
---
|
||||
@ -25,6 +25,7 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> By default, Microsoft Defender Antivirus checks for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) to override this default.
|
||||
|
||||
@ -44,7 +45,9 @@ This article describes how to configure scheduled scans with Group Policy, Power
|
||||
|
||||
5. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below.
|
||||
|
||||
6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
|
||||
6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration.
|
||||
|
||||
7. Click **OK**, and repeat for any other settings.
|
||||
|
||||
Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) topics.
|
||||
|
||||
@ -74,12 +77,13 @@ Scheduled scans will run at the day and time you specify. You can use Group Poli
|
||||
|
||||
### Use Group Policy to schedule scans
|
||||
|
||||
| Location | Setting | Description | Default setting (if not configured) |
|
||||
|Location | Setting | Description | Default setting (if not configured) |
|
||||
|:---|:---|:---|:---|
|
||||
|Scan | Specify the scan type to use for a scheduled scan | Quick scan |
|
||||
|Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never |
|
||||
| Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.). | 2 a.m. |
|
||||
| Root | Randomize scheduled task times |In Microsoft Defender Antivirus: Randomize the start time of the scan to any interval from 0 to 4 hours. <br>In FEP/SCEP: randomize to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments. | Enabled |
|
||||
|Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.). | 2 a.m. |
|
||||
|Root | Randomize scheduled task times |In Microsoft Defender Antivirus: Randomize the start time of the scan to any interval from 0 to 4 hours. <br>In FEP/SCEP: randomize to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments. | Enabled |
|
||||
|
||||
|
||||
### Use PowerShell cmdlets to schedule scans
|
||||
|
||||
@ -100,8 +104,10 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
```WMI
|
||||
SignatureFallbackOrder
|
||||
SignatureDefinitionUpdateFileSharesSouce
|
||||
ScanParameters
|
||||
ScanScheduleDay
|
||||
ScanScheduleTime
|
||||
RandomizeScheduleTaskTimes
|
||||
```
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
@ -138,8 +144,7 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
```WMI
|
||||
SignatureFallbackOrder
|
||||
SignatureDefinitionUpdateFileSharesSouce
|
||||
ScanOnlyIfIdleEnabled
|
||||
```
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
@ -173,8 +178,8 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
```WMI
|
||||
SignatureFallbackOrder
|
||||
SignatureDefinitionUpdateFileSharesSouce
|
||||
RemediationScheduleDay
|
||||
RemediationScheduleTime
|
||||
```
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
@ -190,7 +195,8 @@ You can enable a daily quick scan that can be run in addition to your other sche
|
||||
|
||||
### Use Group Policy to schedule daily scans
|
||||
|
||||
| Location | Setting | Description | Default setting (if not configured)|
|
||||
|
||||
|Location | Setting | Description | Default setting (if not configured) |
|
||||
|:---|:---|:---|:---|
|
||||
|Scan | Specify the interval to run quick scans per day | Specify how many hours should elapse before the next quick scan. For example, to run every two hours, enter **2**, for once a day, enter **24**. Enter **0** to never run a daily quick scan. | Never |
|
||||
|Scan | Specify the time for a daily quick scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.) | 2 a.m. |
|
||||
@ -210,8 +216,7 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
```WMI
|
||||
SignatureFallbackOrder
|
||||
SignatureDefinitionUpdateFileSharesSouce
|
||||
ScanScheduleQuickScanTime
|
||||
```
|
||||
|
||||
See the following for more information and allowed parameters:
|
||||
@ -224,9 +229,9 @@ You can force a scan to occur after every [protection update](manage-protection-
|
||||
|
||||
### Use Group Policy to schedule scans after protection updates
|
||||
|
||||
Location | Setting | Description | Default setting (if not configured)
|
||||
---|---|---|---
|
||||
Signature updates | Turn on scan after Security intelligence update | A scan will occur immediately after a new protection update is downloaded | Enabled
|
||||
|Location | Setting | Description | Default setting (if not configured)|
|
||||
|:---|:---|:---|:---|
|
||||
|Signature updates | Turn on scan after Security intelligence update | A scan will occur immediately after a new protection update is downloaded | Enabled |
|
||||
|
||||
## See also
|
||||
- [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 10/29/2020
|
||||
ms.date: 11/03/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -22,8 +22,8 @@ Answering frequently asked questions about Microsoft Defender Application Guard
|
||||
|
||||
## Frequently Asked Questions
|
||||
|
||||
### Can I enable Application Guard on machines equipped with 4 GB RAM?
|
||||
We recommend 8 GB RAM for optimal performance but you may use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration.
|
||||
### Can I enable Application Guard on machines equipped with 4-GB RAM?
|
||||
We recommend 8-GB RAM for optimal performance but you can use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration.
|
||||
|
||||
`HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount` (Default is four cores.)
|
||||
|
||||
@ -33,7 +33,7 @@ We recommend 8 GB RAM for optimal performance but you may use the following regi
|
||||
|
||||
### Can employees download documents from the Application Guard Edge session onto host devices?
|
||||
|
||||
In Windows 10 Enterprise edition 1803, users will be able to download documents from the isolated Application Guard container to the host PC. This capability is managed by policy.
|
||||
In Windows 10 Enterprise edition 1803, users are able to download documents from the isolated Application Guard container to the host PC. This capability is managed by policy.
|
||||
|
||||
In Windows 10 Enterprise edition 1709 or Windows 10 Professional edition 1803, it is not possible to download files from the isolated Application Guard container to the host PC. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device.
|
||||
|
||||
@ -71,7 +71,7 @@ The following Input Method Editors (IME) introduced in Windows 10, version 1903
|
||||
|
||||
### I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering?
|
||||
|
||||
This feature is currently experimental only and is not functional without an additional regkey provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, contact Microsoft and we’ll work with you to enable the feature.
|
||||
This feature is currently experimental only and is not functional without an additional registry key provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, contact Microsoft and we’ll work with you to enable the feature.
|
||||
|
||||
### What is the WDAGUtilityAccount local account?
|
||||
|
||||
@ -79,11 +79,11 @@ This account is part of Application Guard beginning with Windows 10, version 170
|
||||
|
||||
### How do I trust a subdomain in my site list?
|
||||
|
||||
To trust a subdomain, you must precede your domain with two dots, for example: `..contoso.com` will ensure `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted.
|
||||
To trust a subdomain, you must precede your domain with two dots, for example: `..contoso.com` ensures that `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted.
|
||||
|
||||
### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise?
|
||||
|
||||
When using Windows Pro or Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard).
|
||||
When using Windows Pro or Windows Enterprise, you have access to using Application Guard in Standalone Mode. However, when using Enterprise you have access to Application Guard in Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard).
|
||||
|
||||
### Is there a size limit to the domain lists that I need to configure?
|
||||
|
||||
@ -91,7 +91,7 @@ Yes, both the Enterprise Resource domains hosted in the cloud and the Domains ca
|
||||
|
||||
### Why does my encryption driver break Microsoft Defender Application Guard?
|
||||
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message ("0x80070013 ERROR_WRITE_PROTECT").
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (`0x80070013 ERROR_WRITE_PROTECT`).
|
||||
|
||||
### Why do the Network Isolation policies in Group Policy and CSP look different?
|
||||
|
||||
@ -101,17 +101,17 @@ Mandatory network isolation GP policy to deploy Application Guard: "DomainSubnet
|
||||
Mandatory network isolation CSP policy to deploy Application Guard: "EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)"
|
||||
For EnterpriseNetworkDomainNames, there is no mapped CSP policy.
|
||||
|
||||
Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message (`0x80070013 ERROR_WRITE_PROTECT`).
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (`0x80070013 ERROR_WRITE_PROTECT`).
|
||||
|
||||
### Why did Application Guard stop working after I turned off hyperthreading?
|
||||
|
||||
If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements.
|
||||
|
||||
### Why am I getting the error message ("ERROR_VIRTUAL_DISK_LIMITATION")?
|
||||
### Why am I getting the error message "ERROR_VIRTUAL_DISK_LIMITATION"?
|
||||
|
||||
Application Guard may not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume.
|
||||
Application Guard might not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume.
|
||||
|
||||
### Why am I getting the error message ("ERR_NAME_NOT_RESOLVED") after not being able to reach PAC file?
|
||||
### Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach PAC file?
|
||||
|
||||
This is a known issue. To mitigate this you need to create two firewall rules.
|
||||
For guidance on how to create a firewall rule by using group policy, see:
|
||||
@ -129,7 +129,7 @@ This is the same as the first rule, but scoped to local port 68.
|
||||
In the Microsoft Defender Firewall user interface go through the following steps:
|
||||
1. Right click on inbound rules, create a new rule.
|
||||
2. Choose **custom rule**.
|
||||
3. Program path: **%SystemRoot%\System32\svchost.exe**.
|
||||
3. Program path: `%SystemRoot%\System32\svchost.exe`.
|
||||
4. Protocol Type: UDP, Specific ports: 67, Remote port: any.
|
||||
5. Any IP addresses.
|
||||
6. Allow the connection.
|
||||
@ -139,23 +139,26 @@ In the Microsoft Defender Firewall user interface go through the following steps
|
||||
|
||||
### Why can I not launch Application Guard when Exploit Guard is enabled?
|
||||
|
||||
There is a known issue such that if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to Windows Security-> App and Browser control -> Exploit Protection Setting -> switch CFG to the “use default".
|
||||
There is a known issue such that if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to **Windows Security** > **App and Browser control** > **Exploit Protection Setting**, and then switch CFG to **use default**.
|
||||
|
||||
|
||||
### How can I have ICS in enabled state yet still use Application Guard?
|
||||
|
||||
This is a two-step process.
|
||||
ICS is enabled by default in Windows, and ICS must be enabled in order for Application Guard to function correctly. We do not recommend disabling ICS; however, you can disable ICS in part by using a Group Policy and editing registry keys.
|
||||
|
||||
Step 1:
|
||||
1. In the Group Policy setting called, *Prohibit use of Internet Connection Sharing on your DNS domain network*, set it to **Disabled**.
|
||||
|
||||
Enable Internet Connection sharing by changing the Group Policy setting *Prohibit use of Internet Connection Sharing on your DNS domain network*, which is part of the MS Security baseline from Enabled to Disabled.
|
||||
2. Disable IpNat.sys from ICS load as follows: <br/>
|
||||
`System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1`
|
||||
|
||||
Step 2:
|
||||
3. Configure ICS (SharedAccess) to enabled as follows: <br/>
|
||||
`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3`
|
||||
|
||||
1. Disable IpNat.sys from ICS load
|
||||
System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1
|
||||
2. Configure ICS (SharedAccess) to enabled
|
||||
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3
|
||||
3. Disabling IPNAT (Optional)
|
||||
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4
|
||||
4. Reboot.
|
||||
4. (This is optional) Disable IPNAT as follows: <br/>
|
||||
`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4`
|
||||
|
||||
5. Reboot the device.
|
||||
|
||||
## See also
|
||||
|
||||
[Configure Microsoft Defender Application Guard policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)
|
||||
@ -57,7 +57,7 @@ You can access Microsoft Defender ATP API with **Application Context** or **User
|
||||
- **User Context:** <br>
|
||||
Used to perform actions in the API on behalf of a user.
|
||||
|
||||
Steps that needs to be taken to access Microsoft Defender ATP API with application context:
|
||||
Steps that need to be taken to access Microsoft Defender ATP API with user context:
|
||||
1. Create AAD Native-Application.
|
||||
2. Assign the desired permission to the application, e.g 'Read Alerts', 'Isolate Machines' etc.
|
||||
3. Get token using the application with user credentials.
|
||||
|
||||
@ -51,8 +51,8 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr
|
||||
|
||||
Microsoft Defender Advanced Threat Protection, on Windows Server, requires one of the following licensing options:
|
||||
|
||||
- [Azure Security Center Standard plan](https://docs.microsoft.com/azure/security-center/security-center-pricing) (per node)
|
||||
- Microsoft Defender ATP for Servers (one per covered Server)
|
||||
- [Azure Security Center with Azure Defender enabled](https://docs.microsoft.com/azure/security-center/security-center-pricing)
|
||||
- Microsoft Defender ATP for Servers (one per covered server)
|
||||
|
||||
> [!NOTE]
|
||||
> Customers with a combined minimum of 50 licenses for one or more of the following may acquire Server SLs for Microsoft Defender Advanced Threat Protection for Servers (one per covered Server OSE): Microsoft Defender Advanced Threat Protection, Windows E5/A5, Microsoft 365 E5/A5 and Microsoft 365 E5 Security User SLs. This license applies to Microsoft Defender ATP for Linux.
|
||||
|
||||
@ -26,7 +26,7 @@ An overview of password policies for Windows and links to information for each p
|
||||
|
||||
In many operating systems, the most common method to authenticate a user's identity is to use a secret passphrase or password. A secure network environment requires all users to use strong passwords, which have at least eight characters and include a combination of letters, numbers, and symbols. These passwords help prevent the compromise of user accounts and administrative accounts by unauthorized users who use manual methods or automated tools to guess weak passwords. Strong passwords that are changed regularly reduce the likelihood of a successful password attack.
|
||||
|
||||
Introduced in Windows Server 2008 R2 and Windows Server 2008, Windows supports fine-grained password policies. This feature provides organizations with a way to define different password and account lockout policies for different sets of users in a domain. Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups.
|
||||
Introduced in Windows Server 2008 R2 and Windows Server 2008, Windows supports fine-grained password policies. This feature provides organizations with a way to define different password and account lockout policies for different sets of users in a domain. Fine-grained password policies apply only to user objects (or inetOrgPerson objects if they are used instead of user objects) and global security groups. For more details, see [AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770842(v=ws.10)).
|
||||
|
||||
To apply a fine-grained password policy to users of an OU, you can use a shadow group. A shadow group is a global security group that is logically mapped to an OU to enforce a fine-grained password policy. You add users of the OU as members of the newly created shadow group and then apply the fine-grained password policy to this shadow group. You can create additional shadow groups for other OUs as needed. If you move a user from one OU to another, you must update the membership of the corresponding shadow groups.
|
||||
|
||||
@ -38,7 +38,7 @@ You can configure the password policy settings in the following location by usin
|
||||
|
||||
**Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy**
|
||||
|
||||
If individual groups require distinct password policies, these groups should be separated into another domain or forest, based on additional requirements.
|
||||
This group policy is applied on the domain level. If individual groups require distinct password policies, consider using fine-grained password policies, as described above.
|
||||
|
||||
The following topics provide a discussion of password policy implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible vulnerabilities of each setting), countermeasures that you can take, and the potential impact for each setting.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.collection:
|
||||
ms.topic: article
|
||||
ms.localizationpriority:
|
||||
ms.localizationpriority: medium
|
||||
ms.date:
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
Reference in New Issue
Block a user