diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md
index 36cb8e6e0f..bcab5ce598 100644
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@@ -7,12 +7,15 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/26/2017
+ms.date: 01/29/2018
---
# Defender CSP
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
The Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise.
The following image shows the Windows Defender configuration service provider in tree format.
@@ -310,6 +313,11 @@ Node that can be used to perform signature updates for Windows Defender.
Supported operations are Get and Execute.
+**OfflineScan**
+Added in Windows 10, next major update. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. This command causes the computer reboot and start in Windows Defender offline mode to begin the scan.
+
+Supported operations are Get and Execute.
+
## Related topics
diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md
index 126869323b..4077ab58af 100644
--- a/windows/client-management/mdm/defender-ddf.md
+++ b/windows/client-management/mdm/defender-ddf.md
@@ -7,12 +7,15 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 12/05/2017
+ms.date: 01/29/20178
---
# Defender DDF file
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
This topic shows the OMA DM device description framework (DDF) for the **Defender** configuration service provider. DDF files are used only with OMA DM provisioning XML.
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
@@ -22,648 +25,659 @@ The XML below is the current version for this CSP.
``` syntax
]>
+ "http://www.openmobilealliance.org/tech/DTD/DM_DDF-V1_2.dtd"
+ []>
- 1.2
-
+ 1.2
+
Defender
./Vendor/MSFT
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+ com.microsoft/1.1/MDM/Defender
+
- Detections
+ Detections
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+ ThreatId
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ThreatId
-
-
-
-
-
- Name
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- URL
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- Severity
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- Category
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- CurrentStatus
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- ExecutionStatus
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- InitialDetectionTime
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- LastThreatStatusChangeTime
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- NumberOfDetections
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
+ Name
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+ URL
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ Severity
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ Category
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ CurrentStatus
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ ExecutionStatus
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ InitialDetectionTime
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ LastThreatStatusChangeTime
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ NumberOfDetections
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
- Health
+ Health
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ComputerState
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
-
- ComputerState
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- DefenderEnabled
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- RtpEnabled
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- NisEnabled
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- QuickScanOverdue
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- FullScanOverdue
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- SignatureOutOfDate
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- RebootRequired
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- FullScanRequired
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- EngineVersion
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- SignatureVersion
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- DefenderVersion
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- QuickScanTime
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- FullScanTime
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- QuickScanSigVersion
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- FullScanSigVersion
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
+
+
+ DefenderEnabled
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ RtpEnabled
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ NisEnabled
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ QuickScanOverdue
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ FullScanOverdue
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ SignatureOutOfDate
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ RebootRequired
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ FullScanRequired
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ EngineVersion
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ SignatureVersion
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ DefenderVersion
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ QuickScanTime
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ FullScanTime
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ QuickScanSigVersion
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ FullScanSigVersion
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
- Scan
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
+ Scan
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
- UpdateSignature
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
+ UpdateSignature
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
-
+
+ OfflineScan
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
```
## Related topics
-[Defender configuration service provider](defender-csp.md)
-
-
-
-
-
-
-
-
-
-
+[Defender configuration service provider](defender-csp.md)
\ No newline at end of file
diff --git a/windows/client-management/mdm/images/provisioning-csp-defender.png b/windows/client-management/mdm/images/provisioning-csp-defender.png
index b3be3ba7f4..8d34e77eb9 100644
Binary files a/windows/client-management/mdm/images/provisioning-csp-defender.png and b/windows/client-management/mdm/images/provisioning-csp-defender.png differ
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index 71fbb6027f..2065aba9d1 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -1514,6 +1514,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
| [BitLocker CSP](bitlocker-csp.md) |
Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, next major update.
|
+
+| [Defender CSP](defender-csp.md) |
+Added new node (OfflineScan) in Windows 10, next major update.
+ |