mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
Merge branch 'master' into MTE_premiereEOD
This commit is contained in:
Dolcita Montemayor
@ -29,7 +29,7 @@ The tools in the folder might vary depending on which edition of Windows you are
|
||||
|
||||
|
||||
|
||||
These tools were included in previous versions of Windows and the associated documentation for each tool should help you use these tools in Windows 10. The following list links to documentation for each tool.
|
||||
These tools were included in previous versions of Windows and the associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders.
|
||||
|
||||
|
||||
|
||||
@ -43,6 +43,8 @@ These tools were included in previous versions of Windows and the associated doc
|
||||
- [ODBC Data Sources]( https://go.microsoft.com/fwlink/p/?LinkId=708494)
|
||||
- [Performance Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708495)
|
||||
- [Print Management](https://go.microsoft.com/fwlink/p/?LinkId=708496)
|
||||
- [Recovery Drive](https://support.microsoft.com/help/4026852/windows-create-a-recovery-drive)
|
||||
- [Registry Editor](https://docs.microsoft.com/windows/win32/sysinfo/registry)
|
||||
- [Resource Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708497)
|
||||
- [Services](https://go.microsoft.com/fwlink/p/?LinkId=708498)
|
||||
- [System Configuration](https://go.microsoft.com/fwlink/p/?LinkId=708499)
|
||||
@ -60,7 +62,3 @@ These tools were included in previous versions of Windows and the associated doc
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@ The auto-enrollment relies on the presence of an MDM service and the Azure Activ
|
||||
|
||||
When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page.
|
||||
|
||||
In Windows 10, version 1709, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/).
|
||||
In Windows 10, version 1709 or later, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/)
|
||||
|
||||
For this policy to work, you must verify that the MDM service provider allows the GP triggered MDM enrollment for domain joined devices.
|
||||
|
||||
@ -52,9 +52,10 @@ The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.
|
||||
> For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled.
|
||||
> [!IMPORTANT]
|
||||
> For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.
|
||||
>
|
||||
> For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled.
|
||||
|
||||
3. Verify that the device OS version is Windows 10, version 1709 or later.
|
||||
4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line.
|
||||
@ -93,7 +94,7 @@ You may contact your domain administrators to verify if the group policy has bee
|
||||
This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It is not recommended for the production environment in the enterprise. For bulk deployment, you should use the [Group Policy Management Console process](#configure-the-auto-enrollment-for-a-group-of-devices).
|
||||
|
||||
Requirements:
|
||||
- AD-joined PC running Windows 10, version 1709
|
||||
- AD-joined PC running Windows 10, version 1709 or later
|
||||
- Enterprise has MDM service already configured
|
||||
- Enterprise AD must be registered with Azure AD
|
||||
|
||||
@ -109,27 +110,27 @@ Requirements:
|
||||
|
||||
|
||||
|
||||
4. Double-click **Enable Automatic MDM enrollment using default Azure AD credentials**.
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** (support for Device Credential is coming) as the Selected Credential Type to use. User Credential enrolls Windows 10, version 1709 and later once an Intune licensed user logs into the device. Device Credential will enroll the device and then assign a user later, once support for this is available.
|
||||
|
||||
|
||||
|
||||
5. Click **Enable**, then click **OK**.
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later.
|
||||
The default behavior for older releases is to revert to **User Credential**.
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later.
|
||||
> The default behavior for older releases is to revert to **User Credential**.
|
||||
|
||||
When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD."
|
||||
When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD."
|
||||
|
||||
To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app).
|
||||
To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app).
|
||||
|
||||
If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot.
|
||||
If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!Tip]
|
||||
> You can avoid this behavior by using Conditional Access Policies in Azure AD.
|
||||
Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview).
|
||||
> [!Tip]
|
||||
> You can avoid this behavior by using Conditional Access Policies in Azure AD.
|
||||
Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview).
|
||||
|
||||
6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account.
|
||||
|
||||
@ -159,27 +160,28 @@ Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/a
|
||||
## Configure the auto-enrollment for a group of devices
|
||||
|
||||
Requirements:
|
||||
- AD-joined PC running Windows 10, version 1709
|
||||
- AD-joined PC running Windows 10, version 1709 or later
|
||||
- Enterprise has MDM service already configured (with Intune or a third party service provider)
|
||||
- Enterprise AD must be integrated with Azure AD.
|
||||
- Ensure that PCs belong to same computer group.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you do not see the policy, it may be because you don’t have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, follow these steps (Note: the latest MDM.admx is backwards compatible):
|
||||
> 1. Download:
|
||||
> 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) or
|
||||
> 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) or
|
||||
> 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495&WT.mc_id=rss_alldownloads_all)
|
||||
> 2. Install the package on the Domain Controller.
|
||||
> 3. Navigate, depending on the version to the folder:
|
||||
> 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**, or
|
||||
> 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2**, or
|
||||
> 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3**
|
||||
> 4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**.
|
||||
> 5. Copy PolicyDefinitions folder to **C:\Windows\SYSVOL\domain\Policies**.
|
||||
> (If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain).
|
||||
> 6. Restart the Domain Controller for the policy to be available.
|
||||
> This procedure will work for any future version as well.
|
||||
[!IMPORTANT]
|
||||
If you do not see the policy, it may be because you don’t have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, follow these steps (Note: the latest MDM.admx is backwards compatible):
|
||||
1. Download:
|
||||
1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) or
|
||||
1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) or
|
||||
1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495&WT.mc_id=rss_alldownloads_all)
|
||||
2. Install the package on the Domain Controller.
|
||||
3. Navigate, depending on the version to the folder:
|
||||
1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**, or
|
||||
1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2**, or
|
||||
1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3**
|
||||
4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**.
|
||||
5. Copy PolicyDefinitions folder to **C:\Windows\SYSVOL\domain\Policies**.
|
||||
(If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain).
|
||||
6. Restart the Domain Controller for the policy to be available.
|
||||
|
||||
This procedure will work for any future version as well.
|
||||
|
||||
1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**.
|
||||
2. Create a Security Group for the PCs.
|
||||
@ -187,7 +189,6 @@ Requirements:
|
||||
4. Filter using Security Groups.
|
||||
|
||||
## Troubleshoot auto-enrollment of devices
|
||||
|
||||
Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device.
|
||||
|
||||
To collect Event Viewer logs:
|
||||
@ -241,10 +242,10 @@ To collect Event Viewer logs:
|
||||
- [Link a Group Policy Object](https://technet.microsoft.com/library/cc732979(v=ws.11).aspx)
|
||||
- [Filter Using Security Groups](https://technet.microsoft.com/library/cc752992(v=ws.11).aspx)
|
||||
- [Enforce a Group Policy Object Link](https://technet.microsoft.com/library/cc753909(v=ws.11).aspx)
|
||||
- [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra)
|
||||
|
||||
### Useful Links
|
||||
|
||||
- [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591)
|
||||
- [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495)
|
||||
- [Windows 10 Administrative Templates for Windows 10 October 2018 Update 1809](https://www.microsoft.com/download/details.aspx?id=57576)
|
||||
- [Windows 10 Administrative Templates for Windows 10 April 2018 Update 1803](https://www.microsoft.com/download/details.aspx?id=56880)
|
||||
|
||||
@ -260,7 +260,7 @@ Note that the data payload of the SyncML needs to be encoded so that it does not
|
||||
|
||||
The **LocURI** for the above GP policy is:
|
||||
|
||||
`.\Device\Vendor\MSFT\Policy\Config\AppVirtualization\PublishingAllowServer2`
|
||||
`./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2`
|
||||
|
||||
To construct SyncML for your area/policy using the samples below, you need to update the **data id** and the **value** in the `<Data>` section of the SyncML. The items prefixed with an '&' character are the escape characters needed and can be retained as shown.
|
||||
|
||||
|
||||
@ -25,6 +25,33 @@ ms.topic: reference
|
||||
|
||||
Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/100591).
|
||||
|
||||
## New Group Policy settings in Windows 10, version 1903
|
||||
|
||||
The following Group Policy settings were added in Windows 10, version 1903:
|
||||
|
||||
**System**
|
||||
|
||||
- System\Service Control Manager Settings\Security Settings\Enable svchost.exe mitigation options
|
||||
- System\Storage Sense\Allow Storage Sense
|
||||
- System\Storage Sense\Allow Storage Sense Temporary Files cleanup
|
||||
- System\Storage Sense\Configure Storage Sense
|
||||
- System\Storage Sense\Configure Storage Sense Cloud content dehydration threshold
|
||||
- System\Storage Sense\Configure Storage Sense Recycle Bin cleanup threshold
|
||||
- System\Storage Sense\Configure Storage Sense Downloads cleanup threshold
|
||||
- System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Troubleshooting:Allow users to access recommended troubleshooting for known problems
|
||||
|
||||
|
||||
**Windows Components**
|
||||
|
||||
- Windows Components\App Privacy\Let Windows apps activate with voice
|
||||
- Windows Components\App Privacy\Let Windows apps activate with voice while the system is locked
|
||||
- Windows Components\Data Collection and Preview Builds\Allow commercial data pipeline
|
||||
- Windows Components\Data Collection and Preview Builds\Configure collection of browsing data for Desktop Analytics
|
||||
- Windows Components\Data Collection and Preview Builds\Configure diagnostic data upload endpoint for Desktop Analytics
|
||||
- Windows Components\Delivery Optimization\Delay background download Cache Server fallback (in seconds)
|
||||
- Windows Components\Delivery Optimization\Delay Foreground download Cache Server fallback (in seconds)
|
||||
- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use WDDM graphics display driver for Remote Desktop Connections
|
||||
- Windows Components\Windows Logon Options\Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
|
||||
|
||||
## New Group Policy settings in Windows 10, version 1809
|
||||
|
||||
@ -496,4 +523,3 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId=
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -25,12 +25,16 @@ ms.topic: article
|
||||
This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization.
|
||||
|
||||
- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/index).
|
||||
- For a detailed list of changes to Windows 10 ITPro TechNet library content, see [Online content change history](#online-content-change-history).
|
||||
|
||||
## Recent changes
|
||||
## Latest news
|
||||
|
||||
[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.<br>
|
||||
The [Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.<br>
|
||||
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).<br>
|
||||
VPN support is added to [Windows Autopilot](#windows-autopilot)<br>
|
||||
An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).<br>
|
||||
The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.<br>
|
||||
The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.<br>
|
||||
|
||||
## The Modern Desktop Deployment Center
|
||||
|
||||
@ -47,7 +51,34 @@ See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, whic
|
||||
|
||||
## Windows 10 servicing and support
|
||||
|
||||
- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon!
|
||||
### Delivery Optimization
|
||||
|
||||
Windows PowerShell cmdlets for Delivery Optimization have been improved:
|
||||
|
||||
- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peak behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent).
|
||||
- **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections.
|
||||
- **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting.
|
||||
|
||||
Additional improvements in [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) include:
|
||||
- Enterprise network [throttling is enhanced](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling.
|
||||
- Automatic cloud-based congestion detection is available for PCs with cloud service support.
|
||||
- Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon!
|
||||
|
||||
The following Delivery Optimization policies are removed in the Windows 10, version 2004 release:
|
||||
|
||||
- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth)
|
||||
- Reason: Replaced with separate policies for foreground and background
|
||||
- Max Upload Bandwidth (DOMaxUploadBandwidth)
|
||||
- Reason: impacts uploads to internet peers only, which isn't used in Enterprises.
|
||||
- Absolute max throttle (DOMaxDownloadBandwidth)
|
||||
- Reason: separated to foreground and background
|
||||
|
||||
### Windows Update for Business
|
||||
|
||||
[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include:
|
||||
- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy.
|
||||
- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds.
|
||||
|
||||
- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically log on as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed.
|
||||
- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period.
|
||||
- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally.
|
||||
@ -68,13 +99,16 @@ Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel o
|
||||
|
||||
For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md)
|
||||
|
||||
|
||||
## Deployment solutions and tools
|
||||
|
||||
### Windows Autopilot
|
||||
|
||||
[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices.
|
||||
|
||||
With the release of Windows 10, version 2004 you can configure [Windows Autopilot user-driven](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903.
|
||||
|
||||
If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, this was only supported with self-deploying profiles.
|
||||
|
||||
The following Windows Autopilot features are available in Windows 10, version 1903 and later:
|
||||
|
||||
- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in Windows 10, version 1903. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users.
|
||||
@ -83,6 +117,10 @@ The following Windows Autopilot features are available in Windows 10, version 19
|
||||
- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE.
|
||||
- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE.
|
||||
|
||||
### Microsoft Endpoint Configuration Manager
|
||||
|
||||
An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364).
|
||||
|
||||
### Windows 10 Subscription Activation
|
||||
|
||||
Windows 10 Education support has been added to Windows 10 Subscription Activation.
|
||||
@ -91,9 +129,11 @@ With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to
|
||||
|
||||
### SetupDiag
|
||||
|
||||
[SetupDiag](upgrade/setupdiag.md) is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful.
|
||||
[SetupDiag](upgrade/setupdiag.md) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues.
|
||||
|
||||
SetupDiag version 1.6.0.42 was released on 08/08/2019.
|
||||
In Windows 10, version 2004, SetupDiag is now automatically installed.
|
||||
|
||||
During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there is an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup.
|
||||
|
||||
### Upgrade Readiness
|
||||
|
||||
@ -129,21 +169,21 @@ There are many benefits to converting the partition style of a disk to GPT, incl
|
||||
|
||||
For more information, see [MBR2GPT.EXE](mbr-to-gpt.md).
|
||||
|
||||
|
||||
### Microsoft Deployment Toolkit (MDT)
|
||||
|
||||
MDT build 8456 (12/19/2018) is available, including support for Windows 10, version 1809, and Windows Server 2019.
|
||||
|
||||
For more information about MDT, see the [MDT resource page](https://docs.microsoft.com/sccm/mdt/).
|
||||
MDT version 8456 supports Windows 10, version 2004 and earlier operating systems, including Windows Server 2019. There is currently an issue that causes MDT to incorrectly detect that UEFI is present in Windows 10, version 2004. This issue is currently under investigation.
|
||||
|
||||
For the latest information about MDT, see the [MDT release notes](https://docs.microsoft.com/mem/configmgr/mdt/release-notes).
|
||||
|
||||
### Windows Assessment and Deployment Kit (ADK)
|
||||
|
||||
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. See the following topics:
|
||||
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows.
|
||||
|
||||
- [What's new in ADK kits and tools](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools)
|
||||
- [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md)
|
||||
Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install).
|
||||
|
||||
For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004).
|
||||
|
||||
Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md).
|
||||
|
||||
## Testing and validation guidance
|
||||
|
||||
@ -157,25 +197,15 @@ For more information, see the following guides:
|
||||
- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md)
|
||||
- [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md)
|
||||
|
||||
|
||||
## Troubleshooting guidance
|
||||
|
||||
[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and will continue to be updated with new fixes. The topic provides a detailed explanation of the Windows 10 upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process.
|
||||
|
||||
|
||||
## Online content change history
|
||||
|
||||
The following topics provide a change history for Windows 10 ITPro TechNet library content related to deploying and using Windows 10.
|
||||
|
||||
[Change history for Access Protection](/windows/access-protection/change-history-for-access-protection)<br>
|
||||
[Change history for Device Security](/windows/device-security/change-history-for-device-security)<br>
|
||||
[Change history for Threat Protection](/windows/threat-protection/change-history-for-threat-protection)
|
||||
|
||||
## Related topics
|
||||
|
||||
[Overview of Windows as a service](update/waas-overview.md)
|
||||
<BR>[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)
|
||||
<BR>[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)
|
||||
<BR>[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)
|
||||
<BR>[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
|
||||
<BR>[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
|
||||
[Overview of Windows as a service](update/waas-overview.md)<br>
|
||||
[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)<br>
|
||||
[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)<br>
|
||||
[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)<br>
|
||||
[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)<br>
|
||||
[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)<br>
|
||||
|
||||
@ -1,59 +0,0 @@
|
||||
---
|
||||
title: Define update strategy
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description:
|
||||
keywords: updates, calendar, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
audience: itpro
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.audience: itpro
|
||||
author: jaimeo
|
||||
ms.topic: article
|
||||
ms.collection: M365-modern-desktop
|
||||
---
|
||||
|
||||
# Define update strategy
|
||||
|
||||
Traditionally, organizations treated the deployment of operating system updates (especially feature updates) as a discrete project that had a beginning, a middle, and an end. A release was "built" (usually in the form of an image) and then distributed to users and their devices.
|
||||
|
||||
Today, more organizations are treating deployment as a continual process of updates which roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--withouth interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release.
|
||||
|
||||
Though we encourage you to deploy every available release and maintain a fast cadence for some portion of your environment, we also recognize that you might have a large number of devices, and a need for little or no disruption, an so you might choose to update annually. The 18/30 month lifecycle cadence lets you to allow some portion of you environment to move faster while a majority can move less quickly.
|
||||
|
||||
|
||||
|
||||
## Calendar approaches
|
||||
|
||||
You can use a calendar approach for either a faster 18-month or twice-per-year cadence or a 30-month or annual cadence. Depending on company size, installing Windows 10 feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they will stop receiving the monthly security updates.
|
||||
|
||||
|
||||
### Annual
|
||||
|
||||
Here's a calendar showing an example schedule that applies one Windows 10 feature update per calendar year, aligned with Microsoft Endpoint Configuration Manager and Microsoft 365 Apps release cycles:
|
||||
|
||||
|
||||
|
||||
This approach provides approximately twelve months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version 20H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates.
|
||||
|
||||
This cadence might be most suitable for you if any of these conditions apply:
|
||||
|
||||
- You are just starting your journey with the Windows 10 servicing process. If you are unfamiliar with new processes that support Windows 10 servicing, moving from a once every 3-5 year project to a twice a year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost.
|
||||
- You want to wait and see how successful other companies are at adopting a Windows 10 feature update.
|
||||
- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows 10 serviced in case business priorities change. Aligning to the Windows 10 feature update released in the *second* half of each calendar year, you get additional servicing for Windows 10 (30 months of servicing compared to 18 months).
|
||||
|
||||
|
||||
### Rapid
|
||||
|
||||
This calendar shows an example schedule that installs each feature update as it is released, twice per year:
|
||||
|
||||
|
||||
|
||||
This cadence might be best for you if these conditions apply:
|
||||
|
||||
- You have a strong appetite for change.
|
||||
- You want to continuously update supporting infrastructure and unlock new scenarios.
|
||||
- Your organization has a large population of information workers that can use the latest features and functionality in Windows 10 and Office.
|
||||
- You have experience with feature updates for Windows 10.
|
||||
@ -28,13 +28,25 @@ ms.topic: article
|
||||
|
||||
## About SetupDiag
|
||||
|
||||
<I>Current version of SetupDiag: 1.6.0.42</I>
|
||||
<I>Current downloadable version of SetupDiag: 1.6.0.42</I>
|
||||
>Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues.
|
||||
|
||||
SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful.
|
||||
|
||||
SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode.
|
||||
|
||||
## SetupDiag in Windows 10, version 2004 and later
|
||||
|
||||
With the release of Windows 10, version 2004, SetupDiag is included with Windows Setup.
|
||||
|
||||
During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, **setupdiag.exe** is also installed to this directory. If there is an issue with the upgrade, SetupDiag will automatically run to determine the cause of the failure.
|
||||
|
||||
When run by Windows Setup, results of the SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\Setup\SetupDiag\Results**.
|
||||
|
||||
If the upgrade process proceeds normally, the **Sources** directory including **setupdiag.exe** is moved under **%SystemDrive%\Windows.Old** for cleanup. If the **Windows.old** directory is deleted later, **setupdiag.exe** will also be removed.
|
||||
|
||||
## Using SetupDiag
|
||||
|
||||
To quickly use SetupDiag on your current computer:
|
||||
1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137).
|
||||
2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142).
|
||||
|
||||
@ -294,6 +294,8 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted
|
||||
5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**.
|
||||
|
||||
6. Sign out of the Microsoft Azure Portal.
|
||||
> [!NOTE]
|
||||
> After the creation, the **supported platform** parameter of the profile will contain the value "Windows 8.1 and later", as the certificate configuration for Windows 8.1 and Windows 10 is the same.
|
||||
|
||||
## Configure Windows Hello for Business Device Enrollment
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.reviewer:
|
||||
# Configure Windows Hello for Business: Active Directory Federation Services
|
||||
|
||||
**Applies to**
|
||||
- Windows10, version 1703 or later
|
||||
- Windows 10, version 1703 or later
|
||||
- Hybrid deployment
|
||||
- Certificate trust
|
||||
|
||||
@ -36,15 +36,14 @@ The Windows Hello for Business Authentication certificate template is configured
|
||||
Sign-in the AD FS server with *Domain Admin* equivalent credentials.
|
||||
|
||||
1. Open a **Windows PowerShell** prompt.
|
||||
2. Type the following command
|
||||
2. Enter the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication -WindowsHelloCertificateProxyEnabled $true
|
||||
```
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority.
|
||||
>[!NOTE]
|
||||
> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the preceding command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template by using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name by using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority.
|
||||
|
||||
|
||||
### Group Memberships for the AD FS Service Account
|
||||
@ -66,8 +65,8 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
### Section Review
|
||||
> [!div class="checklist"]
|
||||
> * Configure the registration authority
|
||||
> * Update group memberships for the AD FS service account
|
||||
> * Configure the registration authority.
|
||||
> * Update group memberships for the AD FS service account.
|
||||
>
|
||||
>
|
||||
> [!div class="step-by-step"]
|
||||
|
||||
@ -16,6 +16,7 @@ localizationpriority: medium
|
||||
ms.date: 10/23/2017
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Configure Hybrid Windows Hello for Business: Directory Synchronization
|
||||
|
||||
**Applies to**
|
||||
@ -26,7 +27,7 @@ ms.reviewer:
|
||||
|
||||
## Directory Synchronization
|
||||
|
||||
In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory.
|
||||
In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory.
|
||||
|
||||
The key-trust model needs Windows Server 2016 domain controllers, which configure the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually.
|
||||
|
||||
@ -45,12 +46,12 @@ Sign-in a domain controller or management workstations with *Domain Admin* equiv
|
||||
6. In the **Applies to** list box, select **Descendant User objects**.
|
||||
7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**.
|
||||
8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCredentialLink**.
|
||||
9. Click **OK** three times to complete the task.
|
||||
9. Click **OK** three times to complete the task.
|
||||
|
||||
|
||||
### Group Memberships for the Azure AD Connect Service Account
|
||||
|
||||
The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory.
|
||||
The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory.
|
||||
|
||||
Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials.
|
||||
|
||||
@ -62,14 +63,14 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
6. Click **OK** to return to **Active Directory Users and Computers**.
|
||||
|
||||
> [!NOTE]
|
||||
> If your AD forest has multiple domains. Please make sure you add the ADConnect sync service account (that is, MSOL_12121212) into "Enterprise Key Admins" group to gain permission across the domains in the forest.
|
||||
> If your AD forest has multiple domains, make sure you add the ADConnect sync service account (ie. MSOL_12121212) into "Enterprise Key Admins" group to gain permission across the domains in the forest.
|
||||
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Configure Permissions for Key Synchronization
|
||||
> * Configure group membership for Azure AD Connect
|
||||
>
|
||||
>
|
||||
> [!div class="step-by-step"]
|
||||
> [< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md)
|
||||
> [Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md)
|
||||
|
||||
@ -457,7 +457,7 @@ Checking BitLocker status with the control panel is the most common method used
|
||||
| **Suspended** | BitLocker is suspended and not actively protecting the volume |
|
||||
| **Waiting for Activation**| BitLocker is enabled with a clear protector key and requires further action to be fully protected|
|
||||
|
||||
If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on volume E. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status.
|
||||
If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on the volume. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status.
|
||||
Using the control panel, administrators can choose **Turn on BitLocker** to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume (or password if no TPM exists), or a password or smart card protector to a data volume.
|
||||
The drive security window displays prior to changing the volume status. Selecting **Activate BitLocker** will complete the encryption process.
|
||||
|
||||
|
||||
@ -29,7 +29,9 @@ ms.topic: article
|
||||
|
||||
Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network.
|
||||
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work.
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work. For more information, see:
|
||||
- [Microsoft Defender ATP for Linux system requirements](microsoft-defender-atp-linux.md#system-requirements)
|
||||
- [Microsoft Defender ATP for Mac system requirements](microsoft-defender-atp-mac.md#system-requirements).
|
||||
|
||||
## Onboarding non-Windows machines
|
||||
You'll need to take the following steps to onboard non-Windows machines:
|
||||
|
||||
@ -12,14 +12,14 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 05/20/2020
|
||||
ms.date: 05/29/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Enable attack surface reduction rules
|
||||
|
||||
[Attack surface reduction rules](attack-surface-reduction.md) help prevent actions that malware often abuses to compromise devices and networks. You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
[Attack surface reduction rules](attack-surface-reduction.md) (ASR rules) help prevent actions that malware often abuses to compromise devices and networks. You can set ASR rules for devices running any of the following editions and versions of Windows:
|
||||
- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later
|
||||
@ -27,22 +27,22 @@ manager: dansimp
|
||||
|
||||
Each ASR rule contains one of three settings:
|
||||
|
||||
* Not configured: Disable the ASR rule
|
||||
* Block: Enable the ASR rule
|
||||
* Audit: Evaluate how the ASR rule would impact your organization if enabled
|
||||
- Not configured: Disable the ASR rule
|
||||
- Block: Enable the ASR rule
|
||||
- Audit: Evaluate how the ASR rule would impact your organization if enabled
|
||||
|
||||
To use ASR rules, you need either a Windows 10 Enterprise E3 or E5 license. We recommend an E5 license so you can take advantage of the advanced monitoring and reporting capabilities available in [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP). These advanced capabilities aren't available with an E3 license, but you can develop your own monitoring and reporting tools to use in conjunction with ASR rules.
|
||||
To use ASR rules, you must have either a Windows 10 Enterprise E3 or E5 license. We recommend E5 licenses so you can take advantage of the advanced monitoring and reporting capabilities that are available in [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP). Advanced monitoring and reporting capabilities aren't available with an E3 license, but you can develop your own monitoring and reporting tools to use in conjunction with ASR rules.
|
||||
|
||||
> [!TIP]
|
||||
> To learn more about Windows licensing, see [Windows 10 Licensing](https://www.microsoft.com/licensing/product-licensing/windows10?activetab=windows10-pivot:primaryr5) and get the [Volume Licensing guide for Windows 10](https://download.microsoft.com/download/2/D/1/2D14FE17-66C2-4D4C-AF73-E122930B60F6/Windows-10-Volume-Licensing-Guide.pdf).
|
||||
|
||||
You can enable attack surface reduction rules by using any of these methods:
|
||||
|
||||
* [Microsoft Intune](#intune)
|
||||
* [Mobile Device Management (MDM)](#mdm)
|
||||
* [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager)
|
||||
* [Group Policy](#group-policy)
|
||||
* [PowerShell](#powershell)
|
||||
- [Microsoft Intune](#intune)
|
||||
- [Mobile Device Management (MDM)](#mdm)
|
||||
- [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager)
|
||||
- [Group Policy](#group-policy)
|
||||
- [PowerShell](#powershell)
|
||||
|
||||
Enterprise-level management such as Intune or Microsoft Endpoint Configuration Manager is recommended. Enterprise-level management will overwrite any conflicting Group Policy or PowerShell settings on startup.
|
||||
|
||||
@ -50,6 +50,8 @@ Enterprise-level management such as Intune or Microsoft Endpoint Configuration M
|
||||
|
||||
You can exclude files and folders from being evaluated by most attack surface reduction rules. This means that even if an ASR rule determines the file or folder contains malicious behavior, it will not block the file from running. This could potentially allow unsafe files to run and infect your devices.
|
||||
|
||||
You can also exclude ASR rules from triggering based on certificate and file hashes by allowing specified Microsoft Defender ATP file and certificate indicators. (See [Manage indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators).)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded.
|
||||
> If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md).
|
||||
@ -67,9 +69,9 @@ The following procedures for enabling ASR rules include instructions for how to
|
||||
|
||||
2. In the **Endpoint protection** pane, select **Windows Defender Exploit Guard**, then select **Attack Surface Reduction**. Select the desired setting for each ASR rule.
|
||||
|
||||
3. Under **Attack Surface Reduction exceptions**, you can enter individual files and folders, or you can select **Import** to import a CSV file that contains files and folders to exclude from ASR rules. Each line in the CSV file should be in the following format:
|
||||
3. Under **Attack Surface Reduction exceptions**, you can enter individual files and folders, or you can select **Import** to import a CSV file that contains files and folders to exclude from ASR rules. Each line in the CSV file should be formatted as follows:
|
||||
|
||||
*C:\folder*, *%ProgramFiles%\folder\file*, *C:\path*
|
||||
`C:\folder`, `%ProgramFiles%\folder\file`, `C:\path`
|
||||
|
||||
4. Select **OK** on the three configuration panes and then select **Create** if you're creating a new endpoint protection file or **Save** if you're editing an existing one.
|
||||
|
||||
@ -79,23 +81,23 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https
|
||||
|
||||
The following is a sample for reference, using [GUID values for ASR rules](attack-surface-reduction.md#attack-surface-reduction-rules).
|
||||
|
||||
OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules
|
||||
`OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules`
|
||||
|
||||
Value: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}=2|{3B576869-A4EC-4529-8536-B80A7769E899}=1|{D4F940AB-401B-4EfC-AADC-AD5F3C50688A}=2|{D3E037E1-3EB8-44C8-A917-57927947596D}=1|{5BEB7EFE-FD9A-4556-801D-275E5FFC04CC}=0|{BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550}=1
|
||||
`Value: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}=2|{3B576869-A4EC-4529-8536-B80A7769E899}=1|{D4F940AB-401B-4EfC-AADC-AD5F3C50688A}=2|{D3E037E1-3EB8-44C8-A917-57927947596D}=1|{5BEB7EFE-FD9A-4556-801D-275E5FFC04CC}=0|{BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550}=1`
|
||||
|
||||
The values to enable, disable, or enable in audit mode are:
|
||||
|
||||
* Disable = 0
|
||||
* Block (enable ASR rule) = 1
|
||||
* Audit = 2
|
||||
- Disable = 0
|
||||
- Block (enable ASR rule) = 1
|
||||
- Audit = 2
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions.
|
||||
|
||||
Example:
|
||||
|
||||
OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions
|
||||
`OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions`
|
||||
|
||||
Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
`Value: c:\path|e:\path|c:\Whitelisted.exe`
|
||||
|
||||
> [!NOTE]
|
||||
> Be sure to enter OMA-URI values without spaces.
|
||||
@ -103,11 +105,16 @@ Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
## Microsoft Endpoint Configuration Manager
|
||||
|
||||
1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**.
|
||||
1. Click **Home** > **Create Exploit Guard Policy**.
|
||||
1. Enter a name and a description, click **Attack Surface Reduction**, and click **Next**.
|
||||
1. Choose which rules will block or audit actions and click **Next**.
|
||||
1. Review the settings and click **Next** to create the policy.
|
||||
1. After the policy is created, click **Close**.
|
||||
|
||||
2. Click **Home** > **Create Exploit Guard Policy**.
|
||||
|
||||
3. Enter a name and a description, click **Attack Surface Reduction**, and click **Next**.
|
||||
|
||||
4. Choose which rules will block or audit actions and click **Next**.
|
||||
|
||||
5. Review the settings and click **Next** to create the policy.
|
||||
|
||||
6. After the policy is created, click **Close**.
|
||||
|
||||
## Group Policy
|
||||
|
||||
@ -120,15 +127,15 @@ Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
|
||||
3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Attack surface reduction**.
|
||||
|
||||
4. Select **Configure Attack surface reduction rules** and select **Enabled**. You can then set the individual state for each rule in the options section:
|
||||
4. Select **Configure Attack surface reduction rules** and select **Enabled**. You can then set the individual state for each rule in the options section.
|
||||
|
||||
* Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows:
|
||||
Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows:
|
||||
|
||||
* Disable = 0
|
||||
* Block (enable ASR rule) = 1
|
||||
* Audit = 2
|
||||
- Disable = 0
|
||||
- Block (enable ASR rule) = 1
|
||||
- Audit = 2
|
||||
|
||||
|
||||
|
||||
|
||||
5. To exclude files and folders from ASR rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item.
|
||||
|
||||
@ -169,11 +176,11 @@ Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
> Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID 1>,<rule ID 2>,<rule ID 3>,<rule ID 4> -AttackSurfaceReductionRules_Actions Enabled, Enabled, Disabled, AuditMode
|
||||
> ```
|
||||
|
||||
You can also the `Add-MpPreference` PowerShell verb to add new rules to the existing list.
|
||||
You can also use the `Add-MpPreference` PowerShell verb to add new rules to the existing list.
|
||||
|
||||
> [!WARNING]
|
||||
> `Set-MpPreference` will always overwrite the existing set of rules. If you want to add to the existing set, you should use `Add-MpPreference` instead.
|
||||
> You can obtain a list of rules and their current state by using `Get-MpPreference`
|
||||
> You can obtain a list of rules and their current state by using `Get-MpPreference`.
|
||||
|
||||
3. To exclude files and folders from ASR rules, use the following cmdlet:
|
||||
|
||||
@ -186,9 +193,12 @@ Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
> [!IMPORTANT]
|
||||
> Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list.
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
* [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md)
|
||||
* [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md)
|
||||
* [Attack surface reduction FAQ](attack-surface-reduction.md)
|
||||
* [Enable cloud-delivered protection](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
|
||||
- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md)
|
||||
|
||||
- [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md)
|
||||
|
||||
- [Attack surface reduction FAQ](attack-surface-reduction.md)
|
||||
|
||||
- [Enable cloud-delivered protection](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
|
||||
|
||||
@ -53,7 +53,13 @@ The risk level reflects the overall risk assessment of the machine based on a co
|
||||
|
||||
### Exposure level
|
||||
|
||||
The exposure level reflects the current exposure of the machine based on the cumulative impact of its pending security recommendations.
|
||||
The exposure level reflects the current exposure of the machine based on the cumulative impact of its pending security recommendations. The possible levels are low, medium, and high. Low exposure means your machines are less vulnerable from exploitation.
|
||||
|
||||
If the exposure level says "No data available," there are a few reasons why this may be the case:
|
||||
|
||||
- Device stopped reporting for more than 30 days – in that case it is considered inactive, and the exposure isn't computed
|
||||
- Device OS not supported - see [minimum requirements for Microsoft Defender ATP](minimum-requirements.md)
|
||||
- Device with stale agent (very unlikely)
|
||||
|
||||
### OS Platform
|
||||
|
||||
|
||||
@ -34,7 +34,8 @@ Offboard machine from Microsoft Defender ATP.
|
||||
[!include[Machine actions note](../../includes/machineactionsnote.md)]
|
||||
|
||||
>[!Note]
|
||||
> This does not support offboarding macOS Devices.
|
||||
> This API is supported on Windows 10, version 1703 and later, or Windows Server 2019 and later.
|
||||
> This API is not supported on MacOS or Linux devices.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
@ -60,10 +60,6 @@ An experimental implementation of TLS 1.3 is included in Windows 10, version 190
|
||||
|
||||
## Virtualization
|
||||
|
||||
### Containers on Windows
|
||||
|
||||
This update includes 5 fixes to allow the host to run down-level containers on up-level for process (Argon) isolation. Previously [Containers on Windows](https://docs.microsoft.com/virtualization/windowscontainers/) required matched host and container version. This limited Windows containers from supporting mixed-version container pod scenarios.
|
||||
|
||||
### Windows Sandbox
|
||||
|
||||
[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature is available in Windows 10, version 1903. In Windows 10, version 1909 you have even more control over the level of isolation.
|
||||
|
||||
@ -74,7 +74,7 @@ If you configure the language settings in the Autopilot profile and the device i
|
||||
|
||||
### Microsoft Endpoint Manager
|
||||
|
||||
An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuraton Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364).
|
||||
An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364).
|
||||
|
||||
Also see [What's new in Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/whats-new).
|
||||
|
||||
@ -121,13 +121,9 @@ The following [Delivery Optimization](https://docs.microsoft.com/windows/deploym
|
||||
|
||||
## Virtualization
|
||||
|
||||
### Containers on Windows
|
||||
|
||||
This update includes 5 fixes to allow the host to run down-level containers on up-level for process (Argon) isolation. Previously [Containers on Windows](https://docs.microsoft.com/virtualization/windowscontainers/) required matched host and container version. This limited Windows containers from supporting mixed-version container pod scenarios.
|
||||
|
||||
### Windows Sandbox
|
||||
|
||||
[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature was released with Windows 10, version 1903. Windows 10, version 2004 includes bugfixes and enables even more control over configuration.
|
||||
[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature was released with Windows 10, version 1903. Windows 10, version 2004 includes bug fixes and enables even more control over configuration.
|
||||
|
||||
[Windows Sandbox configuration](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file) includes:
|
||||
- MappedFolders now supports a destination folder. Previously no destination could be specified, it was always mapped to the Sandbox desktop.
|
||||
@ -183,7 +179,7 @@ For updated information, see the [Microsoft 365 blog](https://aka.ms/CortanaUpda
|
||||
|
||||
### Windows Search
|
||||
|
||||
Windows Search is [improved](https://insider.windows.com/community-news/desktop-search/) in several ways.
|
||||
Windows Search is improved in several ways. For more information, see [Supercharging Windows Search](https://aka.ms/AA8kllm).
|
||||
|
||||
### Virtual Desktops
|
||||
|
||||
@ -235,6 +231,8 @@ For information about Desktop Analytics and this release of Windows 10, see [Wha
|
||||
|
||||
## See Also
|
||||
|
||||
[What’s new for IT pros in Windows 10, version 2004](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-2004/ba-p/1419764): Windows IT Pro blog.<br>
|
||||
[What’s new in the Windows 10 May 2020 Update](https://blogs.windows.com/windowsexperience/2020/05/27/whats-new-in-the-windows-10-may-2020-update/): Windows Insider blog.<br>
|
||||
[What's New in Windows Server](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.<br>
|
||||
[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.<br>
|
||||
[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.<br>
|
||||
@ -243,4 +241,3 @@ For information about Desktop Analytics and this release of Windows 10, see [Wha
|
||||
[What's new in Windows 10, version 2004 - Windows Insiders](https://docs.microsoft.com/windows-insider/at-home/whats-new-wip-at-home-20h1): This list also includes consumer focused new features.<br>
|
||||
[Features and functionality removed in Windows 10](https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features): Removed features.<br>
|
||||
[Windows 10 features we’re no longer developing](https://docs.microsoft.com/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.<br>
|
||||
[What’s new for IT pros in Windows 10, version 2004](https://aka.ms/whats-new-in-2004): Windows IT Pro blog.<br>
|
||||
|
||||
Reference in New Issue
Block a user