mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-26 07:43:36 +00:00
Merge branch 'master' into deployment-guide
This commit is contained in:
Joey Caparas
@ -86,6 +86,8 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
```
|
||||
dism /image:<WIM file name> /Enable-Feature /FeatureName:IsolatedUserMode
|
||||
```
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required.
|
||||
|
||||
> [!NOTE]
|
||||
> You can also add these features to an online image by using either DISM or Configuration Manager.
|
||||
|
||||
@ -68,3 +68,5 @@ Following are the various deployment guides and models included in this topic:
|
||||
|
||||
Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**.
|
||||
|
||||
> [!NOTE]
|
||||
> You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data.
|
||||
|
||||
@ -58,6 +58,9 @@ To resolve this issue, the CRL distribution point must be a location that is acc
|
||||
|
||||
If your CRL distribution point does not list an HTTP distribution point, then you need to reconfigure the issuing certificate authority to include an HTTP CRL distribution point, preferably first in the list of distribution points.
|
||||
|
||||
> [!NOTE]
|
||||
> If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server.
|
||||
|
||||
### Windows Server 2016 Domain Controllers
|
||||
If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
|
||||
@ -335,6 +338,3 @@ Sign-in a workstation with access equivalent to a _domain user_.
|
||||
|
||||
If you plan on using certificates for on-premises single-sign on, perform the additional steps in [Using Certificates for On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -118,6 +118,11 @@ Hybrid certificate trust deployments need the device write back feature. Authen
|
||||
> [!NOTE]
|
||||
> Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory, and therefore the device writeback is used to update the msDS-KeyCredentialLink on the computer object.
|
||||
|
||||
## Provisioning
|
||||
|
||||
You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data.
|
||||
|
||||
|
||||
### Section Checklist ###
|
||||
> [!div class="checklist"]
|
||||
> * Azure Active Directory Device writeback
|
||||
|
||||
@ -31,7 +31,7 @@ In hybrid deployments, users register the public portion of their Windows Hello
|
||||
The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**.
|
||||
> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use the pre-created group KeyAdmins in step 3 of the "Group Memberships for the Azure AD Connect Service Account" section of this article.
|
||||
|
||||
### Configure Permissions for Key Synchronization
|
||||
|
||||
@ -56,9 +56,6 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. Click the **Users** container in the navigation pane.
|
||||
>[!IMPORTANT]
|
||||
> If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created.
|
||||
|
||||
3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**.
|
||||
4. Click the **Members** tab and click **Add**
|
||||
5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**.
|
||||
|
||||
@ -40,7 +40,7 @@ Hybrid Windows Hello for Business needs two directories: on-premises Active Dire
|
||||
|
||||
A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription.
|
||||
|
||||
You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 or later domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more.
|
||||
|
||||
Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs.
|
||||
|
||||
@ -125,7 +125,11 @@ Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Auth
|
||||
## Device Registration
|
||||
|
||||
Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory.
|
||||
|
||||
|
||||
## Provisioning
|
||||
|
||||
You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data.
|
||||
|
||||
|
||||
### Section Checklist
|
||||
|
||||
|
||||
@ -196,7 +196,7 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using
|
||||
Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions.
|
||||
|
||||
|
||||
## Follow the Windows Hello for Business on premises certificate trust deployment guide
|
||||
## Follow the Windows Hello for Business on premises key trust deployment guide
|
||||
1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md)
|
||||
2. Validate and Configure Public Key Infrastructure (*You are here*)
|
||||
3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md)
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
---
|
||||
title: Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10)
|
||||
title: Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10)
|
||||
description: Use Configuration Manager to make & deploy a Windows Information Protection (WIP) policy. Choose protected apps, WIP-protection level, and find enterprise data.
|
||||
ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529
|
||||
ms.reviewer:
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager, MEMCM, Microsoft Endpoint Configuration Manager
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
@ -15,26 +15,29 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 05/13/2019
|
||||
ms.date: 01/09/2020
|
||||
---
|
||||
|
||||
# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager
|
||||
# Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
- System Center Configuration Manager
|
||||
- Microsoft Endpoint Configuration Manager
|
||||
|
||||
System Center Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network.
|
||||
Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network.
|
||||
|
||||
## Add a WIP policy
|
||||
After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy.
|
||||
After you’ve installed and set up Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy.
|
||||
|
||||
>[!TIP]
|
||||
> Review the [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) article before creating a new configuration item to avoid common issues.
|
||||
|
||||
**To create a configuration item for WIP**
|
||||
|
||||
1. Open the System Center Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node.
|
||||
1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Click the **Create Configuration Item** button.<p>
|
||||
The **Create Configuration Item Wizard** starts.
|
||||
@ -43,7 +46,7 @@ The **Create Configuration Item Wizard** starts.
|
||||
|
||||
3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
|
||||
|
||||
4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use System Center Configuration Manager for device management, and then click **Next**.
|
||||
4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Configuration Manager for device management, and then click **Next**.
|
||||
|
||||
- **Settings for devices managed with the Configuration Manager client:** Windows 10
|
||||
|
||||
@ -62,7 +65,7 @@ The **Create Configuration Item Wizard** starts.
|
||||
The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization.
|
||||
|
||||
## Add app rules to your policy
|
||||
During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
|
||||
|
||||
@ -295,9 +298,9 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules*
|
||||
</RuleCollection>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager.
|
||||
12. After you’ve created your XML file, you need to import it by using Configuration Manager.
|
||||
|
||||
**To import your Applocker policy file app rule using System Center Configuration Manager**
|
||||
**To import your Applocker policy file app rule using Configuration Manager**
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
@ -506,3 +509,5 @@ After you’ve created your WIP policy, you'll need to deploy it to your organiz
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
|
||||
- [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md)
|
||||
|
||||
@ -121,6 +121,7 @@
|
||||
##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md)
|
||||
##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md)
|
||||
##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md)
|
||||
##### [DeviceFileCertificateInfoBeta](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md)
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
|
||||
@ -26,7 +26,7 @@ ms.date: 10/08/2019
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `AlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table.
|
||||
The `AlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts in Microsoft Defender Security Center. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
|
||||
@ -0,0 +1,60 @@
|
||||
---
|
||||
title: DeviceFileCertificateInfoBeta table in the advanced hunting schema
|
||||
description: Learn about file signing information in the DeviceFileCertificateInfoBeta table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, digital signature, certificate, file signing, DeviceFileCertificateInfoBeta
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 01/14/2020
|
||||
---
|
||||
|
||||
# DeviceFileCertificateInfoBeta
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceFileCertificateInfoBeta` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file signing certificates. This table uses data obtained from certificate verification activities regularly performed on files on endpoints.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `SHA1` | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| `IsSigned` | boolean | Indicates whether the file is signed |
|
||||
| `SignatureType` | string | Indicates whether signature information was read as embedded | content in the file itself or read from an external catalog file |
|
||||
| `Signer` | string | Information about the signer of the file |
|
||||
| `SignerHash` | string | Unique hash value identifying the signer |
|
||||
| `Issuer` | string | Information about the issuing certificate authority (CA) |
|
||||
| `IssuerHash` | string | Unique hash value identifying issuing certificate authority (CA) |
|
||||
| `CertificateSerialNumber` | string | Identifier for the certificate that is unique to the issuing certificate authority (CA) |
|
||||
| `CrlDistributionPointUrls` | string | JSON array listing the URLs of network shares that contain certificates and certificate revocation lists (CRLs) |
|
||||
| `CertificateCreationTime` | datetime | Date and time the certificate was created |
|
||||
| `CertificateExpirationTime` | datetime | Date and time the certificate is set to expire |
|
||||
| `CertificateCountersignatureTime` | datetime | Date and time the certificate was countersigned |
|
||||
| `IsTrusted` | boolean | Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes |
|
||||
| `IsRootSignerMicrosoft` | boolean | Indicates whether the signer of the root certificate is Microsoft |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns. |
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -23,8 +23,7 @@ ms.date: 10/08/2019
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for advanced hunting. To understand these concepts better, run your first query.
|
||||
|
||||
@ -141,5 +140,4 @@ For detailed information about the query language, see [Kusto query language doc
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Apply query best practices](advanced-hunting-best-practices.md)
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
|
||||
@ -15,7 +15,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
ms.date: 01/14/2020
|
||||
---
|
||||
|
||||
# Understand the advanced hunting schema
|
||||
@ -47,6 +47,7 @@ Table and column names are also listed within the Microsoft Defender Security Ce
|
||||
| **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events |
|
||||
| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events |
|
||||
| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection |
|
||||
| **[DeviceFileCertificateInfoBeta](advanced-hunting-devicefilecertificateinfobeta-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints |
|
||||
| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products |
|
||||
| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
|
||||
| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices |
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 72 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 69 KiB After Width: | Height: | Size: 72 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 64 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 62 KiB After Width: | Height: | Size: 64 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 121 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 7.8 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 47 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 47 KiB |
@ -63,7 +63,7 @@ The three most recent major releases of macOS are supported.
|
||||
- 10.15 (Catalina), 10.14 (Mojave), 10.13 (High Sierra)
|
||||
- Disk space: 650 MB
|
||||
|
||||
Beta versions of macOS are not supported. macOS Sierra (10.12) support will end on January 1, 2020.
|
||||
Beta versions of macOS are not supported. macOS Sierra (10.12) support ended on January 1, 2020.
|
||||
|
||||
After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints.
|
||||
|
||||
|
||||
@ -47,18 +47,19 @@ You can access the security recommendation from the Microsoft Defender ATP Threa
|
||||
*Security recommendations option from the left navigation menu*
|
||||
|
||||
1. Go to the Threat & Vulnerability Management navigation menu and select **Security recommendations** to open up the list of security recommendations for the threats and vulnerabilities found in your organization. It gives you an overview of the security recommendation context: weaknesses found, related components, the application and operating system where the threat or vulnerabilities were found, network, accounts, and security controls, associated breach, threats, and recommendation insights, exposed machine trends, status, remediation type and activities.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
> The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the amount of exposed machines, the color of the graph will change into green. This happens when the numbers on the right hand side is greater than what’s on the left, which means an increase or decrease at the end of even a single machine will change the graph's color.
|
||||
|
||||
You can filter your view based on related components, status, and remediation type. If you want to see the remediation activities of software and software versions which have reached their end-of-life, select **Active**, then select **Software update** from the **Remediation Type** filter, and click **Apply**.
|
||||
<br></br>
|
||||
<br></br>
|
||||
|
||||
2. Select the security recommendation that you need to investigate or process.
|
||||
<br></br>
|
||||
<br></br>
|
||||
|
||||
*Top security recommendations from the dashboard*
|
||||
|
||||
*Top security recommendations from the dashboard*
|
||||
|
||||
In a given day as a Security Administrator, you can take a look at the dashboard to see your exposure score side-by-side with your configuration score. The goal is to lower down your organization's exposure from vulnerabilities, and increase your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
||||
|
||||
@ -81,12 +82,12 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
|
||||
1. Select the **Security recommendation** tab.
|
||||
|
||||
2. Click **:** beside the security recommendation that you want to report about, then select **Report inaccuracy**.
|
||||
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu.
|
||||
<br></br>
|
||||
<br></br>
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 04/19/2017
|
||||
# Interactive logon: Do not require CTRL+ALT+DEL
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
|
||||
Describes the best practices, location, values, and security considerations for the **Interactive logon: Do not require CTRL+ALT+DEL** security policy setting.
|
||||
|
||||
@ -27,7 +27,7 @@ Describes the best practices, location, values, and security considerations for
|
||||
|
||||
This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on.
|
||||
|
||||
If this policy setting is enabled on a device, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords.
|
||||
If this policy setting is enabled on a device, a user is not required to press CTRL+ALT+DEL to log on.
|
||||
|
||||
If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to the Windows operating system (unless they are using a smart card for logon).
|
||||
|
||||
@ -37,13 +37,13 @@ A malicious user might install malware that looks like the standard logon dialog
|
||||
|
||||
### Possible values
|
||||
|
||||
- Enabled
|
||||
- Disabled
|
||||
- Not defined
|
||||
- Enabled
|
||||
- Disabled
|
||||
- Not defined
|
||||
|
||||
### Best practices
|
||||
|
||||
- It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Not configured**.
|
||||
- It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Not configured**.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -23,11 +23,11 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in.
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in.
|
||||
|
||||
Before attempting this process, ensure you have read [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps.
|
||||
|
||||
On at least two endpoints that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by following this process:
|
||||
On at least two devices that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by taking the following steps:
|
||||
|
||||
1. Open an administrator-level version of the command prompt as follows:
|
||||
|
||||
@ -37,19 +37,15 @@ On at least two endpoints that are not reporting or showing up in Update Complia
|
||||
|
||||
c. Enter administrator credentials or approve the prompt.
|
||||
|
||||
2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
|
||||
2. Navigate to the Windows Defender directory. By default, this is `C:\Program Files\Windows Defender`.
|
||||
|
||||
```Dos
|
||||
cd c:\program files\windows\defender
|
||||
```
|
||||
|
||||
3. Enter the following command and press **Enter**
|
||||
3. Type the following command, and then press **Enter**
|
||||
|
||||
```Dos
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
|
||||
4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
|
||||
4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`.
|
||||
|
||||
5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us.
|
||||
|
||||
|
||||
@ -32,11 +32,11 @@ You can manage and configure Windows Defender Antivirus with the following tools
|
||||
- Windows Management Instrumentation (WMI)
|
||||
- The mpcmdrun.exe utility
|
||||
|
||||
The topics in this section provide further information, links, and resources for using these tools to manage and configure Windows Defender Antivirus.
|
||||
The articles in this section provide further information, links, and resources for using these tools to manage and configure Windows Defender Antivirus.
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
Article | Description
|
||||
---|---
|
||||
[Manage Windows Defender Antivirus with Microsoft Intune and System Center Configuration Manager](use-intune-config-manager-windows-defender-antivirus.md)|Information about using Intune and System Center Configuration Manager to deploy, manage, report, and configure Windows Defender Antivirus
|
||||
[Manage Windows Defender Antivirus with Group Policy settings](use-group-policy-windows-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates
|
||||
|
||||
@ -12,7 +12,6 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 10/25/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -30,11 +29,11 @@ See [Configure device restriction settings in Microsoft Intune](https://docs.mic
|
||||
|
||||
<a id="ref1"></a>
|
||||
|
||||
**Use Configuration Manager to configure scanning options:**
|
||||
## Use Configuration Manager to configure scanning options:
|
||||
|
||||
See [How to create and deploy antimalware policies: Scan settings](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring System Center Configuration Manager (current branch).
|
||||
|
||||
**Use Group Policy to configure scanning options**
|
||||
## Use Group Policy to configure scanning options
|
||||
|
||||
To configure the Group Policy settings described in the following table:
|
||||
|
||||
@ -63,15 +62,15 @@ Specify the level of subfolders within an archive folder to scan | Scan > Specif
|
||||
>[!NOTE]
|
||||
>If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives.
|
||||
|
||||
**Use PowerShell to configure scanning options**
|
||||
## Use PowerShell to configure scanning options
|
||||
|
||||
See [Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
|
||||
|
||||
**Use WMI to configure scanning options**
|
||||
## Use WMI to configure scanning options
|
||||
|
||||
For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx).
|
||||
|
||||
### Email scanning limitations
|
||||
## Email scanning limitations
|
||||
|
||||
We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 80 KiB |
@ -66,7 +66,7 @@ Tamper protection doesn't prevent you from viewing your security settings. And,
|
||||
>
|
||||
> Once you’ve made this update, tamper protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors.
|
||||
|
||||
If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to turn tamper protection on or off. You must have appropriate admin permissions on your machine to perform the following task.
|
||||
If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to turn tamper protection on or off. You must have appropriate admin permissions on your machine to do this.
|
||||
|
||||
1. Click **Start**, and start typing *Defender*. In the search results, select **Windows Security**.
|
||||
|
||||
@ -76,21 +76,24 @@ If you are a home user, or you are not subject to settings managed by a security
|
||||
|
||||
Here's what you see in the Windows Security app:
|
||||
|
||||
|
||||
|
||||
|
||||
## Turn tamper protection on (or off) for your organization using Intune
|
||||
|
||||
If you are part of your organization's security team, you can turn tamper protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). (This feature is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) (Microsoft Defender ATP) and that you meet the prerequisites listed below.)
|
||||
If you are part of your organization's security team, and your subscription includes [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the Microsoft 365 Device Management portal ([https://aka.ms/intuneportal](https://aka.ms/intuneportal)).
|
||||
|
||||
> [!NOTE]
|
||||
> The ability to manage tamper protection in Intune is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) (Microsoft Defender ATP) and that you meet the prerequisites listed below.
|
||||
|
||||
You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task.
|
||||
|
||||
1. Make sure your organization meets all of the following requirements:
|
||||
|
||||
- Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in Microsoft 365 E5. See [Microsoft 365 Enterprise overview](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview) for more details.)
|
||||
- Your organization's devices must be managed by [Intune](https://docs.microsoft.com/intune/device-management-capabilities).
|
||||
- Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in [Microsoft 365 E5](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview)).
|
||||
- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; this is included in Microsoft 365 E5.)
|
||||
- Your Windows machines must be running Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later. (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) for more details about releases.)
|
||||
- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).
|
||||
- Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). (See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md).)
|
||||
- Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md).)
|
||||
|
||||
2. Go to the Microsoft 365 Device Management portal ([https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com)) and sign in with your work or school account.
|
||||
|
||||
@ -116,7 +119,7 @@ Here's what you see in the Windows Security app:
|
||||
|
||||
### Are you using Windows OS 1709, 1803, or 1809?
|
||||
|
||||
If you are using Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, the one of the following procedures to determine whether tamper protection is enabled.
|
||||
If you are using Windows OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, you can use PowerShell to determine whether tamper protection is enabled.
|
||||
|
||||
#### Use PowerShell to determine whether tamper protection is turned
|
||||
|
||||
@ -126,16 +129,6 @@ If you are using Windows OS [1709](https://docs.microsoft.com/windows/release-in
|
||||
|
||||
3. In the list of results, look for `IsTamperProtected`. (A value of *true* means tamper protection is enabled.)
|
||||
|
||||
#### View a registry key value to determine whether tamper protection is turned on
|
||||
|
||||
1. Open the Registry Editor app.
|
||||
|
||||
2. Go to **HKEY_LOCAL_MACHINE** > **SOFTWARE** > **Microsoft** > **Windows Defender** > **Features**.
|
||||
|
||||
3. Look for an entry of **TamperProtection** of type **REG_DWORD**, with a value of **0x5**.<br/>
|
||||
- If you see **TamperProtection** with a value of **0**, tamper protection is not turned on.
|
||||
- If you do not see **TamperProtection** at all, tamper protection is not turned on.
|
||||
|
||||
## View information about tampering attempts
|
||||
|
||||
Tampering attempts typically indicate bigger cyberattacks. Bad actors try to change security settings as a way to persist and stay undetected. If you're part of your organization's security team, you can view information about such attempts, and then take appropriate actions to mitigate threats.
|
||||
|
||||
@ -12,7 +12,6 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -127,8 +126,8 @@ See the following for more information:
|
||||
3. Select **Windows Defender Offline scan** and click **Scan now**.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1607, the offline scan could be run from under **Windows Settings** > **Update & security** > **Windows Defender** or from the Windows Defender client.
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1607, the offline scan could be run from under **Windows Settings** > **Update & security** > **Windows Defender** or from the Windows Defender client.
|
||||
|
||||
|
||||
## Review scan results
|
||||
|
||||
@ -12,7 +12,6 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -47,7 +46,7 @@ See the [Windows Security topic](/windows/threat-protection/windows-defender-sec
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar).
|
||||
|
||||
|
||||
|
||||
|
||||
## Comparison of settings and functions of the old app and the new app
|
||||
|
||||
@ -96,7 +95,7 @@ This section describes how to perform some of the most common tasks when reviewi
|
||||
|
||||
3. Click **Virus & threat protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check this against the latest version available for manual download, or review the change log for that version.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Click **Check for updates** to download new protection updates (if there are any).
|
||||
|
||||
@ -111,9 +110,9 @@ This section describes how to perform some of the most common tasks when reviewi
|
||||
|
||||
4. Toggle the **Real-time protection** switch to **On**.
|
||||
|
||||
>[!NOTE]
|
||||
>If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats.
|
||||
>If you install another antivirus product, Windows Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md).
|
||||
>[!NOTE]
|
||||
>If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats.
|
||||
>If you install another antivirus product, Windows Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md).
|
||||
|
||||
|
||||
<a id="exclusions"></a>
|
||||
@ -129,18 +128,20 @@ This section describes how to perform some of the most common tasks when reviewi
|
||||
4. Under the **Exclusions** setting, click **Add or remove exclusions**.
|
||||
|
||||
5. Click the plus icon to choose the type and set the options for each exclusion.
|
||||
|
||||
<a id="detection-history"></a>
|
||||
|
||||
### Review threat detection history in the Windows Defender Security Center app
|
||||
1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar).
|
||||
|
||||
3. Click **Threat history**.
|
||||
|
||||
4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**, **Allowed threats**).
|
||||
|
||||
1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or
|
||||
searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar).
|
||||
|
||||
3. Click **Threat history**
|
||||
|
||||
4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**,
|
||||
**Allowed threats**).
|
||||
|
||||
<a id="ransomware"></a>
|
||||
|
||||
### Set ransomware protection and recovery options
|
||||
|
||||
@ -40,7 +40,7 @@ Before you begin this process, you need to create a WDAC policy binary file. If
|
||||
>
|
||||
> - An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it by using the Local Group Policy Editor.
|
||||
|
||||
3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard**, and then select **Deploy Windows Defender Application Control**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1.
|
||||
3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Device Guard**, and then select **Deploy Windows Defender Application Control**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1.
|
||||
|
||||
> [!Note]
|
||||
>
|
||||
|
||||
@ -67,7 +67,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru
|
||||
| **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.|
|
||||
| **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. |
|
||||
| **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. |
|
||||
| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection of enforcing user-writeability and only allowing admin-writeable locations. |
|
||||
| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for the path specified in the FilePathRule parameter of the New-CIPolicyRule cmdlet. |
|
||||
| **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. |
|
||||
|
||||
## Windows Defender Application Control file rule levels
|
||||
|
||||
Reference in New Issue
Block a user