mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 15:27:22 +00:00
Merge branch 'main' into v-smandalika-edit-3-of-4318240
This commit is contained in:
Siddarth Mandalika
GitHub
commit
608713925a
@ -12,8 +12,10 @@ items:
|
||||
items:
|
||||
- name: Overview
|
||||
href: windows-11-se-overview.md
|
||||
- name: Settings and CSP list
|
||||
- name: Settings list
|
||||
href: windows-11-se-settings-list.md
|
||||
- name: Frequently Asked Questions (FAQ)
|
||||
href: windows-11-se-faq.yml
|
||||
- name: Windows in S Mode
|
||||
items:
|
||||
- name: Test Windows 10 in S mode on existing Windows 10 education devices
|
||||
|
||||
@ -33,15 +33,10 @@ This [table][INT-1] describes the ideal scenarios for using either option. It's
|
||||
:::image type="content" source="./images/enroll.png" alt-text="The device lifecycle for Intune-managed devices - enrollment" border="false":::
|
||||
|
||||
Select one of the following options to learn the next steps about the enrollment method you chose:
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Next: Automatic Intune enrollment via Azure AD join >](enroll-aadj.md)
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Next: Bulk enrollment with provisioning packages >](enroll-package.md)
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Next: Enroll devices with Windows Autopilot >](enroll-autopilot.md)
|
||||
> [!div class="op_single_selector"]
|
||||
> - [Automatic Intune enrollment via Azure AD join](enroll-aadj.md)
|
||||
> - [Bulk enrollment with provisioning packages](enroll-package.md)
|
||||
> - [Enroll devices with Windows Autopilot ](enroll-autopilot.md)
|
||||
|
||||
<!-- Reference links in article -->
|
||||
|
||||
|
||||
68
education/windows/windows-11-se-faq.yml
Normal file
68
education/windows/windows-11-se-faq.yml
Normal file
@ -0,0 +1,68 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: Windows 11 SE Frequently Asked Questions (FAQ)
|
||||
description: Use these frequently asked questions (FAQ) to learn important details about Windows 11 SE.
|
||||
ms.prod: windows
|
||||
ms.technology: windows
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
manager: aaroncz
|
||||
ms.reviewer:
|
||||
ms.collection: education
|
||||
ms.topic: faq
|
||||
localizationpriority: medium
|
||||
ms.date: 09/14/2022
|
||||
appliesto:
|
||||
- ✅ <b>Windows 11 SE</b>
|
||||
|
||||
title: Common questions about Windows 11 SE
|
||||
summary: Windows 11 SE combines the power and privacy of Windows 11 with educator feedback to create a simplified experience on devices built for education. This Frequently Asked Questions (FAQ) article is intended to help you learn more about Windows 11 SE so you can get to what matters most.
|
||||
|
||||
sections:
|
||||
- name: General
|
||||
questions:
|
||||
- question: What is Windows 11 SE?
|
||||
answer: |
|
||||
Windows 11 SE is a new cloud-first operating system that offers the power and reliability of Windows 11 with a simplified design and tools specially designed for schools.
|
||||
To learn more, see [Windows 11 SE Overview](/education/windows/windows-11-se-overview).
|
||||
- question: Who is the Windows 11 SE designed for?
|
||||
answer: |
|
||||
Windows 11 SE is designed for students in grades K-8 who use a laptop provided by their school, in a 1:1 scenario.
|
||||
- question: What are the major differences between Windows 11 and Windows 11 SE?
|
||||
answer: |
|
||||
Windows 11 SE was created based on feedback from educators who wanted a distraction-free experience for their students. Here are some of the differences that you'll find in Windows 11 SE:
|
||||
- Experience a simplified user interface so you can stay focused on the important stuff
|
||||
- Only IT admins can install apps. Users will not be able to access the Microsoft Store or download apps from the internet
|
||||
- Use Snap Assist to maximize screen space on smaller screens with two-window snapping
|
||||
- Store your Desktop, Documents, and Photos folders in the cloud using OneDrive, so your work is backed up and easy to find
|
||||
- Express yourself and celebrate accomplishments with the *emoji and GIF panel* and *Stickers*
|
||||
- name: Deployment
|
||||
questions:
|
||||
- question: Can I load Windows 11 SE on any hardware?
|
||||
answer: |
|
||||
Windows 11 SE is only available on devices that are built for education. To learn more, see [Windows 11 SE Overview](/education/windows/windows-11-se-overview).
|
||||
- name: Applications and settings
|
||||
questions:
|
||||
- question: How can I install applications on Windows 11 SE?
|
||||
answer: |
|
||||
You can use Microsoft Intune to install applications on Windows 11 SE.
|
||||
For more information, see [Configure applications with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-apps).
|
||||
- question: What apps will work on Windows 11 SE?
|
||||
answer: |
|
||||
Windows 11 SE supports all web applications and a curated list of desktop applications. You can prepare and add a desktop app to Microsoft Intune as a Win32 app from the [approved app list](/education/windows/windows-11-se-overview), then distribute it.
|
||||
For more information, see [Considerations for Windows 11 SE](/education/windows/tutorial-school-deployment/configure-device-apps#considerations-for-windows-11-se).
|
||||
- question: Why there's no application store on Windows 11 SE?
|
||||
answer: |
|
||||
IT Admins can manage system settings (including application installation and the application store) to ensure all students have a safe, distraction-free experience. On Windows SE devices, you have pre-installed apps from Microsoft, from your IT admin, and from your device manufacturer. You can continue to use web apps on the Microsoft Edge browser, as web apps do not require installation.
|
||||
For more information, see [Configure applications with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-app).
|
||||
- question: What does the error 0x87D300D9 mean in the Intune for Education portal?
|
||||
answer: |
|
||||
This error means that the app you are trying to install is not supported on Windows 11 SE. If you have an app that fails with this error, then:
|
||||
- Make sure the app is on the [available applications list](/education/windows/windows-11-se-overview#available-applications). Or, make sure your app is [approved for Windows 11 SE](/education/windows/windows-11-se-overview#add-your-own-applications)
|
||||
- If the app is approved, then it's possible the app is not packaged correctly. For more information, [Configure applications with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-apps)
|
||||
- If the app isn't approved, then it won't run on Windows 11 SE. To get apps approved, see [Add your own applications](/education/windows/windows-11-se-overview#add-your-own-applications). Or, use an app that runs in a web browser, such as a web app or PWA
|
||||
- name: Out-of-box experience (OOBE)
|
||||
questions:
|
||||
- question: My Windows 11 SE device is stuck in OOBE, how can I troubleshoot it?
|
||||
answer: |
|
||||
To access the Settings application during OOBE on a Windows 11 SE device, press <kbd>Shift</kbd>+<kbd>F10</kbd>, then select the accessibility icon :::image type="icon" source="images/icons/accessibility.svg"::: on the bottom-right corner of the screen. From the Settings application, you can troubleshoot the OOBE process and, optionally, trigger a device reset.
|
||||
@ -88,7 +88,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us
|
||||
|-----------------------------------------|-------------------|----------|------------------------------|
|
||||
| AirSecure | 8.0.0 | Win32 | AIR |
|
||||
| Alertus Desktop | 5.4.44.0 | Win32 | Alertus technologies |
|
||||
| Brave Browser | 1.34.80 | Win32 | Brave |
|
||||
| Brave Browser | 106.0.5249.65 | Win32 | Brave |
|
||||
| Bulb Digital Portfolio | 0.0.7.0 | Store | Bulb |
|
||||
| CA Secure Browser | 14.0.0 | Win32 | Cambium Development |
|
||||
| Cisco Umbrella | 3.0.110.0 | Win32 | Cisco |
|
||||
@ -167,14 +167,6 @@ When the app is ready, Microsoft will update you. Then, you add the app to the I
|
||||
|
||||
For more information on Intune requirements for adding education apps, see [Configure applications with Microsoft Intune][EDUWIN-1].
|
||||
|
||||
### 0x87D300D9 error with an app
|
||||
|
||||
When you deploy an app using Intune for Education, you may get a `0x87D300D9` error code with a `Failed` state in the [Intune for Education portal](https://intuneeducation.portal.azure.com). If you have an app that fails with this error, then:
|
||||
|
||||
- Make sure the app is on the [available applications list](#available-applications). Or, make sure your app is [approved for Windows 11 SE](#add-your-own-applications)
|
||||
- If the app is approved, then it's possible the app is packaged wrong. For more information, see [Add your own apps](#add-your-own-applications) and [Configure applications with Microsoft Intune][EDUWIN-1]
|
||||
- If the app isn't approved, then it won't run on Windows 11 SE. To get apps approved, see [Add your own apps](#add-your-own-applications). Or, use an app that runs in a web browser, such as a web app or PWA
|
||||
|
||||
## Related articles
|
||||
|
||||
- [Tutorial: deploy and manage Windows devices in a school][EDUWIN-2]
|
||||
|
||||
@ -17,7 +17,7 @@ appliesto:
|
||||
|
||||
# Windows 11 SE for Education settings list
|
||||
|
||||
Windows 11 SE automatically configures settings and features in the operating system. These settings use the Configuration Service Provider (CSPs) provided by Microsoft. You can use an MDM provider to configure these settings.
|
||||
Windows 11 SE automatically configures certain settings and features in the operating system. You can use Microsoft Intune to customize these settings.
|
||||
|
||||
This article lists the settings automatically configured. For more information on Windows 11 SE, see [Windows 11 SE for Education overview](windows-11-se-overview.md).
|
||||
|
||||
@ -61,45 +61,6 @@ The following settings can't be changed.
|
||||
| Administrative tools | Administrative tools, such as the command prompt and Windows PowerShell, can't be opened. Windows PowerShell scripts deployed using Microsoft Endpoint Manager can run. |
|
||||
| Apps | Only certain apps are allowed to run on Windows 11 SE. For more info on what apps can run on Windows 11 SE, see [Windows 11 SE for Education overview](windows-11-se-overview.md). |
|
||||
|
||||
## What's available in the Settings app
|
||||
|
||||
On Windows 11 SE devices, the Settings app shows the following setting pages. Depending on the hardware, some setting pages might not be shown.
|
||||
|
||||
- Accessibility
|
||||
|
||||
- Accounts
|
||||
- Email & accounts
|
||||
|
||||
- Apps
|
||||
|
||||
- Bluetooth & devices
|
||||
- Bluetooth
|
||||
- Printers & scanners
|
||||
- Mouse
|
||||
- Touchpad
|
||||
- Typing
|
||||
- Pen
|
||||
- AutoPlay
|
||||
|
||||
- Network & internet
|
||||
- WiFi
|
||||
- VPN
|
||||
|
||||
- Personalization
|
||||
- Taskbar
|
||||
|
||||
- Privacy & security
|
||||
|
||||
- System
|
||||
- Display
|
||||
- Notifications
|
||||
- Tablet mode
|
||||
- Multitasking
|
||||
- Projecting to this PC
|
||||
|
||||
- Time & Language
|
||||
- Language & region
|
||||
|
||||
## Next steps
|
||||
|
||||
[Windows 11 SE for Education overview](windows-11-se-overview.md)
|
||||
|
||||
@ -52,7 +52,7 @@ ms.date: 08/01/2022
|
||||
- [Experience/AllowManualMDMUnenrollment](policy-csp-experience.md#experience-allowmanualmdmunenrollment)
|
||||
- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
|
||||
- [MixedReality/AADGroupMembershipCacheValidityInDays](./policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays) <sup>9</sup>
|
||||
- [MixedReality/AllowCaptivePortalBeforeSignIn](./policy-csp-mixedreality.md#mixedreality-allowcaptiveportalpeforesignin) <sup>Insider</sup>
|
||||
- [MixedReality/AllowCaptivePortalBeforeLogon](./policy-csp-mixedreality.md#mixedreality-allowcaptiveportalpeforelogon) <sup>Insider</sup>
|
||||
- [MixedReality/AllowLaunchUriInSingleAppKiosk](./policy-csp-mixedreality.md#mixedreality-allowlaunchuriinsingleappkiosk)<sup>10</sup>
|
||||
- [MixedReality/AutoLogonUser](./policy-csp-mixedreality.md#mixedreality-autologonuser) <sup>11</sup>
|
||||
- [MixedReality/BrightnessButtonDisabled](./policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled) <sup>9</sup>
|
||||
|
||||
@ -23,7 +23,7 @@ manager: aaroncz
|
||||
<a href="#mixedreality-aadgroupmembershipcachevalidityindays">MixedReality/AADGroupMembershipCacheValidityInDays</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#mixedreality-allowcaptiveportalpeforesignin">MixedReality/AllowCaptivePortalBeforeSignIn</a>
|
||||
<a href="#mixedreality-allowcaptiveportalpeforelogon">MixedReality/AllowCaptivePortalBeforeLogon</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#mixedreality-allowlaunchuriinsingleappkiosk">MixedReality/AllowLaunchUriInSingleAppKiosk</a>
|
||||
@ -103,7 +103,7 @@ Steps to use this policy correctly:
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="mixedreality-allowcaptiveportalpeforesignin"></a>**MixedReality/AllowCaptivePortalBeforeSignIn**
|
||||
<a href="" id="mixedreality-allowcaptiveportalpeforelogon"></a>**MixedReality/AllowCaptivePortalBeforeLogon**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
|
||||
@ -127,11 +127,14 @@ Steps to use this policy correctly:
|
||||
<!--Description-->
|
||||
This new feature is an opt-in policy that IT Admins can enable to help with the setup of new devices in new areas or new users. When this policy is turned on it allows a captive portal on the sign-in screen, which allows a user to enter credentials to connect to the Wi-Fi access point. If enabled, sign in will implement similar logic as OOBE to display captive portal if necessary.
|
||||
|
||||
MixedReality/AllowCaptivePortalBeforeSignIn
|
||||
MixedReality/AllowCaptivePortalBeforeLogon
|
||||
|
||||
The OMA-URI of new policy: `./Device/Vendor/MSFT/Policy/Config/MixedReality/AllowCaptivePortalBeforeSignIn`
|
||||
The OMA-URI of new policy: `./Device/Vendor/MSFT/Policy/Config/MixedReality/AllowCaptivePortalBeforeLogon`
|
||||
|
||||
Bool value
|
||||
Int value
|
||||
|
||||
- 0: (Default) Off
|
||||
- 1: On
|
||||
|
||||
<!--/Description-->
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ appliesto:
|
||||
|
||||
## Default Enablement
|
||||
|
||||
Starting with Windows 11 Enterprise 22H2, compatible systems have Windows Defender Credential Guard turned on by default. This changes the default state of the feature in Windows, though system administrators can still modify this enablement state. Windows Defender Credential Guard can still be manually [enabled](#enable-windows-defender-credential-guard) or [disabled](#disable-windows-defender-credential-guard) via the methods documented below.
|
||||
Starting in **Windows 11 Enterprise, version 22H2** and **Windows 11 Education, version 22H2**, compatible systems have Windows Defender Credential Guard turned on by default. This changes the default state of the feature in Windows, though system administrators can still modify this enablement state. Windows Defender Credential Guard can still be manually [enabled](#enable-windows-defender-credential-guard) or [disabled](#disable-windows-defender-credential-guard) via the methods documented below.
|
||||
|
||||
### Requirements for automatic enablement
|
||||
|
||||
@ -33,18 +33,26 @@ Windows Defender Credential Guard will be enabled by default when a PC meets the
|
||||
|
||||
|Component|Requirement|
|
||||
|---|---|
|
||||
|Operating System|Windows 11 Enterprise 22H2|
|
||||
|Operating System|**Windows 11 Enterprise, version 22H2** or **Windows 11 Education, version 22H2**|
|
||||
|Existing Windows Defender Credential Guard Requirements|Only devices which meet the [existing hardware and software requirements](credential-guard-requirements.md#hardware-and-software-requirements) to run Windows Defender Credential Guard will have it enabled by default.|
|
||||
|Virtualization-based Security (VBS) Requirements|VBS must be enabled in order to run Windows Defender Credential Guard. Starting with Windows 11 Enterprise 22H2, devices that meet the requirements to run Windows Defender Credential Guard as well as the [minimum requirements to enable VBS](/windows-hardware/design/device-experiences/oem-vbs) will have both Windows Defender Credential Guard and VBS enabled by default.
|
||||
|Virtualization-based Security (VBS) Requirements|VBS must be enabled in order to run Windows Defender Credential Guard. Starting with Windows 11 Enterprise 22H2 and Windows 11 Education 22H2, devices that meet the requirements to run Windows Defender Credential Guard as well as the [minimum requirements to enable VBS](/windows-hardware/design/device-experiences/oem-vbs) will have both Windows Defender Credential Guard and VBS enabled by default.
|
||||
|
||||
> [!NOTE]
|
||||
> If Windows Defender Credential Guard or VBS has previously been explicitly disabled, default enablement will not overwrite this setting.
|
||||
|
||||
> [!NOTE]
|
||||
> Devices running Windows 11 Pro 22H2 may have Virtualization-Based Security (VBS) and/or Windows Defender Credential Guard automaticaly enabled if they meet the other requirements for default enablement listed above and have previously run Windows Defender Credential Guard (for example if Windows Defender Credential Guard was running on an Enterprise device that later downgraded to Pro).
|
||||
>
|
||||
> To determine whether the Pro device is in this state, check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. In this scenario, if you wish to disable VBS and Windows Defender Credential Guard, follow the instructions for [disabling Virtualization-Based Security](#disabling-virtualization-based-security). If you wish to disable only Windows Defender Credential Guard without disabling Virtualization-Based Security, use the procedures for [disabling Windows Defender Credential Guard](#disable-windows-defender-credential-guard).
|
||||
|
||||
## Enable Windows Defender Credential Guard
|
||||
|
||||
Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the [Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard hardware readiness tool](#enable-windows-defender-credential-guard-by-using-the-hvci-and-windows-defender-credential-guard-hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
|
||||
The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines.
|
||||
|
||||
> [!NOTE]
|
||||
> Credential Guard and Device Guard are not supported when using Azure Gen 1 VMs. These options are available with Gen 2 VMs only.
|
||||
|
||||
### Enable Windows Defender Credential Guard by using Group Policy
|
||||
|
||||
You can use Group Policy to enable Windows Defender Credential Guard. This will add and enable the virtualization-based security features for you if needed.
|
||||
@ -230,24 +238,54 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
|
||||
## Disable Windows Defender Credential Guard
|
||||
|
||||
To disable Windows Defender Credential Guard, you can use the following set of procedures or the [HVCI and Windows Defender Credential Guard hardware readiness tool](#disable-windows-defender-credential-guard-by-using-the-hvci-and-windows-defender-credential-guard-hardware-readiness-tool). If Credential Guard was enabled with UEFI Lock then you must use the following procedure as the settings are persisted in EFI (firmware) variables and it will require physical presence at the machine to press a function key to accept the change. If Credential Guard was enabled without UEFI Lock then you can turn it off by using Group Policy.
|
||||
Windows Defender Credential Guard can be disabled via several methods explained below, depending on how the feature was enabled. For devices that had Windows Defender Credential Guard automatically enabled in the 22H2 update and did not have it enabled prior to the update, it is sufficient to [disable via Group Policy](#disabling-windows-defender-credential-guard-using-group-policy).
|
||||
|
||||
1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn on Virtualization Based Security**).
|
||||
If Windows Defender Credential Guard was enabled with UEFI Lock, the procedure described in [Disabling Windows Defender Credential Guard with UEFI Lock](#disabling-windows-defender-credential-guard-with-uefi-lock) must be followed. Note that the default enablement change in eligible 22H2 devices does **not** use a UEFI Lock.
|
||||
|
||||
1. Delete the following registry settings:
|
||||
If Windows Defender Credential Guard was enabled via Group Policy without UEFI Lock, Windows Defender Credential Guard should be [disabled via Group Policy](#disabling-windows-defender-credential-guard-using-group-policy).
|
||||
|
||||
Otherwise, Windows Defender Credential Guard can be [disabled by changing registry keys](#disabling-windows-defender-credential-guard-using-registry-keys).
|
||||
|
||||
Windows Defender Credential Guard running in a virtual machine can be [disabled by the host](#disable-windows-defender-credential-guard-for-a-virtual-machine).
|
||||
|
||||
For information on disabling Virtualization-Based Security (VBS), see [Disabling Virtualization-Based Security](#disabling-virtualization-based-security).
|
||||
|
||||
### Disabling Windows Defender Credential Guard using Group Policy
|
||||
|
||||
If Windows Defender Credential Guard was enabled via Group Policy and without UEFI Lock, disabling the same Group Policy setting will disable Windows Defender Credential Guard.
|
||||
|
||||
1. Disable the Group Policy setting that governs Windows Defender Credential Guard. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn on Virtualization Based Security**. In the "Credential Guard Configuration" section, set the dropdown value to "Disabled":
|
||||
|
||||
:::image type="content" source="images/credguard-gp-disabled.png" alt-text="Windows Defender Credential Guard Group Policy set to Disabled.":::
|
||||
|
||||
1. Restart the machine.
|
||||
|
||||
### Disabling Windows Defender Credential Guard using Registry Keys
|
||||
|
||||
If Windows Defender Credential Guard was enabled without UEFI Lock and without Group Policy, it is sufficient to edit the registry keys as described below to disable Windows Defender Credential Guard.
|
||||
|
||||
1. Change the following registry settings to 0:
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LsaCfgFlags`
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags`
|
||||
|
||||
1. If you also wish to disable virtualization-based security delete the following registry settings:
|
||||
> [!NOTE]
|
||||
> Deleting these registry settings may not disable Windows Defender Credential Guard. They must be set to a value of 0.
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity`
|
||||
1. Restart the machine.
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures`
|
||||
### Disabling Windows Defender Credential Guard with UEFI Lock
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery.
|
||||
If Windows Defender Credential Guard was enabled with UEFI Lock enabled, then the following procedure must be followed since the settings are persisted in EFI (firmware) variables. This scenario will require physical presence at the machine to press a function key to accept the change.
|
||||
|
||||
1. If Group Policy was used to enable Windows Defender Credential Guard, disable the relevant Group Policy setting. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn on Virtualization Based Security**. In the "Credential Guard Configuration" section, set the dropdown value to "Disabled".
|
||||
|
||||
1. Change the following registry settings to 0:
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LsaCfgFlags`
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags`
|
||||
|
||||
1. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands:
|
||||
|
||||
@ -262,37 +300,7 @@ To disable Windows Defender Credential Guard, you can use the following set of p
|
||||
mountvol X: /d
|
||||
```
|
||||
|
||||
1. Restart the PC.
|
||||
|
||||
1. Accept the prompt to disable Windows Defender Credential Guard.
|
||||
|
||||
1. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard.
|
||||
|
||||
> [!NOTE]
|
||||
> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings:
|
||||
>
|
||||
> ```cmd
|
||||
> bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
|
||||
> bcdedit /set vsmlaunchtype off
|
||||
> ```
|
||||
|
||||
For more info on virtualization-based security and HVCI, see [Enable virtualization-based protection of code integrity](../../threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md).
|
||||
|
||||
> [!NOTE]
|
||||
> Credential Guard and Device Guard are not supported when using Azure Gen 1 VMs. These options are available with Gen 2 VMs only.
|
||||
|
||||
### Disable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```powershell
|
||||
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
>
|
||||
> This is a known issue.
|
||||
1. Restart the PC. Before the OS boots, a prompt will appear notifying that UEFI was modified, and asking for confirmation. This prompt must be confirmed for the changes to persist. This step requires physical access to the machine.
|
||||
|
||||
### Disable Windows Defender Credential Guard for a virtual machine
|
||||
|
||||
@ -301,3 +309,31 @@ From the host, you can disable Windows Defender Credential Guard for a virtual m
|
||||
```powershell
|
||||
Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
||||
```
|
||||
|
||||
## Disabling Virtualization-Based Security
|
||||
|
||||
Instructions are given below for how to disable Virtualization-Based Security (VBS) entirely, rather than just Windows Defender Credential Guard. Disabling Virtualization-Based Security will automatically disable Windows Defender Credential Guard and other features that rely on VBS.
|
||||
|
||||
> [!IMPORANT]
|
||||
> Other security features in addition to Windows Defender Credential Guard rely on Virtualization-Based Security in order to run. Disabling Virtualization-Based Security may have unintended side effects.
|
||||
|
||||
1. If Group Policy was used to enable Virtualization-Based Security, set the Group Policy setting that was used to enable it (**Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn on Virtualization Based Security**) to "Disabled".
|
||||
|
||||
1. Delete the following registry settings:
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity`
|
||||
|
||||
- `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures`
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery.
|
||||
|
||||
1. If Windows Defender Credential Guard is running when disabling Virtualization-Based Security and either feature was enabled with UEFI Lock, the EFI (firmware) variables must be cleared using bcdedit. From an elevated command prompt, run the following bcdedit commands after turning off all Virtualization-Based Security Group Policy and registry settings as described in steps 1 and 2 above:
|
||||
|
||||
>
|
||||
> ```cmd
|
||||
> bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
|
||||
> bcdedit /set vsmlaunchtype off
|
||||
> ```
|
||||
|
||||
1. Restart the PC.
|
||||
|
||||
@ -101,7 +101,7 @@ The following tables describe baseline protections, plus protections for improve
|
||||
|Hardware: **Trusted Platform Module (TPM)**|**Requirement**: </br> - TPM 1.2 or TPM 2.0, either discrete or firmware. [TPM recommendations](../../information-protection/tpm/tpm-recommendations.md)|A TPM provides protection for VBS encryption keys that are stored in the firmware. TPM helps protect against attacks involving a physically present user with BIOS access.|
|
||||
|Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot**|**Requirements**: </br> - See the following Windows Hardware Compatibility Program requirement: System.Fundamentals.Firmware.UEFISecureBoot|UEFI Secure Boot helps ensure that the device boots only authorized code, and can prevent boot kits and root kits from installing and persisting across reboots.|
|
||||
|Firmware: **Secure firmware update process**|**Requirements**: </br> - UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: System.Fundamentals.Firmware.UEFISecureBoot.|UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed.|
|
||||
|Software: Qualified **Windows operating system**|**Requirement**: </br> - At least Windows 10 Enterprise or Windows Server 2016.|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard.|
|
||||
|Software: Qualified **Windows operating system**|**Requirement**: </br> - At least Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016.|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard.|
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 200 KiB |
@ -6,11 +6,11 @@ ms.prod: m365-security
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: jogeurte
|
||||
ms.reviewer: aaroncz
|
||||
ms.author: jogeurte
|
||||
ms.manager: jsuther
|
||||
manager: dansimp
|
||||
ms.date: 03/08/2022
|
||||
ms.date: 10/06/2022
|
||||
ms.technology: windows-sec
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
@ -27,13 +27,15 @@ ms.localizationpriority: medium
|
||||
>[!NOTE]
|
||||
>Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
|
||||
|
||||
This topic describes how to deploy Windows Defender Application Control (WDAC) policies using script. The instructions below use PowerShell but can work with any scripting host.
|
||||
This article describes how to deploy Windows Defender Application Control (WDAC) policies using script. The instructions below use PowerShell but can work with any scripting host.
|
||||
|
||||
> [!NOTE]
|
||||
> To use this procedure, download and distribute the [WDAC policy refresh tool](https://aka.ms/refreshpolicy) to all managed endpoints. Ensure your WDAC policies allow the WDAC policy refresh tool or use a managed installer to distribute the tool.
|
||||
|
||||
## Deploying policies for Windows 10 version 1903 and above
|
||||
|
||||
You should now have one or more WDAC policies converted into binary form. If not, follow the steps described in [Deploying Windows Defender Application Control (WDAC) policies](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide).
|
||||
|
||||
1. Initialize the variables to be used by the script.
|
||||
|
||||
```powershell
|
||||
@ -49,7 +51,7 @@ This topic describes how to deploy Windows Defender Application Control (WDAC) p
|
||||
Copy-Item -Path $PolicyBinary -Destination $DestinationFolder -Force
|
||||
```
|
||||
|
||||
3. Repeat steps 1-2 as appropriate to deploy additional WDAC policies.
|
||||
3. Repeat steps 1-2 as appropriate to deploy more WDAC policies.
|
||||
4. Run RefreshPolicy.exe to activate and refresh all WDAC policies on the managed endpoint.
|
||||
|
||||
```powershell
|
||||
@ -82,7 +84,7 @@ This topic describes how to deploy Windows Defender Application Control (WDAC) p
|
||||
|
||||
In addition to the steps outlined above, the binary policy file must also be copied to the device's EFI partition. Deploying your policy via [Microsoft Endpoint Manager](/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune) or the Application Control CSP will handle this step automatically.
|
||||
|
||||
1. Mount the EFI volume and make the directory, if it does not exist, in an elevated PowerShell prompt:
|
||||
1. Mount the EFI volume and make the directory, if it doesn't exist, in an elevated PowerShell prompt:
|
||||
|
||||
```powershell
|
||||
$MountPoint = 'C:\EFIMount'
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: jogeurte
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 06/27/2022
|
||||
ms.date: 10/06/2022
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
@ -31,13 +31,17 @@ ms.technology: windows-sec
|
||||
>
|
||||
> Group Policy-based deployment of Windows Defender Application Control policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for policy deployment.
|
||||
|
||||
Single-policy format Windows Defender Application Control policies (pre-1903 policy schema) can be easily deployed and managed with Group Policy. The following procedure walks you through how to deploy a WDAC policy called **ContosoPolicy.bin** to a test OU called *WDAC Enabled PCs* by using a GPO called **Contoso GPO Test**.
|
||||
Single-policy format Windows Defender Application Control policies (pre-1903 policy schema) can be easily deployed and managed with Group Policy.
|
||||
|
||||
You should now have a WDAC policy converted into binary form. If not, follow the steps described in [Deploying Windows Defender Application Control (WDAC) policies](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide).
|
||||
|
||||
The following procedure walks you through how to deploy a WDAC policy called **SiPolicy.p7b** to a test OU called *WDAC Enabled PCs* by using a GPO called **Contoso GPO Test**.
|
||||
|
||||
To deploy and manage a Windows Defender Application Control policy with Group Policy:
|
||||
|
||||
1. On a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC**
|
||||
|
||||
2. Create a new GPO: right-click an OU and then click **Create a GPO in this domain, and Link it here**.
|
||||
2. Create a new GPO: right-click an OU and then select **Create a GPO in this domain, and Link it here**.
|
||||
|
||||
> [!NOTE]
|
||||
> You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Plan for Windows Defender Application Control lifecycle policy management](../plan-windows-defender-application-control-management.md).
|
||||
@ -46,15 +50,15 @@ To deploy and manage a Windows Defender Application Control policy with Group Po
|
||||
|
||||
3. Name the new GPO. You can choose any name.
|
||||
|
||||
4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**.
|
||||
4. Open the Group Policy Management Editor: right-click the new GPO, and then select **Edit**.
|
||||
|
||||
5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**.
|
||||
5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Windows Defender Application Control** and then select **Edit**.
|
||||
|
||||
|
||||
|
||||
6. In the **Deploy Windows Defender Application Control** dialog box, select the **Enabled** option, and then specify the WDAC policy deployment path.
|
||||
|
||||
In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, with ContosoPolicy.bin on the test computer, the example file path would be C:\\Windows\\System32\\CodeIntegrity\\ContosoPolicy.bin.
|
||||
In this policy setting, you specify either the local path where the policy will exist on each client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, the path to SiPolicy.p7b using the steps described in [Deploying Windows Defender Application Control (WDAC) policies](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) would be %USERPROFILE%\Desktop\SiPolicy.p7b.
|
||||
|
||||
> [!NOTE]
|
||||
> This policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers.
|
||||
@ -62,6 +66,6 @@ To deploy and manage a Windows Defender Application Control policy with Group Po
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
|
||||
> You may have noticed that the GPO setting references a .p7b file, but the file extension and name of the policy binary do not matter. Regardless of what you name your policy binary, they are all converted to SIPolicy.p7b when applied to the client computers running Windows 10. If you are deploying different WDAC policies to different sets of devices, you may want to give each of your WDAC policies a friendly name and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
|
||||
|
||||
7. Close the Group Policy Management Editor, and then restart the Windows test computer. Restarting the computer updates the WDAC policy.
|
||||
|
||||
@ -6,10 +6,10 @@ ms.technology: itpro-security
|
||||
ms.localizationpriority: medium
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.reviewer: jogeurte
|
||||
ms.author: vinpa
|
||||
manager: aaroncz
|
||||
ms.date: 06/27/2022
|
||||
ms.date: 10/06/2022
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
@ -48,19 +48,17 @@ To use Intune's built-in WDAC policies, configure [Endpoint Protection for Windo
|
||||
> [!NOTE]
|
||||
> Policies deployed through Intune custom OMA-URI are subject to a 350,000 byte limit. Customers should create Windows Defender Application Control policies that use signature-based rules, the Intelligent Security Graph, and managed installers where practical. Customers whose devices are running 1903+ builds of Windows are also encouraged to use [multiple policies](../deploy-multiple-windows-defender-application-control-policies.md) which allow more granular policy.
|
||||
|
||||
You should now have one or more WDAC policies converted into binary form. If not, follow the steps described in [Deploying Windows Defender Application Control (WDAC) policies](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide).
|
||||
|
||||
### Deploy custom WDAC policies on Windows 10 1903+
|
||||
|
||||
Beginning with Windows 10 1903, custom OMA-URI policy deployment can use the [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp), which has support for multiple policies and rebootless policies.
|
||||
|
||||
The steps to use Intune's custom OMA-URI functionality are:
|
||||
|
||||
1. Know a generated policy's GUID, which can be found in the policy xml as `<PolicyID>`
|
||||
1. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10).
|
||||
|
||||
2. Convert the policy XML to binary format using the [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) cmdlet in order to be deployed. The binary policy may be signed or unsigned.
|
||||
|
||||
3. Open the Microsoft Intune portal and [create a profile with custom settings](/mem/intune/configuration/custom-settings-windows-10).
|
||||
|
||||
4. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings:
|
||||
2. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings:
|
||||
- **OMA-URI**: `./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy`
|
||||
- **Data type**: Base64 (file)
|
||||
- **Certificate file**: upload your binary format policy file. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf.
|
||||
|
||||
@ -11,9 +11,10 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jgeurten
|
||||
ms.reviewer: isbrahm
|
||||
ms.reviewer: aaroncz
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 10/06/2022
|
||||
---
|
||||
|
||||
# Microsoft recommended driver block rules
|
||||
@ -25,36 +26,32 @@ manager: dansimp
|
||||
- Windows Server 2016 and above
|
||||
|
||||
>[!NOTE]
|
||||
>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md).
|
||||
>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
|
||||
|
||||
Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they're quickly patched and rolled out to the ecosystem. The vulnerable driver blocklist is designed to help harden systems against third party-developed drivers across the Windows ecosystem with any of the following attributes:
|
||||
Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers. When vulnerabilities in drivers are found, we work with our partners to ensure they're quickly patched and rolled out to the ecosystem. The vulnerable driver blocklist is designed to help harden systems against third party-developed drivers across the Windows ecosystem with any of the following attributes:
|
||||
|
||||
- Known security vulnerabilities that can be exploited by attackers to elevate privileges in the Windows kernel
|
||||
- Malicious behaviors (malware) or certificates used to sign malware
|
||||
- Behaviors that aren't malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel
|
||||
|
||||
Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center
|
||||
](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the vulnerable driver blocklist, including updating a block rule once a driver vulnerability has been patched, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article.
|
||||
Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the vulnerable driver blocklist, including updating a block rule once a driver vulnerability has been patched, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article.
|
||||
|
||||
## Microsoft vulnerable driver blocklist
|
||||
|
||||
<!-- MAXADO-6286432 -->
|
||||
|
||||
Microsoft adds the vulnerable versions of the drivers to our vulnerable driver blocklist, which is automatically enabled on devices when any of the listed conditions are met:
|
||||
|
||||
| Condition | Windows 10 or 11 | Windows 11 22H2 or later |
|
||||
|--|:--:|:--:|
|
||||
| Device has [Hypervisor-protected code integrity (HVCI)](../device-guard/enable-virtualization-based-protection-of-code-integrity.md) enabled | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Device is in [S mode](https://support.microsoft.com/windows/windows-10-and-windows-11-in-s-mode-faq-851057d6-1ee9-b9e5-c30b-93baebeebc85#WindowsVersion=Windows_11) | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Device has [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) enabled | :x: | :heavy_check_mark: |
|
||||
| Clean install of Windows | :x: | :heavy_check_mark: |
|
||||
With Windows 11 2022 update, the vulnerable driver blocklist is enabled by default for all devices, and can be turned on or off via the [Windows Security](https://support.microsoft.com/windows/device-protection-in-windows-security-afa11526-de57-b1c5-599f-3a4c6a61c5e2) app. The vulnerable driver blocklist is also enforced when either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode is active. Users can opt in to HVCI using the Windows Security app, and HVCI is on by-default for most new Windows 11 devices.
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft vulnerable driver blocklist can also be enabled using [Windows Security](https://support.microsoft.com/windows/device-protection-in-windows-security-afa11526-de57-b1c5-599f-3a4c6a61c5e2), but the option to disable it is grayed out when HVCI or Smart App Control is enabled, or when the device is in S mode. You must disable HVCI or Smart App Control, or switch the device out of S mode, and restart the device before you can disable Microsoft vulnerable driver blocklist.
|
||||
> The option to turn Microsoft's vulnerable driver blocklist on or off using the [Windows Security](https://support.microsoft.com/windows/device-protection-in-windows-security-afa11526-de57-b1c5-599f-3a4c6a61c5e2) app is grayed out when HVCI, Smart App Control, or S mode is enabled. You must disable HVCI or Smart App Control, or switch the device out of S mode, and restart the device before you can turn off the Microsoft vulnerable driver blocklist.
|
||||
|
||||
The blocklist is updated with each new major release of Windows. We plan to update the current blocklist for non-Windows 11 customers in an upcoming servicing release and will occasionally publish future updates through regular Windows servicing.
|
||||
|
||||
Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we've provided a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, you can use the XML provided below to create your own custom WDAC policies.
|
||||
|
||||
## Blocking vulnerable drivers using WDAC
|
||||
|
||||
Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking this list of drivers within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events.
|
||||
Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking this list of drivers within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) and review the audit block events.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Microsoft also recommends enabling Attack Surface Reduction (ASR) rule [**Block abuse of exploited vulnerable signed drivers**](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference#block-abuse-of-exploited-vulnerable-signed-drivers) to prevent an application from writing a vulnerable signed driver to disk. The ASR rule doesn't block a driver already existing on the system from being loaded, however enabling **Microsoft vulnerable driver blocklist** or applying this WDAC policy prevents the existing driver from being loaded.
|
||||
@ -78,6 +75,12 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Rule>
|
||||
<Option>Enabled:Audit Mode</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Disabled:Script Enforcement</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Update Policy No Reboot</Option>
|
||||
</Rule>
|
||||
</Rules>
|
||||
<!--EKUS-->
|
||||
<EKUs />
|
||||
@ -401,7 +404,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Deny ID="ID_DENY_MHYPROT2_1A" FriendlyName="mhyprot2.sys\B8B94C2646B62F6AC08F16514B6EFAA9866AA3C581E4C0435A7AEAFE569B2418 Hash Sha256" Hash="8CED17D1EE92AE72749AFDFE40F5029223D97F0F977E718BD5AB1242D1FF7CB5" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_1B" FriendlyName="mhyprot2.sys\B8B94C2646B62F6AC08F16514B6EFAA9866AA3C581E4C0435A7AEAFE569B2418 Hash Page Sha1" Hash="1C843C256936E700CEDE3DD444E1B6714EFF4E8B" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_1C" FriendlyName="mhyprot2.sys\B8B94C2646B62F6AC08F16514B6EFAA9866AA3C581E4C0435A7AEAFE569B2418 Hash Page Sha256" Hash="84516365771430545C4D7D950B0F0699EC1573F316EF787983081F027E8A1FC5" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_21" FriendlyName="mhyprot.sys\69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 Hash Sha1" Hash="C771EA59F075170E952C393CFD6FC784B265027C" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_21" FriendlyName="mhyprot.sys\69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 Hash Sha1" Hash="C771EA59F075170E952C393CFD6FC784B265027C" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_22" FriendlyName="mhyprot.sys\69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 Hash Sha256" Hash="39937D239220C1B779D7D55613DE2C0A48BD6E12E0214DA4C65992B96CF591DF" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_23" FriendlyName="mhyprot.sys\69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 Hash Page Sha1" Hash="CB44C6F0EE51CB4C5836499BC61DD6C1FBDF8AA1" />
|
||||
<Deny ID="ID_DENY_MHYPROT2_24" FriendlyName="mhyprot.sys\69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2 Hash Page Sha256" Hash="7ED26A593524A2A92FFCFB075A42BB4FA4775FFBF83AF98525244A4710886EAD" />
|
||||
@ -1800,7 +1803,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_1A" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_1B" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_1C" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_21" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_21" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_22" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_23" />
|
||||
<FileRuleRef RuleID="ID_DENY_MHYPROT2_24" />
|
||||
@ -2183,8 +2186,21 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
</details>
|
||||
|
||||
> [!NOTE]
|
||||
> The policy listed above contains **Allow All** rules. Microsoft recommends deploying this policy alongside an existing WDAC policy instead of merging it with the existing policy. If you must use a single policy, remove the **Allow All** rules before merging it with the existing policy. For more information, see [Create a WDAC Deny Policy](create-wdac-deny-policy.md#single-policy-considerations).
|
||||
> The policy listed above contains **Allow All** rules. Microsoft recommends deploying this policy alongside an existing WDAC policy instead of merging it with the existing policy. If you must use a single policy, remove the **Allow All** rules before merging it with the existing policy. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations).
|
||||
|
||||
## Steps to download and apply the vulnerable driver blocklist binary
|
||||
|
||||
If you prefer to apply the vulnerable driver blocklist exactly as shown above, follow these steps:
|
||||
|
||||
1. Download the [WDAC policy refresh tool](https://aka.ms/refreshpolicy)
|
||||
2. Download and extract the [vulnerable driver blocklist binaries](https://aka.ms/VulnerableDriverBlockList)
|
||||
3. Select either the audit only version or the enforced version and rename the file to SiPolicy.p7b
|
||||
4. Copy SiPolicy.p7b to %windir%\system32\CodeIntegrity
|
||||
5. Run the WDAC policy refresh tool you downloaded in Step 1 above to activate and refresh all WDAC policies on your computer
|
||||
|
||||
> [!NOTE]
|
||||
> If any vulnerable drivers are already running that would be blocked by the policy, you must reboot your computer for those drivers to be blocked. Running processes aren't shutdown when activating a new WDAC policy without reboot.
|
||||
|
||||
## More information
|
||||
|
||||
- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md)
|
||||
- [Merge Windows Defender Application Control policies](/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies)
|
||||
|
||||
@ -9,7 +9,7 @@ author: jgeurten
|
||||
ms.reviewer: aaroncz
|
||||
ms.author: jogeurte
|
||||
manager: jsuther
|
||||
ms.date: 06/27/2022
|
||||
ms.date: 10/06/2022
|
||||
ms.topic: overview
|
||||
---
|
||||
|
||||
@ -26,9 +26,31 @@ ms.topic: overview
|
||||
|
||||
You should now have one or more Windows Defender Application Control (WDAC) policies ready to deploy. If you haven't yet completed the steps described in the [WDAC Design Guide](windows-defender-application-control-design-guide.md), do so now before proceeding.
|
||||
|
||||
## Convert your WDAC policy XML to binary
|
||||
|
||||
Before you deploy your WDAC policies, you must first convert the XML to its binary form. You can do this using the following PowerShell example. You must set the $WDACPolicyXMLFile variable to point to your WDAC policy XML file.
|
||||
|
||||
```powershell
|
||||
## Update the path to your WDAC policy XML
|
||||
$WDACPolicyXMLFile = $env:USERPROFILE"\Desktop\MyWDACPolicy.xml"
|
||||
[xml]$WDACPolicy = Get-Content -Path $WDACPolicyXMLFile
|
||||
if (($WDACPolicy.SiPolicy.PolicyID) -ne $null) ## Multiple policy format (For Windows builds 1903+ only, including Server 2022)
|
||||
{
|
||||
$PolicyID = $WDACPolicy.SiPolicy.PolicyID
|
||||
$PolicyBinary = $PolicyID+".cip"
|
||||
}
|
||||
else ## Single policy format (Windows Server 2016 and 2019, and Windows 10 1809 LTSC)
|
||||
{
|
||||
$PolicyBinary = "SiPolicy.p7b"
|
||||
}
|
||||
|
||||
## Binary file will be written to your desktop
|
||||
ConvertFrom-CIPolicy -XmlFilePath $WDACPolicyXMLFile -BinaryFilePath $env:USERPROFILE\Desktop\$PolicyBinary
|
||||
```
|
||||
|
||||
## Plan your deployment
|
||||
|
||||
As with any significant change to your environment, implementing application control can have unintended consequences. To ensure the best chance for success, you should follow safe deployment practices and plan your deployment carefully. Decide what devices you'll manage with Windows Defender Application Control and split them into deployment rings so you can control the scale of the deployment and respond if anything goes wrong. Define the success criteria that will determine when it's safe to continue from one ring to the next.
|
||||
As with any significant change to your environment, implementing application control can have unintended consequences. To ensure the best chance for success, you should follow safe deployment practices and plan your deployment carefully. Identify the devices you'll manage with WDAC and split them into deployment rings. This way, you can control the speed and scale of the deployment and respond if anything goes wrong. Define the success criteria that will determine when it's safe to continue from one ring to the next.
|
||||
|
||||
All Windows Defender Application Control policy changes should be deployed in audit mode before proceeding to enforcement. Carefully monitor events from devices where the policy has been deployed to ensure the block events you observe match your expectation before broadening the deployment to other deployment rings. If your organization uses Microsoft Defender for Endpoint, you can use the Advanced Hunting feature to centrally monitor WDAC-related events. Otherwise, we recommend using an event log forwarding solution to collect relevant events from your managed endpoints.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user