mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 22:03:46 +00:00
Merge branch 'public' of https://github.com/MicrosoftDocs/windows-itpro-docs into public
This commit is contained in:
martyav
@ -71,4 +71,5 @@
|
||||
### [VPN security features](vpn\vpn-security-features.md)
|
||||
### [VPN profile options](vpn\vpn-profile-options.md)
|
||||
### [How to configure Diffie Hellman protocol over IKEv2 VPN connections](vpn\how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md)
|
||||
### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
|
||||
### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
|
||||
### [Optimizing Office 365 traffic with the Windows 10 VPN client](vpn\vpn-office-365-optimization.md)
|
||||
|
||||
@ -47,7 +47,8 @@ Windows Hello provides many benefits, including:
|
||||
## Where is Windows Hello data stored?
|
||||
The biometric data used to support Windows Hello is stored on the local device only. It doesn't roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data from a device, it cannot be converted back into a raw biometric sample that could be recognized by the biometric sensor.
|
||||
|
||||
Each sensor on a device will have its own biometric database file where template data is stored. Each database has a unique, randomly generated key that is encrypted to the system. The template data for the sensor will be encrypted with this per-database key using AES with CBC chaining mode. The hash is SHA256. Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors will store biometric data on the fingerprint module instead of in the database file.
|
||||
> [!NOTE]
|
||||
>Each sensor on a device will have its own biometric database file where template data is stored. Each database has a unique, randomly generated key that is encrypted to the system. The template data for the sensor will be encrypted with this per-database key using AES with CBC chaining mode. The hash is SHA256. Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors will store biometric data on the fingerprint module instead of in the database file.
|
||||
|
||||
## Has Microsoft set any device requirements for Windows Hello?
|
||||
We've been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements:
|
||||
|
||||
@ -45,7 +45,7 @@ The statement "PIN is stronger than Password" is not directed at the strength of
|
||||
The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016.
|
||||
|
||||
## Can I use a convenience PIN with Azure AD?
|
||||
It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users.
|
||||
It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises Domain Joined users and local account users.
|
||||
|
||||
## Can I use an external camera when my laptop is closed or docked?
|
||||
No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further.
|
||||
@ -64,11 +64,11 @@ The user experience for Windows Hello for Business occurs after user sign-in, af
|
||||
[Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience)
|
||||
|
||||
## What happens when my user forgets their PIN?
|
||||
If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider.
|
||||
If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider.
|
||||
|
||||
[Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience)
|
||||
|
||||
For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network.
|
||||
For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network.
|
||||
|
||||
## What URLs do I need to allow for a hybrid deployment?
|
||||
Communicating with Azure Active Directory uses the following URLs:
|
||||
@ -88,11 +88,12 @@ Windows Hello for Business has two types of PIN reset: non-destructive and destr
|
||||
Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services.
|
||||
|
||||
## Which is better or more secure: Key trust or Certificate trust?
|
||||
The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware backed, two-factor credential. The difference between the two trust types are:
|
||||
The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are:
|
||||
- Required domain controllers
|
||||
- Issuing end entity certificates
|
||||
|
||||
The **key trust** model authenticates to Active Directory using a raw key. Windows Server 2016 domain controllers enables this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you do not need to issue certificates to your end users (domain controller certificates are still needed).
|
||||
|
||||
The **certificate trust** model authenticates to Active Directory using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to your end users, but you do not need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM protected private key to request a certificate from your enterprise's issuing certificate authority.
|
||||
|
||||
## Do I need Windows Server 2016 domain controllers?
|
||||
@ -102,7 +103,7 @@ There are many deployment options from which to choose. Some of those options re
|
||||
Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that are sync based on scenarios. The base scenarios that include Windows Hello for Business are [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes.
|
||||
|
||||
## Is Windows Hello for Business multifactor authentication?
|
||||
Windows Hello for Business is two-factor authentication based the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor".
|
||||
Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor".
|
||||
|
||||
## What are the biometric requirements for Windows Hello for Business?
|
||||
Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information.
|
||||
|
||||
@ -43,18 +43,20 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se
|
||||
|
||||
### Connect Azure Active Directory with the PIN reset service
|
||||
|
||||
1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant.
|
||||
2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
|
||||
1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant.
|
||||
2. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account.
|
||||
|
||||
3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant.
|
||||
4. After you log in, click **Accept** to give consent for the PIN reset client to access your account.
|
||||
3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant.
|
||||
4. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account.
|
||||
|
||||
> [!NOTE]
|
||||
> After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant.
|
||||
|
||||
|
||||
|
||||
5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>After you Accept the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN Reset applications are listed for your tenant.
|
||||
|
||||
### Configure Windows devices to use PIN reset using Group Policy
|
||||
|
||||
You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object.
|
||||
@ -70,8 +72,8 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10
|
||||
|
||||
#### Create a PIN Reset Device configuration profile using Microsoft Intune
|
||||
|
||||
1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account.
|
||||
2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.</br>
|
||||
1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account.
|
||||
2. You need your tenant ID to complete the following task. You can discover your tenant ID by viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a Command window on any Azure AD-joined or hybrid Azure AD-joined computer.</br>
|
||||
|
||||
```
|
||||
dsregcmd /status | findstr -snip "tenantid"
|
||||
@ -86,9 +88,9 @@ To configure PIN reset on Windows devices you manage, use an [Intune Windows 10
|
||||
|
||||
#### Assign the PIN Reset Device configuration profile using Microsoft Intune
|
||||
|
||||
1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account.
|
||||
2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration.
|
||||
3. In the device configuration profile, click **Assignments**.
|
||||
1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account.
|
||||
2. Navigate to the Microsoft Intune blade. Choose **Device configuration** > **Profiles**. From the list of device configuration profiles, choose the profile that contains the PIN reset configuration.
|
||||
3. In the device configuration profile, select **Assignments**.
|
||||
4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups.
|
||||
|
||||
## On-premises Deployments
|
||||
|
||||
@ -18,16 +18,23 @@ ms.reviewer:
|
||||
# How Windows Hello for Business works
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
Windows Hello for Business is a modern, two-factor credential that is the more secure alternative to passwords. Whether you are cloud or on-premises, Windows Hello for Business has a deployment option for you. For cloud deployments, you can use Windows Hello for Business with Azure Active Directory joined, Hybrid Azure Active Directory joined, or Azure Active Directory registered devices. Windows Hello for Business also works for domain joined devices.
|
||||
Windows Hello for Business is a modern, two-factor credential that is the more secure alternative to passwords. Whether you are cloud or on-premises, Windows Hello for Business has a deployment option for you. For cloud deployments, you can use Windows Hello for Business with Azure Active Directory joined, Hybrid Azure Active Directory joined, or Azure Active Directory registered devices. Windows Hello for Business also works for domain joined devices.
|
||||
|
||||
Watch this quick video where Pieter Wigleven gives a simple explanation of how Windows Hello for Business works and some of its supporting features.
|
||||
> [!VIDEO https://www.youtube.com/embed/G-GJuDWbBE8]
|
||||
|
||||
## Technical Deep Dive
|
||||
|
||||
Windows Hello for Business is a distributed system that uses several components to accomplish device registration, provisioning, and authentication. Use this section to gain a better understanding of each of the components and how they support Windows Hello for Business.
|
||||
|
||||
Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business provisioning and authentication work.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/RImGsIjSJ1s]
|
||||
> [!VIDEO https://www.youtube.com/embed/WPmzoP_vMek]
|
||||
|
||||
- [Technology and Terminology](hello-how-it-works-technology.md)
|
||||
- [Device Registration](hello-how-it-works-device-registration.md)
|
||||
- [Provisioning](hello-how-it-works-provisioning.md)
|
||||
|
||||
@ -644,28 +644,28 @@ Sign-in a workstation with access equivalent to a _domain user_.
|
||||
3. Select **Device Configuration**, and then click **Profiles**.
|
||||
4. Select **Create Profile**.
|
||||
|
||||
5. Next to **Name**, type **WHFB Certificate Enrollment**.
|
||||
6. Next to **Description**, provide a description meaningful for your environment.
|
||||
7. Select **Windows 10 and later** from the **Platform** list.
|
||||
8. Select **SCEP certificate** from the **Profile** list.
|
||||
|
||||
9. The **SCEP Certificate** blade should open. Configure **Certificate validity period** to match your organization.
|
||||
5. Select **Windows 10 and later** from the **Platform** list.
|
||||
6. Choose **SCEP certificate** from the **Profile** list, and select **Create**.
|
||||
7. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**.
|
||||
8. Next to **Description**, provide a description meaningful for your environment, then select **Next**.
|
||||
9. Select **User** as a certificate type.
|
||||
10. Configure **Certificate validity period** to match your organization.
|
||||
> [!IMPORTANT]
|
||||
> Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity.
|
||||
> Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity.
|
||||
|
||||
10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list.
|
||||
11. Select **Custom** from the **Subject name format** list.
|
||||
12. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate.
|
||||
13. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value.
|
||||
14. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**.
|
||||
15. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority.
|
||||
11. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list.
|
||||
12. Select **Custom** from the **Subject name format** list.
|
||||
13. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate.
|
||||
14. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value.
|
||||
15. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**.
|
||||
16. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority.
|
||||
|
||||
16. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**.
|
||||
17. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**.
|
||||
17. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**.
|
||||
18. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**.
|
||||
|
||||
18. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile.
|
||||
19. Click **OK**.
|
||||
20. Click **Create**.
|
||||
19. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile.
|
||||
20. Click **Next**.
|
||||
21. Click **Next** two more times to skip the **Scope tags** and **Assignments** steps of the wizard and click **Create**.
|
||||
|
||||
### Assign Group to the WHFB Certificate Enrollment Certificate Profile
|
||||
Sign-in a workstation with access equivalent to a _domain user_.
|
||||
|
||||
@ -15,40 +15,42 @@ manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/18/2017
|
||||
ms.date: 4/16/2017
|
||||
---
|
||||
|
||||
# Manage Windows Hello for Business in your organization
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
|
||||
You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511.
|
||||
>The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511.
|
||||
>
|
||||
>Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**.
|
||||
>Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**.
|
||||
>
|
||||
>Use **PIN Complexity** policy settings to manage PINs for Windows Hello for Business.
|
||||
|
||||
|
||||
## Group Policy settings for Windows Hello for Business
|
||||
|
||||
The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**.
|
||||
The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**.
|
||||
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="2">Policy</th>
|
||||
<th>Scope</th>
|
||||
<th>Options</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use Windows Hello for Business</td>
|
||||
<td></td>
|
||||
<td>Computer or user</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users can provision Windows Hello for Business, which encrypts their domain password.</p>
|
||||
<p><b>Not configured</b>: Device does not provision Windows Hello for Business for any user.</p>
|
||||
<p><b>Enabled</b>: Device provisions Windows Hello for Business using keys or certificates for all users.</p>
|
||||
<p><b>Disabled</b>: Device does not provision Windows Hello for Business for any user.</p>
|
||||
</td>
|
||||
@ -56,15 +58,41 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
<tr>
|
||||
<td>Use a hardware security device</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business will only be provisioned using TPM.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use certificate for on-premises authentication</td>
|
||||
<td></td>
|
||||
<td>Computer or user</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business enrolls a key that is used for on-premises authentication.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<td>Use PIN recovery</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p><b>Not configured</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p><b>Enabled</b>: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.</p>
|
||||
<p><b>Disabled</b>: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p>
|
||||
|
||||
For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Use biometrics</td>
|
||||
<td></td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Biometrics can be used as a gesture in place of a PIN.</p>
|
||||
<p><b>Enabled</b>: Biometrics can be used as a gesture in place of a PIN.</p>
|
||||
@ -74,6 +102,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
<tr>
|
||||
<td rowspan="8">PIN Complexity</td>
|
||||
<td>Require digits</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users must include a digit in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include a digit in their PIN.</p>
|
||||
@ -82,6 +111,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require lowercase letters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot use lowercase letters in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one lowercase letter in their PIN.</p>
|
||||
@ -90,6 +120,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Maximum PIN length</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN length must be less than or equal to 127.</p>
|
||||
<p><b>Enabled</b>: PIN length must be less than or equal to the number you specify.</p>
|
||||
@ -98,6 +129,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Minimum PIN length</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN length must be greater than or equal to 4.</p>
|
||||
<p><b>Enabled</b>: PIN length must be greater than or equal to the number you specify.</p>
|
||||
@ -106,6 +138,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Expiration</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: PIN does not expire.</p>
|
||||
<p><b>Enabled</b>: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.</p>
|
||||
@ -114,6 +147,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>History</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Previous PINs are not stored.</p>
|
||||
<p><b>Enabled</b>: Specify the number of previous PINs that can be associated to a user account that can't be reused.</p>
|
||||
@ -124,6 +158,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require special characters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot include a special character in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one special character in their PIN.</p>
|
||||
@ -132,6 +167,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Require uppercase letters</td>
|
||||
<td>Computer</td>
|
||||
<td>
|
||||
<p><b>Not configured</b>: Users cannot include an uppercase letter in their PIN.</p>
|
||||
<p><b>Enabled</b>: Users must include at least one uppercase letter in their PIN.</p>
|
||||
@ -139,9 +175,9 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>>Phone Sign-in</td>
|
||||
<td>
|
||||
<p>Use Phone Sign-in</p>
|
||||
<td>Phone Sign-in</td>
|
||||
<td>Use Phone Sign-in</td>
|
||||
<td>Computer</td>
|
||||
</td>
|
||||
<td>
|
||||
<p>Not currently supported.</p>
|
||||
@ -154,7 +190,7 @@ The following table lists the Group Policy settings that you can configure for W
|
||||
The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=692070).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP.
|
||||
>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
@ -166,7 +202,7 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<tr>
|
||||
<td>UsePassportForWork</td>
|
||||
<td></td>
|
||||
<td>Device</td>
|
||||
<td>Device or user</td>
|
||||
<td>True</td>
|
||||
<td>
|
||||
<p>True: Windows Hello for Business will be provisioned for all users on the device.</p>
|
||||
@ -178,7 +214,7 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<tr>
|
||||
<td>RequireSecurityDevice</td>
|
||||
<td></td>
|
||||
<td>Device</td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>True: Windows Hello for Business will only be provisioned using TPM.</p>
|
||||
@ -186,6 +222,32 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ExcludeSecurityDevice</td>
|
||||
<td>TPM12</td>
|
||||
<td>Device</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p>True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.</p>
|
||||
<p>False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>EnablePinRecovery</td>
|
||||
<td></td>
|
||||
<td>Device or user</td>
|
||||
<td>False</td>
|
||||
<td>
|
||||
<p>Added in Windows 10, version 1703</p>
|
||||
<p>True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.</p>
|
||||
<p>False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.</p>
|
||||
<p>
|
||||
|
||||
For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan="2">Biometrics</td>
|
||||
<td>
|
||||
<p>UseBiometrics</p>
|
||||
@ -216,19 +278,41 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<tr>
|
||||
<td>Digits </td>
|
||||
<td>Device or user</td>
|
||||
<td>2 </td>
|
||||
<td>1 </td>
|
||||
<td>
|
||||
<p>1: Numbers are not allowed. </p>
|
||||
<p>2: At least one number is required.</p>
|
||||
<p>0: Digits are allowed. </p>
|
||||
<p>1: At least one digit is required.</p>
|
||||
<p>2: Digits are not allowed. </p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Lowercase letters </td>
|
||||
<td>Device or user</td>
|
||||
<td>1 </td>
|
||||
<td>2</td>
|
||||
<td>
|
||||
<p>1: Lowercase letters are not allowed. </p>
|
||||
<p>2: At least one lowercase letter is required.</p>
|
||||
<p>0: Lowercase letters are allowed. </p>
|
||||
<p>1: At least one lowercase letter is required.</p>
|
||||
<p>2: Lowercase letters are not allowed. </p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Special characters</td>
|
||||
<td>Device or user</td>
|
||||
<td>2</td>
|
||||
<td>
|
||||
<p>0: Special characters are allowed. </p>
|
||||
<p>1: At least one special character is required. </p>
|
||||
<p>2: Special characters are not allowed.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Uppercase letters</td>
|
||||
<td>Device or user</td>
|
||||
<td>2</td>
|
||||
<td>
|
||||
<p>0: Uppercase letters are allowed. </p>
|
||||
<p>1: At least one uppercase letter is required.</p>
|
||||
<p>2: Uppercase letters are not allowed. </p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -252,7 +336,7 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<td>Device or user</td>
|
||||
<td>0</td>
|
||||
<td>
|
||||
<p>Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire.
|
||||
<p>Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
@ -261,29 +345,11 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
<td>Device or user</td>
|
||||
<td>0</td>
|
||||
<td>
|
||||
<p>Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.
|
||||
<p>Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Special characters</td>
|
||||
<td>Device or user</td>
|
||||
<td>1</td>
|
||||
<td>
|
||||
<p>1: Special characters are not allowed. </p>
|
||||
<p>2: At least one special character is required.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Uppercase letters</td>
|
||||
<td>Device or user</td>
|
||||
<td>1</td>
|
||||
<td>
|
||||
<p>1: Uppercase letters are not allowed </p>
|
||||
<p>2: At least one uppercase letter is required</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Remote</td>
|
||||
<td>
|
||||
<p>UseRemotePassport</p>
|
||||
@ -297,20 +363,53 @@ The following table lists the MDM policy settings that you can configure for Win
|
||||
</table>
|
||||
|
||||
>[!NOTE]
|
||||
> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.
|
||||
|
||||
> In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN.
|
||||
|
||||
## Policy conflicts from multiple policy sources
|
||||
|
||||
Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device.
|
||||
|
||||
Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source.
|
||||
|
||||
Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis.
|
||||
|
||||
>[!NOTE]
|
||||
> Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP.
|
||||
|
||||
><b>Examples</b>
|
||||
>
|
||||
>The following are configured using computer Group Policy:
|
||||
>
|
||||
>- Use Windows Hello for Business - Enabled
|
||||
>- User certificate for on-premises authentication - Enabled
|
||||
>- Require digits - Enabled
|
||||
>- Minimum PIN length - 6
|
||||
>
|
||||
>The following are configured using device MDM Policy:
|
||||
>
|
||||
>- UsePassportForWork - Disabled
|
||||
>- UseCertificateForOnPremAuth - Disabled
|
||||
>- MinimumPINLength - 8
|
||||
>- Digits - 1
|
||||
>- LowercaseLetters - 1
|
||||
>- SpecialCharacters - 1
|
||||
>
|
||||
>Enforced policy set:
|
||||
>
|
||||
>- Use Windows Hello for Business - Enabled
|
||||
>- Use certificate for on-premises authentication - Enabled
|
||||
>- Require digits - Enabled
|
||||
>- Minimum PIN length - 6d
|
||||
|
||||
## How to use Windows Hello for Business with Azure Active Directory
|
||||
|
||||
There are three scenarios for using Windows Hello for Business in Azure AD–only organizations:
|
||||
There are three scenarios for using Windows Hello for Business in Azure AD–only organizations:
|
||||
|
||||
- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone.
|
||||
- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered.
|
||||
- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant's directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone.
|
||||
- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won't be enabled unless and until the organization's administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered.
|
||||
- **Organizations that have subscribed to Azure AD Premium** have access to the full set of Azure AD MDM features. These features include controls to manage Windows Hello for Business. You can set policies to disable or force the use of Windows Hello for Business, require the use of a TPM, and control the length and strength of PINs set on the device.
|
||||
|
||||
If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager, Microsoft Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates.
|
||||
|
||||
|
||||
If you want to use Windows Hello for Business with certificates, you'll need a device registration system. That means that you set up Configuration Manager, Microsoft Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -329,7 +329,7 @@ If box **1a** on your planning worksheet reads **cloud only** or **hybrid**, wri
|
||||
|
||||
If box **1a** on your planning worksheet reads **on-premises**, and box **1f** reads **AD FS with third party**, write **No** in box **6a** on your planning worksheet. Otherwise, write **Yes** in box **6a** as you need an Azure account for per-consumption MFA billing. Write **No** in box **6b** on your planning worksheet—on-premises deployments do not use the cloud directory.
|
||||
|
||||
Windows Hello for Business does not require an Azure AD premium subscription. However, some dependencies do.
|
||||
Windows Hello for Business does not require an Azure AD premium subscription. However, some dependencies, such as [MDM automatic enrollment](https://docs.microsoft.com/mem/intune/enrollment/quickstart-setup-auto-enrollment) and [Conditional Access](https://docs.microsoft.com/azure/active-directory/conditional-access/overview) do.
|
||||
|
||||
If box **1a** on your planning worksheet reads **on-premises**, write **No** in box **6c** on your planning worksheet.
|
||||
|
||||
|
||||
@ -24,14 +24,33 @@ ms.reviewer:
|
||||
## Overview of Windows Hello for Business and Features
|
||||
|
||||
Watch Pieter Wigleven explain Windows Hello for Business, Multi-factor Unlock, and Dynamic Lock
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/G-GJuDWbBE8]
|
||||
|
||||
## Why PIN is more secure than a password
|
||||
|
||||
Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA]
|
||||
|
||||
## Microsoft's passwordless strategy
|
||||
|
||||
Watch Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less**
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/mXJS615IGLM]
|
||||
|
||||
## Windows Hello for Business Provisioning
|
||||
|
||||
Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business provisioning works.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/RImGsIjSJ1s]
|
||||
|
||||
## Windows Hello for Business Authentication
|
||||
|
||||
Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business authentication works.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/WPmzoP_vMek]
|
||||
|
||||
## Windows Hello for Business user enrollment experience
|
||||
|
||||
The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment.
|
||||
|
||||
@ -21,13 +21,18 @@ ms.date: 10/23/2017
|
||||
# Why a PIN is better than a password
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password?
|
||||
On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works.
|
||||
|
||||
Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA]
|
||||
|
||||
## PIN is tied to the device
|
||||
|
||||
One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too!
|
||||
|
||||
Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device.
|
||||
@ -44,7 +49,7 @@ When the PIN is created, it establishes a trusted relationship with the identity
|
||||
|
||||
The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM.
|
||||
|
||||
User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised.
|
||||
User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can't be stolen in cases where the identity provider or websites the user accesses have been compromised.
|
||||
|
||||
The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked.
|
||||
|
||||
@ -54,10 +59,11 @@ The Windows Hello for Business PIN is subject to the same set of IT management p
|
||||
|
||||
## What if someone steals the laptop or phone?
|
||||
|
||||
To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before [TPM anti-hammering](/windows/device-security/tpm/tpm-fundamentals#anti-hammering) protection locks the device.
|
||||
To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user's biometrics or guess his or her PIN—and all of this must be done before [TPM anti-hammering](/windows/device-security/tpm/tpm-fundamentals#anti-hammering) protection locks the device.
|
||||
You can provide additional protection for laptops that don't have TPM by enabling BitLocker and setting a policy to limit failed sign-ins.
|
||||
|
||||
**Configure BitLocker without TPM**
|
||||
|
||||
1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy:
|
||||
|
||||
**Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup**
|
||||
@ -72,7 +78,8 @@ You can provide additional protection for laptops that don't have TPM by enablin
|
||||
2. Set the number of invalid logon attempts to allow, and then click OK.
|
||||
|
||||
## Why do you need a PIN to use biometrics?
|
||||
Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly.
|
||||
|
||||
Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can't use your preferred biometric because of an injury or because the sensor is unavailable or not working properly.
|
||||
|
||||
If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account and password, which doesn't provide you the same level of protection as Hello.
|
||||
|
||||
|
||||
@ -0,0 +1,676 @@
|
||||
---
|
||||
title: Optimizing Office 365 traffic for remote workers with the native Windows 10 VPN client
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
author: kelleyvice-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 04/07/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: jajo
|
||||
---
|
||||
|
||||
# Optimizing Office 365 traffic for remote workers with the native Windows 10 VPN client
|
||||
|
||||
This article describes how to configure the recommendations in the article [Optimize Office 365 connectivity for remote users using VPN split tunneling](https://docs.microsoft.com/office365/enterprise/office-365-vpn-split-tunnel) for the *native Windows 10 VPN client*. This guidance enables VPN administrators to optimize Office 365 usage while still ensuring that all other traffic goes over the VPN connection and through existing security gateways and tooling.
|
||||
|
||||
This can be achieved for the native/built-in Windows 10 VPN client using a _Force Tunneling with Exclusions_ approach. This allows you to define IP-based exclusions *even when using force tunneling* in order to "split" certain traffic to use the physical interface while still forcing all other traffic via the VPN interface. Traffic addressed to specifically defined destinations (like those listed in the Office 365 optimize categories) will therefore follow a much more direct and efficient path, without the need to traverse or "hairpin" via the VPN tunnel and back out of the corporate network. For cloud-services like Office 365, this makes a huge difference in performance and usability for remote users.
|
||||
|
||||
> [!NOTE]
|
||||
> The term _force tunneling with exclusions_ is sometimes confusingly called "split tunnels" by other vendors and in some online documentation. For Windows 10 VPN, the term _split tunneling_ is defined differently as described in the article [VPN routing decisions](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing#split-tunnel-configuration).
|
||||
|
||||
## Solution Overview
|
||||
|
||||
The solution is based upon the use of a VPN Configuration Service Provider Reference profile ([VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp)) and the embedded [ProfileXML](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-profile-xsd). These are used to configure the VPN profile on the device. Various provisioning approaches can be used to create and deploy the VPN profile as discussed in the article [Step 6. Configure Windows 10 client Always On VPN connections](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files).
|
||||
|
||||
Typically, these VPN profiles are distributed using a Mobile Device Management solution like Intune, as described in [VPN profile options](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options#apply-profilexml-using-intune) and [Configure the VPN client by using Intune](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#configure-the-vpn-client-by-using-intune).
|
||||
|
||||
To enable the use of force tunneling in Windows 10 VPN, the `<RoutingPolicyType>` setting is typically configured with a value of _ForceTunnel_ in your existing Profile XML (or script) by way of the following entry, under the `<NativeProfile></NativeProfile>` section:
|
||||
|
||||
```xml
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
```
|
||||
|
||||
In order to define specific force tunnel exclusions, you then need to add the following lines to your existing Profile XML (or script) for each required exclusion, and place them outside of the `<NativeProfile></NativeProfile>` section as follows:
|
||||
|
||||
```xml
|
||||
<Route>
|
||||
<Address>[IP addresses or subnet]</Address>
|
||||
<PrefixSize>[IP Prefix]</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
```
|
||||
|
||||
Entries defined by the `[IP Addresses or Subnet]` and `[IP Prefix]` references will consequently be added to the routing table as _more specific route entries_ that will use the Internet-connected interface as the default gateway, as opposed to using the VPN interface. You will need to define a unique and separate `<Route></Route>` section for each required exclusion.
|
||||
|
||||
An example of a correctly formatted Profile XML configuration for force tunnel with exclusions is shown below:
|
||||
|
||||
```xml
|
||||
<VPNProfile>
|
||||
<NativeProfile>
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
</NativeProfile>
|
||||
<Route>
|
||||
<Address>203.0.113.0</Address>
|
||||
<PrefixSize>24</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>198.51.100.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
</VPNProfile>
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> The IP addresses and prefix size values in this example are used purely as examples only and should not be used.
|
||||
|
||||
## Solution Deployment
|
||||
|
||||
For Office 365, it is therefore necessary to add exclusions for all IP addresses documented within the optimize categories described in [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges?redirectSourcePath=%252fen-us%252farticle%252fOffice-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) to ensure that they are excluded from VPN force tunneling.
|
||||
|
||||
This can be achieved manually by adding the IP addresses defined within the *optimize* category entries to an existing Profile XML (or script) file, or alternatively the following script can be used which dynamically adds the required entries to an existing PowerShell script, or XML file, based upon directly querying the REST-based web service to ensure the correct IP address ranges are always used.
|
||||
|
||||
An example of a PowerShell script that can be used to update a force tunnel VPN connection with Office 365 exclusions is provided below.
|
||||
|
||||
```powershell
|
||||
# Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
#
|
||||
# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
|
||||
# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
|
||||
# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
|
||||
# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN
|
||||
# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER.
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Applies or updates recommended Office 365 optimize IP address exclusions to an existing force tunnel Windows 10 VPN profile
|
||||
.DESCRIPTION
|
||||
Connects to the Office 365 worldwide commercial service instance endpoints to obtain the latest published IP address ranges
|
||||
Compares the optimized IP addresses with those contained in the supplied VPN Profile (PowerShell or XML file)
|
||||
Adds or updates IP addresses as necessary and saves the resultant file with "-NEW" appended to the file name
|
||||
.PARAMETERS
|
||||
Filename and path for a supplied Windows 10 VPN profile file in either PowerShell or XML format
|
||||
.NOTES
|
||||
Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later
|
||||
.VERSION
|
||||
1.0
|
||||
#>
|
||||
|
||||
param (
|
||||
[string]$VPNprofilefile
|
||||
)
|
||||
|
||||
$usage=@"
|
||||
|
||||
This script uses the following parameters:
|
||||
|
||||
VPNprofilefile - The full path and name of the VPN profile PowerShell script or XML file
|
||||
|
||||
EXAMPLES
|
||||
|
||||
To check a VPN profile PowerShell script file:
|
||||
|
||||
Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF POWERSHELL SCRIPT FILE]
|
||||
|
||||
To check a VPN profile XML file:
|
||||
|
||||
Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF XML FILE]
|
||||
|
||||
"@
|
||||
|
||||
# Check if filename has been provided #
|
||||
if ($VPNprofilefile -eq "")
|
||||
{
|
||||
Write-Host "`nWARNING: You must specify either a PowerShell script or XML filename!" -ForegroundColor Red
|
||||
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
|
||||
$FileExtension = [System.IO.Path]::GetExtension($VPNprofilefile)
|
||||
|
||||
# Check if XML file exists and is a valid XML file #
|
||||
if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
{
|
||||
if ( Test-Path $VPNprofilefile )
|
||||
{
|
||||
$xml = New-Object System.Xml.XmlDocument
|
||||
try
|
||||
{
|
||||
$xml.Load((Get-ChildItem -Path $VPNprofilefile).FullName)
|
||||
|
||||
}
|
||||
catch [System.Xml.XmlException]
|
||||
{
|
||||
Write-Verbose "$VPNprofilefile : $($_.toString())"
|
||||
Write-Host "`nWARNING: The VPN profile XML file is not a valid xml file or incorrectly formatted!" -ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}else
|
||||
{
|
||||
Write-Host "`nWARNING: VPN profile XML file does not exist or cannot be found!" -ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
# Check if VPN profile PowerShell script file exists and contains a VPNPROFILE XML section #
|
||||
if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
|
||||
{
|
||||
if ( (Test-Path $VPNprofilefile) )
|
||||
{
|
||||
if (-Not $(Select-String -Path $VPNprofilefile -Pattern "<VPNPROFILE>") )
|
||||
{
|
||||
Write-Host "`nWARNING: PowerShell script file does not contain a valid VPN profile XML section or is incorrectly formatted!" -ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}else
|
||||
{
|
||||
Write-Host "`nWARNING: PowerShell script file does not exist or cannot be found!"-ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
# Define Office 365 endpoints and service URLs #
|
||||
$ws = "https://endpoints.office.com"
|
||||
$baseServiceUrl = "https://endpoints.office.com"
|
||||
|
||||
# Path where client ID and latest version number will be stored #
|
||||
$datapath = $Env:TEMP + "\endpoints_clientid_latestversion.txt"
|
||||
|
||||
# Fetch client ID and version if data file exists; otherwise create new file #
|
||||
if (Test-Path $datapath)
|
||||
{
|
||||
$content = Get-Content $datapath
|
||||
$clientRequestId = $content[0]
|
||||
$lastVersion = $content[1]
|
||||
|
||||
}else
|
||||
{
|
||||
$clientRequestId = [GUID]::NewGuid().Guid
|
||||
$lastVersion = "0000000000"
|
||||
@($clientRequestId, $lastVersion) | Out-File $datapath
|
||||
}
|
||||
|
||||
# Call version method to check the latest version, and pull new data if version number is different #
|
||||
$version = Invoke-RestMethod -Uri ($ws + "/version?clientRequestId=" + $clientRequestId)
|
||||
|
||||
if ($version[0].latest -gt $lastVersion)
|
||||
{
|
||||
|
||||
Write-Host
|
||||
Write-Host "A new version of Office 365 worldwide commercial service instance endpoints has been detected!" -ForegroundColor Cyan
|
||||
|
||||
# Write the new version number to the data file #
|
||||
@($clientRequestId, $version[0].latest) | Out-File $datapath
|
||||
}
|
||||
|
||||
# Invoke endpoints method to get the new data #
|
||||
$uri = "$baseServiceUrl" + "/endpoints/worldwide?clientRequestId=$clientRequestId"
|
||||
|
||||
# Invoke endpoints method to get the data for the VPN profile comparison #
|
||||
$endpointSets = Invoke-RestMethod -Uri ($uri)
|
||||
$Optimize = $endpointSets | Where-Object { $_.category -eq "Optimize" }
|
||||
$optimizeIpsv4 = $Optimize.ips | Where-Object { ($_).contains(".") } | Sort-Object -Unique
|
||||
|
||||
# Temporarily include additional IP address until Teams client update is released
|
||||
$optimizeIpsv4 += "13.107.60.1/32"
|
||||
|
||||
# Process PowerShell script file start #
|
||||
if ($VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
|
||||
{
|
||||
Write-host "`nStarting PowerShell script exclusion route check...`n" -ForegroundColor Cyan
|
||||
|
||||
# Clear Variables to allow re-run testing #
|
||||
|
||||
$ARRVPN=$null # Array to hold VPN addresses from VPN profile PowerShell file #
|
||||
$In_Opt_Only=$null # Variable to hold IP addresses that only appear in the optimize list #
|
||||
$In_VPN_Only=$null # Variable to hold IP addresses that only appear in the VPN profile PowerShell file #
|
||||
|
||||
# Extract the Profile XML from the ps1 file #
|
||||
|
||||
$regex = '(?sm).*^*.<VPNPROFILE>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
|
||||
# Create xml format variable to compare with the optimize list #
|
||||
|
||||
$xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
|
||||
[xml]$VPNprofilexml="<VPNPROFILE>"+$xmlbody+"</VPNPROFILE>"
|
||||
|
||||
# Loop through each address found in VPNPROFILE XML section #
|
||||
foreach ($Route in $VPNprofilexml.VPNProfile.Route)
|
||||
{
|
||||
$VPNIP=$Route.Address+"/"+$Route.PrefixSize
|
||||
[array]$ARRVPN=$ARRVPN+$VPNIP
|
||||
}
|
||||
|
||||
# In optimize address list only #
|
||||
$In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_}
|
||||
|
||||
# In VPN list only #
|
||||
$In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
|
||||
[array]$Inpfile = get-content $VPNprofilefile
|
||||
|
||||
if ($In_Opt_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red
|
||||
|
||||
[int32]$insline=0
|
||||
|
||||
for ($i=0; $i -lt $Inpfile.count; $i++)
|
||||
{
|
||||
if ($Inpfile[$i] -match "</NativeProfile>")
|
||||
{
|
||||
$insline += $i # Record the position of the line after the NativeProfile section ends #
|
||||
}
|
||||
}
|
||||
$OFS = "`r`n"
|
||||
foreach ($NewIP in $In_Opt_Only)
|
||||
{
|
||||
# Add the missing IP address(es) #
|
||||
$IPInfo=$NewIP.Split("/")
|
||||
$InpFile[$insline] += $OFS+" <Route>"
|
||||
$InpFile[$insline] += $OFS+" <Address>"+$IPInfo[0].Trim()+"</Address>"
|
||||
$InpFile[$insline] += $OFS+" <PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"
|
||||
$InpFile[$insline] += $OFS+" <ExclusionRoute>true</ExclusionRoute>"
|
||||
$InpFile[$insline] += $OFS+" </Route>"
|
||||
}
|
||||
# Update fileName and write new PowerShell file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.ps1"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$InpFile | Set-Content $OutFile
|
||||
Write-Host "Exclusion routes have been added to VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green
|
||||
}else
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green
|
||||
$OutFile=$VPNprofilefile
|
||||
}
|
||||
|
||||
if ( $In_VPN_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Unknown exclusion route IP addresses have been found in the VPN profile`n" -ForegroundColor Yellow
|
||||
|
||||
foreach ($OldIP in $In_VPN_Only)
|
||||
{
|
||||
[array]$Inpfile = get-content $Outfile
|
||||
$IPInfo=$OldIP.Split("/")
|
||||
Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow
|
||||
$matchstr="<Address>"+$IPInfo[0].Trim()+"</Address>"
|
||||
$DelAns=Read-host
|
||||
if ($DelAns.ToUpper() -eq "Y")
|
||||
{
|
||||
[int32]$insline=0
|
||||
for ($i=0; $i -lt $Inpfile.count; $i++)
|
||||
{
|
||||
if ($Inpfile[$i] -match $matchstr)
|
||||
{
|
||||
$insline += $i # Record the position of the line for the string match #
|
||||
}
|
||||
}
|
||||
# Remove entries from XML #
|
||||
$InpFile[$insline-1]="REMOVETHISLINE"
|
||||
$InpFile[$insline]="REMOVETHISLINE"
|
||||
$InpFile[$insline+1]="REMOVETHISLINE"
|
||||
$InpFile[$insline+2]="REMOVETHISLINE"
|
||||
$InpFile[$insline+3]="REMOVETHISLINE"
|
||||
$InpFile=$InpFile | Where-Object {$_ -ne "REMOVETHISLINE"}
|
||||
|
||||
# Update filename and write new PowerShell file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$Inpfile | Set-content $OutFile
|
||||
Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green
|
||||
|
||||
}else
|
||||
{
|
||||
Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Process XML file start #
|
||||
if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
{
|
||||
Write-host "`nStarting XML file exclusion route check...`n" -ForegroundColor Cyan
|
||||
|
||||
# Clear variables to allow re-run testing #
|
||||
$ARRVPN=$null # Array to hold VPN addresses from the XML file #
|
||||
$In_Opt_Only=$null # Variable to hold IP Addresses that only appear in optimize list #
|
||||
$In_VPN_Only=$null # Variable to hold IP Addresses that only appear in the VPN profile XML file #
|
||||
|
||||
# Extract the Profile XML from the XML file #
|
||||
$regex = '(?sm).*^*.<VPNPROFILE>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
|
||||
# Create xml format variable to compare with optimize list #
|
||||
$xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
|
||||
[xml]$VPNRulesxml="$xmlbody"
|
||||
|
||||
# Loop through each address found in VPNPROFILE file #
|
||||
foreach ($Route in $VPNRulesxml.VPNProfile.Route)
|
||||
{
|
||||
$VPNIP=$Route.Address+"/"+$Route.PrefixSize
|
||||
[array]$ARRVPN=$ARRVPN+$VPNIP
|
||||
}
|
||||
|
||||
# In optimize address list only #
|
||||
$In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_}
|
||||
|
||||
# In VPN list only #
|
||||
$In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
|
||||
[array]$Inpfile = get-content $VPNprofilefile
|
||||
|
||||
if ($In_Opt_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red
|
||||
|
||||
foreach ($NewIP in $In_Opt_Only)
|
||||
{
|
||||
# Add the missing IP address(es) #
|
||||
$IPInfo=$NewIP.Split("/")
|
||||
$inspoint = $Inpfile[0].IndexOf("</VPNProfile")
|
||||
$routes += "<Route>"+"<Address>"+$IPInfo[0].Trim()+"</Address>"+"<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"+"<ExclusionRoute>true</ExclusionRoute>"+"</Route>"
|
||||
}
|
||||
$Inpfile = $Inpfile[0].Insert($inspoint,$routes)
|
||||
|
||||
# Update filename and write new XML file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$InpFile | Set-Content $OutFile
|
||||
Write-Host "Exclusion routes have been added to VPN profile and output to a separate XML file; the original file has not been modified`n`n" -ForegroundColor Green
|
||||
|
||||
}else
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green
|
||||
$OutFile=$VPNprofilefile
|
||||
}
|
||||
|
||||
if ( $In_VPN_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Unknown exclusion route IP addresses found in the VPN profile`n" -ForegroundColor Yellow
|
||||
|
||||
foreach ($OldIP in $In_VPN_Only)
|
||||
{
|
||||
[array]$Inpfile = get-content $OutFile
|
||||
$IPInfo=$OldIP.Split("/")
|
||||
Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow
|
||||
$matchstr="<Route>"+"<Address>"+$IPInfo[0].Trim()+"</Address>"+"<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"+"<ExclusionRoute>true</ExclusionRoute>"+"</Route>"
|
||||
$DelAns=Read-host
|
||||
if ($DelAns.ToUpper() -eq "Y")
|
||||
{
|
||||
# Remove unknown IP address(es) #
|
||||
$inspoint = $Inpfile[0].IndexOf($matchstr)
|
||||
$Inpfile[0] = $Inpfile[0].Replace($matchstr,"")
|
||||
|
||||
# Update filename and write new XML file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$Inpfile | Set-content $OutFile
|
||||
Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate XML file; the original file has not been modified`n" -ForegroundColor Green
|
||||
|
||||
}else
|
||||
{
|
||||
Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Version Support
|
||||
|
||||
This solution is supported with the following versions of Windows:
|
||||
|
||||
- Windows 10 1903/1909 and newer: Included, no action needed
|
||||
- Windows 10 1809: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
|
||||
- Windows 10 1803: At least [KB4493437](https://support.microsoft.com/help/4493437/windows-10-update-kb4493437)
|
||||
- Windows 10 1709 and lower: Exclusion routes are not supported
|
||||
|
||||
- Windows 10 Enterprise 2019 LTSC: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
|
||||
- Windows 10 Enterprise 2016 LTSC: Exclusion routes are not supported
|
||||
- Windows 10 Enterprise 2015 LTSC: Exclusion routes are not supported
|
||||
|
||||
Microsoft strongly recommends that the latest available Windows 10 cumulative update always be applied.
|
||||
|
||||
## Other Considerations
|
||||
|
||||
You should also be able to adapt this approach to include necessary exclusions for other cloud-services that can be defined by known/static IP addresses; exclusions required for [Cisco WebEx](https://help.webex.com/WBX000028782/Network-Requirements-for-Webex-Teams-Services) or [Zoom](https://support.zoom.us/hc/en-us/articles/201362683) are good examples.
|
||||
|
||||
## Examples
|
||||
|
||||
An example of a PowerShell script that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial PowerShell script:
|
||||
|
||||
```powershell
|
||||
# Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
#
|
||||
# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
|
||||
# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
|
||||
# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
|
||||
# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN
|
||||
# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER.
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Configures an AlwaysOn IKEv2 VPN Connection using a basic script
|
||||
.DESCRIPTION
|
||||
Configures an AlwaysOn IKEv2 VPN Connection with proxy PAC information and force tunneling
|
||||
.PARAMETERS
|
||||
Parameters are defined in a ProfileXML object within the script itself
|
||||
.NOTES
|
||||
Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later
|
||||
.VERSION
|
||||
1.0
|
||||
#>
|
||||
|
||||
<#-- Define Key VPN Profile Parameters --#>
|
||||
$ProfileName = 'Contoso VPN with Office 365 Exclusions'
|
||||
$ProfileNameEscaped = $ProfileName -replace ' ', '%20'
|
||||
|
||||
<#-- Define VPN ProfileXML --#>
|
||||
$ProfileXML = '<VPNProfile>
|
||||
<RememberCredentials>true</RememberCredentials>
|
||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||
<AlwaysOn>true</AlwaysOn>
|
||||
<TrustedNetworkDetection>corp.contoso.com</TrustedNetworkDetection>
|
||||
<NativeProfile>
|
||||
<Servers>edge1.contoso.com</Servers>
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
<NativeProtocolType>IKEv2</NativeProtocolType>
|
||||
<Authentication>
|
||||
<MachineMethod>Certificate</MachineMethod>
|
||||
</Authentication>
|
||||
</NativeProfile>
|
||||
<Route>
|
||||
<Address>13.107.6.152</Address>
|
||||
<PrefixSize>31</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.18.10</Address>
|
||||
<PrefixSize>31</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.128.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>23.103.160.0</Address>
|
||||
<PrefixSize>20</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>40.96.0.0</Address>
|
||||
<PrefixSize>13</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>40.104.0.0</Address>
|
||||
<PrefixSize>15</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.96.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>131.253.33.215</Address>
|
||||
<PrefixSize>32</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>132.245.0.0</Address>
|
||||
<PrefixSize>16</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>150.171.32.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>191.234.140.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>204.79.197.215</Address>
|
||||
<PrefixSize>32</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.136.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>40.108.128.0</Address>
|
||||
<PrefixSize>17</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.104.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>104.146.128.0</Address>
|
||||
<PrefixSize>17</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>150.171.40.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.60.1</Address>
|
||||
<PrefixSize>32</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.64.0</Address>
|
||||
<PrefixSize>18</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.112.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.120.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Proxy>
|
||||
<AutoConfigUrl>http://webproxy.corp.contoso.com/proxy.pac</AutoConfigUrl>
|
||||
</Proxy>
|
||||
</VPNProfile>'
|
||||
|
||||
<#-- Convert ProfileXML to Escaped Format --#>
|
||||
$ProfileXML = $ProfileXML -replace '<', '<'
|
||||
$ProfileXML = $ProfileXML -replace '>', '>'
|
||||
$ProfileXML = $ProfileXML -replace '"', '"'
|
||||
|
||||
<#-- Define WMI-to-CSP Bridge Properties --#>
|
||||
$nodeCSPURI = './Vendor/MSFT/VPNv2'
|
||||
$namespaceName = "root\cimv2\mdm\dmmap"
|
||||
$className = "MDM_VPNv2_01"
|
||||
|
||||
<#-- Define WMI Session --#>
|
||||
$session = New-CimSession
|
||||
|
||||
<#-- Detect and Delete Previous VPN Profile --#>
|
||||
try
|
||||
{
|
||||
$deleteInstances = $session.EnumerateInstances($namespaceName, $className, $options)
|
||||
foreach ($deleteInstance in $deleteInstances)
|
||||
{
|
||||
$InstanceId = $deleteInstance.InstanceID
|
||||
if ("$InstanceId" -eq "$ProfileNameEscaped")
|
||||
{
|
||||
$session.DeleteInstance($namespaceName, $deleteInstance, $options)
|
||||
$Message = "Removed $ProfileName profile $InstanceId"
|
||||
Write-Host "$Message"
|
||||
} else {
|
||||
$Message = "Ignoring existing VPN profile $InstanceId"
|
||||
Write-Host "$Message"
|
||||
}
|
||||
}
|
||||
}
|
||||
catch [Exception]
|
||||
{
|
||||
$Message = "Unable to remove existing outdated instance(s) of $ProfileName profile: $_"
|
||||
Write-Host "$Message"
|
||||
exit
|
||||
}
|
||||
|
||||
<#-- Create VPN Profile --#>
|
||||
try
|
||||
{
|
||||
$newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
|
||||
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')
|
||||
$newInstance.CimInstanceProperties.Add($property)
|
||||
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')
|
||||
$newInstance.CimInstanceProperties.Add($property)
|
||||
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')
|
||||
$newInstance.CimInstanceProperties.Add($property)
|
||||
|
||||
$session.CreateInstance($namespaceName, $newInstance, $options)
|
||||
$Message = "Created $ProfileName profile."
|
||||
Write-Host "$Message"
|
||||
Write-Host "$ProfileName profile summary:"
|
||||
$session.EnumerateInstances($namespaceName, $className, $options)
|
||||
}
|
||||
catch [Exception]
|
||||
{
|
||||
$Message = "Unable to create $ProfileName profile: $_"
|
||||
Write-Host "$Message"
|
||||
exit
|
||||
}
|
||||
|
||||
$Message = "Script Complete"
|
||||
Write-Host "$Message"
|
||||
|
||||
```
|
||||
|
||||
An example of an [Intune-ready XML file](https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options#apply-profilexml-using-intune) that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial XML file.
|
||||
|
||||
>[!NOTE]
|
||||
>This XML is formatted for use with Intune and cannot contain any carriage returns or whitespace.
|
||||
|
||||
```xml
|
||||
<VPNProfile><RememberCredentials>true</RememberCredentials><DnsSuffix>corp.contoso.com</DnsSuffix><AlwaysOn>true</AlwaysOn><TrustedNetworkDetection>corp.contoso.com</TrustedNetworkDetection><NativeProfile><Servers>edge1.contoso.com</Servers><RoutingPolicyType>ForceTunnel</RoutingPolicyType><NativeProtocolType>IKEv2</NativeProtocolType><Authentication><MachineMethod>Certificate</MachineMethod></Authentication></NativeProfile><Route><Address>13.107.6.152</Address><PrefixSize>31</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.18.10</Address><PrefixSize>31</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.128.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>23.103.160.0</Address><PrefixSize>20</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.96.0.0</Address><PrefixSize>13</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.104.0.0</Address><PrefixSize>15</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.96.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>131.253.33.215</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>132.245.0.0</Address><PrefixSize>16</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>150.171.32.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>191.234.140.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>204.79.197.215</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.136.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.108.128.0</Address><PrefixSize>17</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.104.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>104.146.128.0</Address><PrefixSize>17</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>150.171.40.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.60.1</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.64.0</Address><PrefixSize>18</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.112.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.120.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Proxy><AutoConfigUrl>http://webproxy.corp.contoso.com/proxy.pac</AutoConfigUrl></Proxy></VPNProfile>
|
||||
```
|
||||
@ -16,8 +16,8 @@ ms.author: dansimp
|
||||
# VPN security features
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
|
||||
## LockDown VPN
|
||||
@ -29,53 +29,52 @@ A VPN profile configured with LockDown secures the device to only allow network
|
||||
- The user cannot delete or modify the VPN profile.
|
||||
- The VPN LockDown profile uses forced tunnel connection.
|
||||
- If the VPN connection is not available, outbound network traffic is blocked.
|
||||
- Only one VPN LockDown profile is allowed on a device.
|
||||
- Only one VPN LockDown profile is allowed on a device.
|
||||
|
||||
>[!NOTE]
|
||||
>For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type.
|
||||
|
||||
Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected.
|
||||
> [!NOTE]
|
||||
> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type.
|
||||
|
||||
Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected.
|
||||
|
||||
|
||||
## Windows Information Protection (WIP) integration with VPN
|
||||
|
||||
Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally.
|
||||
Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices, without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally.
|
||||
|
||||
The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include:
|
||||
The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include:
|
||||
|
||||
- Core functionality: File encryption and file access blocking
|
||||
- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations
|
||||
- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN
|
||||
- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN
|
||||
|
||||
The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app.
|
||||
The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app.
|
||||
|
||||
Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect.
|
||||
|
||||
[Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)
|
||||
|
||||
|
||||
## Traffic filters
|
||||
## Traffic Filters
|
||||
|
||||
Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules:
|
||||
Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules:
|
||||
|
||||
- App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface.
|
||||
- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface.
|
||||
- App-based rules. With app-based rules, a list of applications can be marked to allow only traffic originating from these apps to go over the VPN interface.
|
||||
- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified to allow only traffic matching these rules to go over the VPN interface.
|
||||
|
||||
There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level.
|
||||
There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level.
|
||||
|
||||
For example, an admin could define rules that specify:
|
||||
For example, an admin could define rules that specify:
|
||||
|
||||
- The Contoso HR App must be allowed to go through the VPN and only access port 4545.
|
||||
- The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889.
|
||||
- All other apps on the device should be able to access only ports 80 or 443.
|
||||
- The Contoso HR App must be allowed to go through the VPN and only access port 4545.
|
||||
- The Contoso finance apps are allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889.
|
||||
- All other apps on the device should be able to access only ports 80 or 443.
|
||||
|
||||
## Configure traffic filters
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune.
|
||||
The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -80,7 +80,9 @@ The server side configuration to enable Network Unlock also requires provisionin
|
||||
|
||||
1. The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration.
|
||||
2. The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address.
|
||||
3. The client computer broadcasts a vendor-specific DHCP request that contains the Network Key (a 256-bit intermediate key) and an AES-256 session key for the reply. Both of these keys are encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server.
|
||||
3. The client computer broadcasts a vendor-specific DHCP request that contains:
|
||||
1. A Network Key (a 256-bit intermediate key) encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server.
|
||||
2. An AES-256 session key for the reply.
|
||||
4. The Network Unlock provider on the WDS server recognizes the vendor-specific request.
|
||||
5. The provider decrypts it with the WDS server’s BitLocker Network Unlock certificate RSA private key.
|
||||
6. The WDS provider then returns the network key encrypted with the session key using its own vendor-specific DHCP reply to the client computer. This forms an intermediate key.
|
||||
|
||||
@ -53,7 +53,7 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
|
||||
|
||||
- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar
|
||||
|
||||
- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook
|
||||
- Microsoft 365 Apps for enterprise apps, including Word, Excel, PowerPoint, OneNote, and Outlook
|
||||
|
||||
- OneDrive app
|
||||
|
||||
@ -99,7 +99,7 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li
|
||||
| PowerPoint Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.PowerPoint<br>**App Type:** Universal app |
|
||||
| OneNote | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.OneNote<br>**App Type:** Universal app |
|
||||
| Outlook Mail and Calendar | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** microsoft.windowscommunicationsapps<br>**App Type:** Universal app |
|
||||
| Office 365 ProPlus and Office 2019 Professional Plus | Office 365 ProPlus and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.<br>We don't recommend setting up Office by using individual paths or publisher rules. |
|
||||
| Microsoft 365 Apps for enterprise and Office 2019 Professional Plus | Microsoft 365 Apps for enterprise and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.<br>We don't recommend setting up Office by using individual paths or publisher rules. |
|
||||
| Microsoft Photos | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Windows.Photos<br>**App Type:** Universal app |
|
||||
| Groove Music | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneMusic<br>**App Type:** Universal app |
|
||||
| Microsoft Movies & TV | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneVideo<br>**App Type:** Universal app |
|
||||
|
||||
@ -1,122 +0,0 @@
|
||||
---
|
||||
title: How Windows Information Protection (WIP) protects files with a sensitivity label (Windows 10)
|
||||
description: Explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label.
|
||||
keywords: sensitivity, labels, WIP, Windows Information Protection, EDP, Enterprise Data Protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dulcemontemayor
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/30/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# How Windows Information Protection (WIP) protects a file that has a sensitivity label
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Windows 10, version 1903
|
||||
- Windows 10, version 1809
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
This topic explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label.
|
||||
Microsoft information protection technologies work together as an integrated solution to help enterprises:
|
||||
|
||||
- Discover corporate data on endpoint devices
|
||||
- Classify and label information based on its content and context
|
||||
- Protect corporate data from unintentionally leaving to non-business environments
|
||||
- Enable audit reports of user interactions with corporate data on endpoint devices
|
||||
|
||||
Microsoft information protection technologies include:
|
||||
|
||||
- [Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) is built in to Windows 10 and protects local data at rest on endpoint devices, and manages apps to protect local data in use. Data that leaves the endpoint device, such as email attachment, is not protected by WIP.
|
||||
|
||||
- [Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection) is a cloud-based solution that can be purchased either standalone or as part of Microsoft 365 Enterprise. It helps an organization classify and protect its documents and emails by applying labels. Azure Information Protection is applied directly to content, and roams with the content as it's moved between locations and cloud services.
|
||||
|
||||
- [Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security) is a cloud access security broker (CASB) solution that allows you to discover, classify, protect, and monitor user data in first-party and third-party Software-as-a-Service (SaaS) apps used by your organization.
|
||||
|
||||
## How WIP protects sensitivity labels with endpoint data loss prevention
|
||||
|
||||
You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center.
|
||||
When you [create a sensitivity label](https://docs.microsoft.com/microsoft-365/compliance/create-sensitivity-labels), you can specify that endpoint data loss prevention applies to content with that label.
|
||||
|
||||
|
||||
|
||||
Office app users can choose a sensitivity label from a menu and apply it to a file.
|
||||
|
||||
|
||||
|
||||
WIP enforces default endpoint protection as follows:
|
||||
|
||||
- If endpoint data loss prevention is enabled, the device enforces work protection for any file with the label
|
||||
- If endpoint data loss prevention is not enabled:
|
||||
- The device enforces work protection to a file downloaded from a work site
|
||||
- The device does not enforce work protection to a file downloaded from a personal site
|
||||
|
||||
Here's an example where a file remains protected without any work context beyond the sensitivity label:
|
||||
|
||||
1. Sara creates a PDF file on a Mac and labels it as **Confidential**.
|
||||
1. She emails the PDF from her Gmail account to Laura.
|
||||
1. Laura opens the PDF file on her Windows 10 device.
|
||||
1. Windows Defender Advanced Threat Protection (Windows Defender ATP) scans Windows 10 for any file that gets modified or created, including files that were created on a personal site.
|
||||
1. Windows Defender ATP triggers WIP policy.
|
||||
1. WIP policy protects the file even though it came from a personal site.
|
||||
|
||||
## How WIP protects automatically classified files
|
||||
|
||||
The next sections cover how Windows Defender ATP extends discovery and protection of sensitive information with improvements in Windows 10 version 1903.
|
||||
|
||||
### Discovery
|
||||
|
||||
Windows Defender ATP can extract the content of the file itself and evaluate whether it contains sensitive information types such as credit card numbers or employee ID numbers.
|
||||
When you create a sensitivity label, you can specify that the label be added to any file that contains a sensitive information type.
|
||||
|
||||
|
||||
|
||||
A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver's license numbers, and so on.
|
||||
You can also [create a custom sensitive information type](https://docs.microsoft.com/office365/securitycompliance/create-a-custom-sensitive-information-type), which can include any keyword or expression that you want to evaluate.
|
||||
|
||||
### Protection
|
||||
|
||||
When a file is created or edited on a Windows 10 endpoint, Windows Defender ATP extracts the content and evaluates if it contains any default or custom sensitive information types that have been defined.
|
||||
If the file has a match, Windows Defender ATP applies endpoint data loss prevention even if the file had no label previously.
|
||||
|
||||
Windows Defender ATP is integrated with Azure Information Protection for data discovery and reports sensitive information types that were discovered.
|
||||
Azure Information Protection aggregates the files with sensitivity labels and the sensitive information types they contain across the enterprise.
|
||||
|
||||
|
||||
|
||||
You can see sensitive information types in Microsoft 365 compliance under **Classifications**. Default sensitive information types have Microsoft as the publisher. The publisher for custom types is the tenant name.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Automatic classification does not change the file itself, but it applies protection based on the label.
|
||||
>WIP protects a file that contains a sensitive information type as a work file.
|
||||
>Azure Information Protection works differently in that it extends a file with a new attribute so the protection persists if the file is copied.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Endpoint data loss prevention requires Windows 10, version 1809
|
||||
- Auto labelling requires Windows 10, version 1903
|
||||
- Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy
|
||||
- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center
|
||||
- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Endpoint Configuration Manager](overview-create-wip-policy-configmgr.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -6,6 +6,7 @@
|
||||
### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md)
|
||||
### [Preview features](microsoft-defender-atp/preview.md)
|
||||
### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md)
|
||||
### [Overview of Microsoft Defender Security Center](microsoft-defender-atp/use.md)
|
||||
### [Portal overview](microsoft-defender-atp/portal-overview.md)
|
||||
### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/commercial-gov.md)
|
||||
|
||||
@ -27,7 +28,7 @@
|
||||
### [Threat & Vulnerability Management]()
|
||||
#### [Overview of Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
#### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
|
||||
#### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
#### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
#### [Configuration score](microsoft-defender-atp/configuration-score.md)
|
||||
#### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
@ -81,7 +82,7 @@
|
||||
#### [Network protection]()
|
||||
##### [Protect your network](microsoft-defender-atp/network-protection.md)
|
||||
##### [Network protection evaluation](microsoft-defender-atp/evaluate-network-protection.md)
|
||||
|
||||
##### [Enable network protection](microsoft-defender-atp/enable-network-protection.md)
|
||||
|
||||
#### [Web protection]()
|
||||
##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md)
|
||||
@ -355,7 +356,7 @@
|
||||
##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md)
|
||||
##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md)
|
||||
##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md)
|
||||
##### [DeviceFileCertificateInfoBeta](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md)
|
||||
##### [DeviceFileCertificateInfo](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md)
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
@ -412,7 +413,7 @@
|
||||
### [Configure portal settings]()
|
||||
#### [Set up preferences](microsoft-defender-atp/preferences-setup.md)
|
||||
#### [General]()
|
||||
##### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md)
|
||||
##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md)
|
||||
@ -583,7 +584,7 @@
|
||||
##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md)
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md)
|
||||
##### [Configure Micro Focus ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md)
|
||||
##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md)
|
||||
@ -699,9 +700,10 @@
|
||||
#### [Family options](windows-defender-security-center/wdsc-family-options.md)
|
||||
|
||||
|
||||
### [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md)
|
||||
#### [Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md)
|
||||
#### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md)
|
||||
### [Microsoft Defender SmartScreen](microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md)
|
||||
#### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md)
|
||||
#### [Set up and use Microsft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md)
|
||||
|
||||
|
||||
### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md)
|
||||
#### [Windows Sandbox architecture](windows-sandbox/windows-sandbox-architecture.md)
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Audit Other Privilege Use Events (Windows 10)
|
||||
description: This security policy setting is not used.
|
||||
ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c
|
||||
ms.reviewer:
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
ms.pagetype: security
|
||||
@ -17,8 +17,8 @@ ms.date: 04/19/2017
|
||||
# Audit Other Privilege Use Events
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
This auditing subcategory should not have any events in it, but for some reason Success auditing will enable generation of event 4985(S): The state of a transaction has changed.
|
||||
@ -31,7 +31,7 @@ This auditing subcategory should not have any events in it, but for some reason
|
||||
|
||||
**Events List:**
|
||||
|
||||
- [4985](event-4674.md)(S): The state of a transaction has changed.
|
||||
- [4985](event-4985.md)(S): The state of a transaction has changed.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: DulceMontemayor
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
@ -19,6 +19,9 @@ ms.topic: conceptual
|
||||
# Threat Protection
|
||||
[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
|
||||
|
||||
>[!TIP]
|
||||
> Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/).
|
||||
|
||||
<center><h2>Microsoft Defender ATP</center></h2>
|
||||
<table>
|
||||
<tr>
|
||||
@ -77,7 +80,7 @@ To further reinforce the security perimeter of your network, Microsoft Defender
|
||||
- [Behavior monitoring](/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md)
|
||||
- [Cloud-based protection](/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md)
|
||||
- [Machine learning](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
|
||||
- [URL Protection](/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md)
|
||||
- [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus)
|
||||
- [Automated sandbox service](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md)
|
||||
|
||||
<a name="edr"></a>
|
||||
|
||||
@ -26,7 +26,6 @@ Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://
|
||||
|
||||
Windows Defender Antivirus is the [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) capability in the [Microsoft Defender ATP Windows 10 security stack](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) that addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign). That's because Windows Defender Antivirus and other [endpoint protection platform (EPP)](https://www.microsoft.com/security/blog/2019/08/23/gartner-names-microsoft-a-leader-in-2019-endpoint-protection-platforms-magic-quadrant/) capabilities in Microsoft Defender ATP detect and stops malware at first sight with [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak), behavioral analysis, and other advanced technologies.
|
||||
<br><br>
|
||||
|
||||
|
||||
**Download the latest transparency report: [Examining industry test results, November 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp)**
|
||||
|
||||
@ -54,7 +53,7 @@ The AV-TEST Product Review and Certification Report tests on three categories: p
|
||||
|
||||
- September — October 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2018/microsoft-windows-defender-antivirus-4.18-184174/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWqOqD)
|
||||
|
||||
### AV-Comparatives: Protection rating of 99.9% in the latest test
|
||||
### AV-Comparatives: Protection rating of 99.6% in the latest test
|
||||
|
||||
Business Security Test consists of three main parts: the Real-World Protection Test that mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (for example by USB), and the Performance Test that looks at the impact on the system's performance.
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ manager: dansimp
|
||||
|
||||
Microsoft Baseline Security Analyzer (MBSA) is used to verify patch compliance. MBSA also performed several other security checks for Windows, IIS, and SQL Server. Unfortunately, the logic behind these additional checks had not been actively maintained since Windows XP and Windows Server 2003. Changes in the products since then rendered many of these security checks obsolete and some of their recommendations counterproductive.
|
||||
|
||||
MBSA was largely used in situations where neither Microsoft Update nor a local WSUS/SCCM server was available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 introduced support for Windows Server 2012 R2 and Windows 8.1, it has since been deprecated and no longer developed. MBSA 2.3 is not updated to fully support Windows 10 and Windows Server 2016.
|
||||
MBSA was largely used in situations where neither Microsoft Update nor a local WSUS or Configuration Manager server was available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 introduced support for Windows Server 2012 R2 and Windows 8.1, it has since been deprecated and no longer developed. MBSA 2.3 is not updated to fully support Windows 10 and Windows Server 2016.
|
||||
|
||||
## The Solution
|
||||
A script can help you with an alternative to MBSA’s patch-compliance checking:
|
||||
|
||||
@ -20,6 +20,7 @@ ms.topic: article
|
||||
# Configure advanced features in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
@ -30,32 +31,36 @@ Use the following advanced features to get better protected from potentially mal
|
||||
|
||||
## Automated investigation
|
||||
|
||||
When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigation](automated-investigations.md).
|
||||
Turn on this feature to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigation](automated-investigations.md).
|
||||
|
||||
## Live response
|
||||
|
||||
When you enable this feature, users with the appropriate permissions can initiate a live response session on machines.
|
||||
Turn on this feature so that users with the appropriate permissions can start a live response session on machines.
|
||||
|
||||
For more information on role assignments see, [Create and manage roles](user-roles.md).
|
||||
For more information about role assignments, see [Create and manage roles](user-roles.md).
|
||||
|
||||
## Live response unsigned script execution
|
||||
|
||||
Enabling this feature allows you to run unsigned scripts in a live response session.
|
||||
|
||||
## Auto-resolve remediated alerts
|
||||
## Autoresolve remediated alerts
|
||||
|
||||
For tenants created on or after Windows 10, version 1809 the automated investigation and remediation capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don’t want to have alerts auto-resolved, you’ll need to manually turn off the feature.
|
||||
For tenants created on or after Windows 10, version 1809 the automated investigation and remediation capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don't want to have alerts auto-resolved, you'll need to manually turn off the feature.
|
||||
|
||||
>[!TIP]
|
||||
>For tenants created prior that version, you'll need to manually turn this feature on from the [Advanced features](https://securitycenter.windows.com/preferences2/integration) page.
|
||||
|
||||
>[!NOTE]
|
||||
> - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine.
|
||||
>
|
||||
>- The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine.
|
||||
>- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it.
|
||||
|
||||
## Allow or block file
|
||||
|
||||
Blocking is only available if your organization uses Windows Defender Antivirus as the active antimalware solution, and if the cloud-based protection feature is enabled.
|
||||
Blocking is only available if your organization fulfills these requirements:
|
||||
|
||||
- Uses Windows Defender Antivirus as the active antimalware solution and,
|
||||
- The cloud-based protection feature is enabled
|
||||
|
||||
This feature enables you to block potentially malicious files in your network. Blocking a file will prevent it from being read, written, or executed on machines in your organization.
|
||||
|
||||
@ -69,24 +74,22 @@ To turn **Allow or block** files on:
|
||||
|
||||
1. Select **Save preferences** at the bottom of the page.
|
||||
|
||||
Once you have enabled this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page.
|
||||
|
||||
After turning on this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page.
|
||||
|
||||
## Custom network indicators
|
||||
|
||||
Enabling this feature allows you to create indicators for IP addresses, domains, or URLs which determine whether they will be allowed or blocked based on your custom indicator list.
|
||||
Turning on this feature allows you to create indicators for IP addresses, domains, or URLs, which determine whether they will be allowed or blocked based on your custom indicator list.
|
||||
|
||||
To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834).
|
||||
To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834).
|
||||
|
||||
For more information, see [Manage indicators](manage-indicators.md).
|
||||
|
||||
>[!NOTE]
|
||||
>Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data.
|
||||
|
||||
|
||||
## Show user details
|
||||
|
||||
When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views:
|
||||
Turn on this feature so that you can see user details stored in Azure Active Directory. Details include a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views:
|
||||
|
||||
- Security operations dashboard
|
||||
- Alert queue
|
||||
@ -110,25 +113,25 @@ The integration with Azure Advanced Threat Protection allows you to pivot direct
|
||||
|
||||
## Microsoft Secure Score
|
||||
|
||||
Forwards Microsoft Defender ATP signals to Microsoft Secure Score in the Microsoft 365 security center. Turning this feature on gives Microsoft Secure Score visibility into the devices security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data.
|
||||
Forwards Microsoft Defender ATP signals to Microsoft Secure Score in the Microsoft 365 security center. Turning on this feature gives Microsoft Secure Score visibility into the devices security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data.
|
||||
|
||||
### Enable the Microsoft Defender ATP integration from the Azure ATP portal
|
||||
|
||||
To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal.
|
||||
|
||||
1. Login to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
|
||||
1. Log in to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
|
||||
|
||||
2. Click **Create your instance**.
|
||||
|
||||
3. Toggle the Integration setting to **On** and click **Save**.
|
||||
|
||||
When you complete the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page.
|
||||
After completing the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page.
|
||||
|
||||
## Office 365 Threat Intelligence connection
|
||||
|
||||
This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page.
|
||||
|
||||
When you enable this feature, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a holistic security investigation across Office 365 mailboxes and Windows machines.
|
||||
When you turn this feature on, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a comprehensive security investigation across Office 365 mailboxes and Windows machines.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
@ -137,7 +140,7 @@ To receive contextual machine integration in Office 365 Threat Intelligence, you
|
||||
|
||||
## Microsoft Threat Experts
|
||||
|
||||
Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability, while experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability. Experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
|
||||
>[!NOTE]
|
||||
>The Microsoft Threat Experts capability in Microsoft Defender ATP is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security).
|
||||
@ -151,11 +154,11 @@ Enabling this setting forwards Microsoft Defender ATP signals to Microsoft Cloud
|
||||
|
||||
## Azure Information Protection
|
||||
|
||||
Turning this setting on forwards signals to Azure Information Protection, giving data owners and administrators visibility into protected data on onboarded machines and machine risk ratings.
|
||||
Turning on this setting allows signals to be forwarded to Azure Information Protection. It gives data owners and administrators visibility into protected data on onboarded machines and machine risk ratings.
|
||||
|
||||
## Microsoft Intune connection
|
||||
|
||||
Microsoft Defender ATP can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [enable this feature](configure-conditional-access.md), you'll be able to share Microsoft Defender ATP device information with Intune, enhancing policy enforcement.
|
||||
Microsoft Defender ATP can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [turn on this feature](configure-conditional-access.md), you'll be able to share Microsoft Defender ATP device information with Intune, enhancing policy enforcement.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You'll need to enable the integration on both Intune and Microsoft Defender ATP to use this feature. For more information on specific steps, see [Configure Conditional Access in Microsoft Defender ATP](configure-conditional-access.md).
|
||||
@ -176,7 +179,7 @@ When you enable Intune integration, Intune will automatically create a classic C
|
||||
|
||||
Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
|
||||
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
|
||||
You'll have access to upcoming features, which you can provide feedback on to help improve the overall experience before features are generally available.
|
||||
|
||||
## Enable advanced features
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceFileCertificateInfoBeta table in the advanced hunting schema
|
||||
description: Learn about file signing information in the DeviceFileCertificateInfoBeta table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, digital signature, certificate, file signing, DeviceFileCertificateInfoBeta
|
||||
title: DeviceFileCertificateInfo table in the advanced hunting schema
|
||||
description: Learn about file signing information in the DeviceFileCertificateInfo table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, digital signature, certificate, file signing, DeviceFileCertificateInfo
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
ms.date: 01/14/2020
|
||||
---
|
||||
|
||||
# DeviceFileCertificateInfoBeta
|
||||
# DeviceFileCertificateInfo
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -26,9 +26,7 @@ ms.date: 01/14/2020
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceFileCertificateInfoBeta` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file signing certificates. This table uses data obtained from certificate verification activities regularly performed on files on endpoints.
|
||||
The `DeviceFileCertificateInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file signing certificates. This table uses data obtained from certificate verification activities regularly performed on files on endpoints.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
@ -47,7 +47,7 @@ Table and column names are also listed within the Microsoft Defender Security Ce
|
||||
| **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events |
|
||||
| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events |
|
||||
| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection |
|
||||
| **[DeviceFileCertificateInfoBeta](advanced-hunting-devicefilecertificateinfobeta-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints |
|
||||
| **[DeviceFileCertificateInfo](advanced-hunting-devicefilecertificateinfo-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints |
|
||||
| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products |
|
||||
| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
|
||||
| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices |
|
||||
|
||||
@ -52,6 +52,9 @@ You can save a new or existing query so that it is only accessible to you or sha
|
||||
|
||||
2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query.
|
||||
|
||||
## Create a direct link to a query
|
||||
To generate a link that opens your query directly in the advanced hunting query editor, finalize your query and select **Share link**.
|
||||
|
||||
## Access queries in the GitHub repository
|
||||
Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/).
|
||||
|
||||
|
||||
@ -21,11 +21,12 @@ ms.date: 03/27/2020
|
||||
# View and organize the Microsoft Defender Advanced Threat Protection Alerts queue
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
|
||||
The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view, with the most recent alerts showing at the top of the list, helping you see the most recent alerts first.
|
||||
The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view. The most recent alerts are showed at the top of the list helping you see the most recent alerts first.
|
||||
|
||||
>[!NOTE]
|
||||
>The alerts queue is significantly reduced with automated investigation and remediation, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. When an alert contains a supported entity for automated investigation (for example, a file) in a machine that has a supported operating system for it, an automated investigation and remediation can start. For more information on automated investigations, see [Overview of Automated investigations](automated-investigations.md).
|
||||
@ -33,6 +34,7 @@ The **Alerts queue** shows a list of alerts that were flagged from machines in y
|
||||
There are several options you can choose from to customize the alerts queue view.
|
||||
|
||||
On the top navigation you can:
|
||||
|
||||
- Select grouped view or list view
|
||||
- Customize columns to add or remove columns
|
||||
- Select the items to show per page
|
||||
@ -42,32 +44,36 @@ On the top navigation you can:
|
||||
|
||||
|
||||
## Sort, filter, and group the alerts queue
|
||||
|
||||
You can apply the following filters to limit the list of alerts and get a more focused view the alerts.
|
||||
|
||||
### Severity
|
||||
|
||||
Alert severity | Description
|
||||
:---|:---
|
||||
High </br>(Red) | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on machines. Some examples of these are credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary.
|
||||
High </br>(Red) | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk because of the severity of damage they can inflict on machines. Some examples are: credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary.
|
||||
Medium </br>(Orange) | Alerts from endpoint detection and response post-breach behaviors that might be a part of an advanced persistent threat (APT). This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. Although some might be part of internal security testing, it requires investigation as it might also be a part of an advanced attack.
|
||||
Low </br>(Yellow) | Alerts on threats associated with prevalent malware, hack-tools, non-malware hack tools, such as running exploration commands, clearing logs, etc., that often do not indicate an advanced threat targeting the organization. It could also come from an isolated security tool testing by a user in your organization.
|
||||
Low </br>(Yellow) | Alerts on threats associated with prevalent malware. For example, hack-tools, non-malware hack tools, such as running exploration commands, clearing logs, etc., that often do not indicate an advanced threat targeting the organization. It could also come from an isolated security tool testing by a user in your organization.
|
||||
Informational </br>(Grey) | Alerts that might not be considered harmful to the network but can drive organizational security awareness on potential security issues.
|
||||
|
||||
#### Understanding alert severity
|
||||
It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes.
|
||||
|
||||
Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes.
|
||||
|
||||
The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected.
|
||||
|
||||
The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization.
|
||||
|
||||
So, for example:
|
||||
- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred.
|
||||
|
||||
- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage.
|
||||
- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat.
|
||||
- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High".
|
||||
- Suspicious behavioral alerts which were not blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations.
|
||||
- Suspicious behavioral alerts, which weren't blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations.
|
||||
|
||||
#### Understanding alert categories
|
||||
We've redefined the alert categories to align to the [enterprise attack tactics](https://attack.mitre.org/tactics/enterprise/) in the [MITRE ATT&CK matrix](https://attack.mitre.org/). New category names apply to all new alerts. Existing alerts will retain the previous category names.
|
||||
|
||||
We've redefined the alert categories to align to the [enterprise attack tactics](https://attack.mitre.org/tactics/enterprise/) in the [MITRE ATT&CK matrix](https://attack.mitre.org/). New category names apply to all new alerts. Existing alerts will keep the previous category names.
|
||||
|
||||
The table below lists the current categories and how they generally map to previous categories.
|
||||
|
||||
@ -92,39 +98,43 @@ The table below lists the current categories and how they generally map to previ
|
||||
|
||||
|
||||
### Status
|
||||
|
||||
You can choose to limit the list of alerts based on their status.
|
||||
|
||||
### Investigation state
|
||||
|
||||
Corresponds to the automated investigation state.
|
||||
|
||||
### Category
|
||||
|
||||
You can choose to filter the queue to display specific types of malicious activity.
|
||||
|
||||
### Assigned to
|
||||
|
||||
You can choose between showing alerts that are assigned to you or automation.
|
||||
|
||||
### Detection source
|
||||
Select the source that triggered the alert detection. Microsoft Threat Experts preview participants can now filter and see detections from the new threat experts managed hunting service.
|
||||
|
||||
Select the source that triggered the alert detection. Microsoft Threat Experts preview participants can now filter and see detections from the new threat experts-managed hunting service.
|
||||
|
||||
>[!NOTE]
|
||||
>The Windows Defender Antivirus filter will only appear if machines are using Windows Defender Antivirus as the default real-time protection antimalware product.
|
||||
|
||||
|
||||
### OS platform
|
||||
|
||||
Limit the alerts queue view by selecting the OS platform that you're interested in investigating.
|
||||
|
||||
### Machine group
|
||||
If you have specific machine groups that you're interested in checking the alerts on, you can select the groups to limit the alerts queue view to display just those machine groups.
|
||||
|
||||
If you have specific machine groups that you're interested in checking, you can select the groups to limit the alerts queue view.
|
||||
|
||||
### Associated threat
|
||||
|
||||
Use this filter to focus on alerts that are related to high profile threats. You can see the full list of high-profile threats in [Threat analytics](threat-analytics.md).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md)
|
||||
- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md)
|
||||
- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md)
|
||||
|
||||
@ -12,7 +12,7 @@ author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
@ -20,9 +20,10 @@ ms.topic: article
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
## Methods
|
||||
|
||||
Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get alert](get-alert-info-by-id.md) | [Alert](alerts.md) | Get a single [alert](alerts.md) object.
|
||||
@ -37,7 +38,8 @@ Method |Return Type |Description
|
||||
|
||||
|
||||
## Properties
|
||||
Property | Type | Description
|
||||
|
||||
Property | Type | Description
|
||||
:---|:---|:---
|
||||
id | String | Alert ID.
|
||||
title | String | Alert title.
|
||||
@ -45,15 +47,15 @@ description | String | Alert description.
|
||||
alertCreationTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was created.
|
||||
lastEventTime | Nullable DateTimeOffset | The last occurrence of the event that triggered the alert on the same machine.
|
||||
firstEventTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that machine.
|
||||
lastUpdateTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that machine.
|
||||
lastUpdateTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was last updated.
|
||||
resolvedTime | Nullable DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'.
|
||||
incidentId | Nullable Long | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert.
|
||||
investigationId | Nullable Long | The [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) ID related to the Alert.
|
||||
incidentId | Nullable Long | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert.
|
||||
investigationId | Nullable Long | The [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) ID related to the Alert.
|
||||
investigationState | Nullable Enum | The current state of the [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'.
|
||||
assignedTo | String | Owner of the alert.
|
||||
severity | Enum | Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'.
|
||||
status | Enum | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'.
|
||||
classification | Nullable Enum | Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'.
|
||||
classification | Nullable Enum | Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'.
|
||||
determination | Nullable Enum | Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'.
|
||||
category| String | Category of the alert.
|
||||
detectionSource | String | Detection source.
|
||||
@ -61,7 +63,6 @@ threatFamilyName | String | Threat family.
|
||||
machineId | String | ID of a [machine](machine.md) entity that is associated with the alert.
|
||||
comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time.
|
||||
|
||||
|
||||
### Response example for getting single alert:
|
||||
|
||||
```
|
||||
@ -73,7 +74,7 @@ GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-2929
|
||||
"id": "da637084217856368682_-292920499",
|
||||
"incidentId": 66860,
|
||||
"investigationId": 4416234,
|
||||
"investigationState": "Running",
|
||||
"investigationState": "Running",
|
||||
"assignedTo": "secop@contoso.com",
|
||||
"severity": "Low",
|
||||
"status": "New",
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: API Explorer in Microsoft Defender ATP
|
||||
ms.reviewer:
|
||||
description: Use the API Explorer to construct and perform API queries, test and send requests for any available API
|
||||
description: Use the API Explorer to construct and do API queries, test, and send requests for any available API
|
||||
keywords: api, explorer, send, request, get, post,
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -19,14 +19,16 @@ ms.topic: conceptual
|
||||
---
|
||||
|
||||
# API Explorer
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively.
|
||||
|
||||
The API Explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint. You can also use the API Explorer to perform actions or find data that might not yet be available through the user interface.
|
||||
The API Explorer makes it easy to construct and do API queries, test, and send requests for any available Microsoft Defender ATP API endpoint. Use the API Explorer to take actions or find data that might not yet be available through the user interface.
|
||||
|
||||
The tool is useful during app development because it allows you to perform API queries that respect your user access settings, reducing the need to generate access tokens.
|
||||
The tool is useful during app development. It allows you to perform API queries that respect your user access settings, reducing the need to generate access tokens.
|
||||
|
||||
You can also use the tool to explore the gallery of sample queries, copy result code samples, and generate debug information.
|
||||
|
||||
@ -34,26 +36,30 @@ With the API Explorer, you can:
|
||||
|
||||
- Run requests for any method and see responses in real-time
|
||||
- Quickly browse through the API samples and learn what parameters they support
|
||||
- Make API calls with ease; no need to authenticate beyond the management portal sign-in
|
||||
- Make API calls with ease; no need to authenticate beyond the management portal sign in
|
||||
|
||||
## Access API Explorer
|
||||
|
||||
From the left navigation menu, select **Partners & APIs** > **API Explorer**.
|
||||
|
||||
## Supported APIs
|
||||
## Supported APIs
|
||||
|
||||
API Explorer supports all the APIs offered by Microsoft Defender ATP.
|
||||
|
||||
The list of supported APIs is available in the [APIs documentation](apis-intro.md).
|
||||
|
||||
## Get started with the API Explorer
|
||||
|
||||
1. In the left pane, there is a list of sample requests that you can use.
|
||||
2. Follow the links and click **Run query**.
|
||||
|
||||
Some of the samples may require specifying a parameter in the URL, for example, {machine- id}.
|
||||
Some of the samples may require specifying a parameter in the URL, for example, {machine- ID}.
|
||||
|
||||
## FAQ
|
||||
|
||||
**Do I need to have an API token to use the API Explorer?** <br>
|
||||
Credentials to access an API are not needed since the API Explorer uses the Microsoft Defender ATP management portal token whenever it makes a request.
|
||||
Credentials to access an API aren't needed. The API Explorer uses the Microsoft Defender ATP management portal token whenever it makes a request.
|
||||
|
||||
The logged-in user authentication credential is used to verify that the API Explorer is authorized to access data on your behalf.
|
||||
|
||||
Specific API requests are limited based on your RBAC privileges; for example, a request to "Submit indicator" is limited to the security admin role.
|
||||
Specific API requests are limited based on your RBAC privileges. For example, a request to "Submit indicator" is limited to the security admin role.
|
||||
|
||||
@ -30,9 +30,9 @@ Your attack surface is the total number of places where an attacker could compro
|
||||
|
||||
Attack surface reduction rules target software behaviors that are often abused by attackers, such as:
|
||||
|
||||
* Launching executable files and scripts that attempt to download or run files
|
||||
* Running obfuscated or otherwise suspicious scripts
|
||||
* Performing behaviors that apps don't usually initiate during normal day-to-day work
|
||||
- Launching executable files and scripts that attempt to download or run files
|
||||
- Running obfuscated or otherwise suspicious scripts
|
||||
- Performing behaviors that apps don't usually initiate during normal day-to-day work
|
||||
|
||||
These behaviors are sometimes seen in legitimate applications; however, they are considered risky because they are commonly abused by malware. Attack surface reduction rules can constrain these kinds of risky behaviors and help keep your organization safe.
|
||||
|
||||
@ -44,9 +44,11 @@ For more information about configuring attack surface reduction rules, see [Enab
|
||||
|
||||
## Attack surface reduction features across Windows versions
|
||||
|
||||
You can set attack surface reduction rules for computers running Windows 10 versions 1709 and 1803 or later, Windows Server version 1803 (Semi-Annual Channel) or later, and Windows Server 2019.
|
||||
You can set attack surface reduction rules for computers running the following versions of Windows:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- [Windows Server, version 1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) (Semi-Annual Channel) or later
|
||||
|
||||
To use the entire feature-set of attack surface reduction rules, you need a Windows 10 Enterprise license. With a Windows E5 license, you get advanced management capabilities including monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the Microsoft 365 security center. These advanced capabilities aren't available with an E3 license, but you can still use Event Viewer to review attack surface reduction rule events.
|
||||
To use the entire feature-set of attack surface reduction rules, you need a [Windows 10 Enterprise license](https://www.microsoft.com/licensing/product-licensing/windows10). With a [Windows E5 license](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses), you get advanced management capabilities including monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the [Microsoft 365 security center](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). These advanced capabilities aren't available with an E3 license, but you can still use Event Viewer to review attack surface reduction rule events.
|
||||
|
||||
## Review attack surface reduction events in the Microsoft Defender Security Center
|
||||
|
||||
@ -77,11 +79,11 @@ You can review the Windows event log to view events generated by attack surface
|
||||
|
||||
This will create a custom view that filters events to only show the following, all of which are related to controlled folder access:
|
||||
|
||||
Event ID | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1121 | Event when rule fires in Block-mode
|
||||
1122 | Event when rule fires in Audit-mode
|
||||
|Event ID | Description |
|
||||
|---|---|
|
||||
|5007 | Event when settings are changed |
|
||||
|1121 | Event when rule fires in Block-mode |
|
||||
|1122 | Event when rule fires in Audit-mode |
|
||||
|
||||
The "engine version" listed for attack surface reduction events in the event log, is generated by Microsoft Defender ATP, not by the operating system. Microsoft Defender ATP is integrated with Windows 10, so this feature works on all devices with Windows 10 installed.
|
||||
|
||||
@ -89,38 +91,42 @@ The "engine version" listed for attack surface reduction events in the event log
|
||||
|
||||
The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs:
|
||||
|
||||
Rule name | GUID | File & folder exclusions
|
||||
-|-|-
|
||||
[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 | Supported
|
||||
[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | D4F940AB-401B-4EFC-AADC-AD5F3C50688A | Supported
|
||||
[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | 3B576869-A4EC-4529-8536-B80A7769E899 | Supported
|
||||
[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 | Supported
|
||||
[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | D3E037E1-3EB8-44C8-A917-57927947596D | Not supported
|
||||
[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC | Supported
|
||||
[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B | Supported
|
||||
[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | 01443614-cd74-433a-b99e-2ecdc07bfc25 | Supported
|
||||
[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | c1db55ab-c21a-4637-bb3f-a12568109d35 | Supported
|
||||
[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | Supported
|
||||
[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | d1e49aac-8f56-4280-b9ba-993a6d77406c | Supported
|
||||
[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 | Supported
|
||||
[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | 26190899-1602-49e8-8b27-eb1d0a1ce869 | Supported
|
||||
[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c | Supported
|
||||
[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | e6db77e5-3df2-4cf1-b95a-636979351e5b | Not supported
|
||||
| Rule name | GUID | File & folder exclusions | Minimum OS supported |
|
||||
|-----|----|---|---|
|
||||
|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Not supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater |
|
||||
|
||||
### Block executable content from email client and webmail
|
||||
|
||||
This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers:
|
||||
|
||||
* Executable files (such as .exe, .dll, or .scr)
|
||||
* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Microsoft Endpoint Configuration Manager CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Microsoft Endpoint Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)
|
||||
|
||||
Microsoft Endpoint Configuration Manager name: Block executable content from email client and webmail
|
||||
|
||||
GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
|
||||
GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550`
|
||||
|
||||
### Block all Office applications from creating child processes
|
||||
|
||||
@ -128,27 +134,35 @@ This rule blocks Office apps from creating child processes. This includes Word,
|
||||
|
||||
Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings.
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Office apps launching child processes
|
||||
|
||||
Configuration Manager name: Block Office application from creating child processes
|
||||
|
||||
GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A
|
||||
GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A`
|
||||
|
||||
### Block Office applications from creating executable content
|
||||
|
||||
This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
|
||||
|
||||
Malware that abuse Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique.
|
||||
Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique.
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [System Center Configuration Manager](https://docs.microsoft.com/configmgr/core/servers/manage/updates) (SCCM) CB 1710 (SCCM is now Microsoft Endpoint Configuration Manager)
|
||||
|
||||
Intune name: Office apps/macros creating executable content
|
||||
|
||||
SCCM name: Block Office applications from creating executable content
|
||||
|
||||
GUID: 3B576869-A4EC-4529-8536-B80A7769E899
|
||||
GUID: `3B576869-A4EC-4529-8536-B80A7769E899`
|
||||
|
||||
### Block Office applications from injecting code into other processes
|
||||
|
||||
@ -160,13 +174,17 @@ There are no known legitimate business purposes for using code injection.
|
||||
|
||||
This rule applies to Word, Excel, and PowerPoint.
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Office apps injecting code into other processes (no exceptions)
|
||||
|
||||
Configuration Manager name: Block Office applications from injecting code into other processes
|
||||
|
||||
GUID: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
|
||||
GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84`
|
||||
|
||||
### Block JavaScript or VBScript from launching downloaded executable content
|
||||
|
||||
@ -177,13 +195,17 @@ Although not common, line-of-business applications sometimes use scripts to down
|
||||
> [!IMPORTANT]
|
||||
> File and folder exclusions don't apply to this attack surface reduction rule.
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: js/vbs executing payload downloaded from Internet (no exceptions)
|
||||
|
||||
Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content
|
||||
|
||||
GUID: D3E037E1-3EB8-44C8-A917-57927947596D
|
||||
GUID: `D3E037E1-3EB8-44C8-A917-57927947596D`
|
||||
|
||||
### Block execution of potentially obfuscated scripts
|
||||
|
||||
@ -191,13 +213,17 @@ This rule detects suspicious properties within an obfuscated script.
|
||||
|
||||
Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software.
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Obfuscated js/vbs/ps/macro code
|
||||
|
||||
Configuration Manager name: Block execution of potentially obfuscated scripts.
|
||||
|
||||
GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
|
||||
GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC`
|
||||
|
||||
### Block Win32 API calls from Office macros
|
||||
|
||||
@ -205,37 +231,42 @@ This rule prevents VBA macros from calling Win32 APIs.
|
||||
|
||||
Office VBA provides the ability to make Win32 API calls. Malware can abuse this capability, such as [calling Win32 APIs to launch malicious shellcode](https://www.microsoft.com/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/) without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways.
|
||||
|
||||
This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1710
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Win32 imports from Office macro code
|
||||
|
||||
Configuration Manager name: Block Win32 API calls from Office macros
|
||||
|
||||
GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
|
||||
GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B`
|
||||
|
||||
### Block executable files from running unless they meet a prevalence, age, or trusted list criterion
|
||||
|
||||
This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list:
|
||||
|
||||
* Executable files (such as .exe, .dll, or .scr)
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
|
||||
Launching untrusted or unknown executable files can be risky, as it may not not be initially clear if the files are malicious.
|
||||
|
||||
> [!NOTE]
|
||||
> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule.
|
||||
Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly.
|
||||
> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule. <br/><br/> The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly.
|
||||
>
|
||||
>You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to.
|
||||
|
||||
This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Executables that don't meet a prevalence, age, or trusted list criteria.
|
||||
|
||||
Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria
|
||||
|
||||
GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25
|
||||
GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25`
|
||||
|
||||
### Use advanced protection against ransomware
|
||||
|
||||
@ -244,13 +275,17 @@ This rule provides an extra layer of protection against ransomware. It scans exe
|
||||
> [!NOTE]
|
||||
> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule.
|
||||
|
||||
This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Advanced ransomware protection
|
||||
|
||||
Configuration Manager name: Use advanced protection against ransomware
|
||||
|
||||
GUID: c1db55ab-c21a-4637-bb3f-a12568109d35
|
||||
GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35`
|
||||
|
||||
### Block credential stealing from the Windows local security authority subsystem
|
||||
|
||||
@ -261,13 +296,17 @@ LSASS authenticates users who log in to a Windows computer. Microsoft Defender C
|
||||
> [!NOTE]
|
||||
> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat.
|
||||
|
||||
This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Flag credential stealing from the Windows local security authority subsystem
|
||||
|
||||
Configuration Manager name: Block credential stealing from the Windows local security authority subsystem
|
||||
|
||||
GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2`
|
||||
|
||||
### Block process creations originating from PSExec and WMI commands
|
||||
|
||||
@ -276,13 +315,16 @@ This rule blocks processes created through [PsExec](https://docs.microsoft.com/s
|
||||
> [!WARNING]
|
||||
> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr) because this rule blocks WMI commands the Configuration Manager client uses to function correctly.
|
||||
|
||||
This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Intune name: Process creation from PSExec and WMI commands
|
||||
|
||||
Configuration Manager name: Not applicable
|
||||
|
||||
GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c`
|
||||
|
||||
### Block untrusted and unsigned processes that run from USB
|
||||
|
||||
@ -291,13 +333,17 @@ With this rule, admins can prevent unsigned or untrusted executable files from r
|
||||
* Executable files (such as .exe, .dll, or .scr)
|
||||
* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
|
||||
This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, Configuration Manager CB 1802
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Untrusted and unsigned processes that run from USB
|
||||
|
||||
Configuration Manager name: Block untrusted and unsigned processes that run from USB
|
||||
|
||||
GUID: b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4`
|
||||
|
||||
### Block Office communication application from creating child processes
|
||||
|
||||
@ -308,13 +354,16 @@ This protects against social engineering attacks and prevents exploit code from
|
||||
> [!NOTE]
|
||||
> This rule applies to Outlook and Outlook.com only.
|
||||
|
||||
This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Intune name: Process creation from Office communication products (beta)
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869`
|
||||
|
||||
### Block Adobe Reader from creating child processes
|
||||
|
||||
@ -322,13 +371,16 @@ This rule prevents attacks by blocking Adobe Reader from creating additional pro
|
||||
|
||||
Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading.
|
||||
|
||||
This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Intune name: Process creation from Adobe Reader (beta)
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c`
|
||||
|
||||
### Block persistence through WMI event subscription
|
||||
|
||||
@ -336,17 +388,22 @@ This rule prevents malware from abusing WMI to attain persistence on a device.
|
||||
|
||||
Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
|
||||
|
||||
This rule was introduced in: Windows 10 1903, Windows Server 1903
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903)
|
||||
- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909)
|
||||
|
||||
Intune name: Block persistence through WMI event subscription
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
GUID: e6db77e5-3df2-4cf1-b95a-636979351e5b
|
||||
GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b`
|
||||
|
||||
## Related topics
|
||||
|
||||
* [Attack surface reduction FAQ](attack-surface-reduction.md)
|
||||
* [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
|
||||
* [Compatibility of Microsoft Defender with other antivirus/antimalware](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md)
|
||||
- [Attack surface reduction FAQ](attack-surface-reduction.md)
|
||||
|
||||
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
|
||||
- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
|
||||
|
||||
- [Compatibility of Microsoft Defender with other antivirus/antimalware](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md)
|
||||
|
||||
@ -18,7 +18,9 @@ ms.topic: article
|
||||
|
||||
# View details and results of automated investigations
|
||||
|
||||
Pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) are listed in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)).
|
||||
During and after an automated investigation, certain remediation actions can be identified. Depending on the threat and how [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP) is configured for your organization, some remediation actions are taken automatically.
|
||||
|
||||
If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)). You can also use the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to view details about an investigation.
|
||||
|
||||
>[!NOTE]
|
||||
>If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the machine or machine group will be able to view the entire investigation.
|
||||
@ -27,12 +29,13 @@ Pending and completed [remediation actions](manage-auto-investigation.md#remedia
|
||||
|
||||
|
||||
|
||||
The action center consists of two main tabs, as described in the following table.
|
||||
|
||||
|Tab |Description |
|
||||
|---------|---------|
|
||||
|Pending actions |Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject. <br/><br/>**NOTE**: The Pending tab appears only if there are pending actions to be approved (or rejected). |
|
||||
|History |Acts as an audit log for all of the following: <br/>- All actions taken by automated investigation and remediation in Microsoft Defender ATP <br/>Actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone) <br/>- All commands ran and remediation actions that were applied in Live Response sessions (some actions can be undone) <br/>- Remediation actions that were applied by Windows Defender Antivirus (some actions can be undone) |
|
||||
The action center consists of two main tabs: **Pending actions** and **History**.
|
||||
- **Pending actions** Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject. The Pending tab appears only if there are pending actions to be approved (or rejected).
|
||||
- **History** Acts as an audit log for all of the following items: <br/>
|
||||
- Remediation actions that were taken as a result of an automated investigation
|
||||
- Remediation actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone)
|
||||
- Commands that were run and remediation actions that were applied in Live Response sessions (some actions can be undone)
|
||||
- Remediation actions that were applied by Windows Defender Antivirus (some actions can be undone)
|
||||
|
||||
Use the **Customize columns** menu to select columns that you'd like to show or hide.
|
||||
|
||||
@ -58,29 +61,30 @@ On the **Investigations** page, you can view details and use filters to focus on
|
||||
|---------|---------|
|
||||
|**Status** |(See [Automated investigation status](#automated-investigation-status)) |
|
||||
|**Triggering alert** | The alert that initiated the automated investigation |
|
||||
|**Detection source** |The source of the alert that initiated the automated investigation. |
|
||||
|**Entities** | These can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that you might have created. |
|
||||
|**Threat** |The category of threat detected during the automated investigation. |
|
||||
|**Tags** |Filter using manually added tags that capture the context of an automated investigation.|
|
||||
|**Comments** |Select between filtering the list between automated investigations that have comments and those that don't.|
|
||||
|**Detection source** |The source of the alert that initiated the automated investigation |
|
||||
|**Entities** | Entities can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that were created. |
|
||||
|**Threat** |The category of threat detected during the automated investigation |
|
||||
|**Tags** |Filter using manually added tags that capture the context of an automated investigation|
|
||||
|**Comments** |Select between filtering the list between automated investigations that have comments and those that don't|
|
||||
|
||||
## Automated investigation status
|
||||
|
||||
An automated investigation can be have one of the following status values:
|
||||
An automated investigation can have one of the following status values:
|
||||
|
||||
|Status |Description |
|
||||
|---------|---------|
|
||||
| No threats found | No malicious entities found during the investigation. |
|
||||
| Failed | A problem has interrupted the investigation, preventing it from completing. |
|
||||
| Partially remediated | A problem prevented the remediation of some malicious entities. |
|
||||
| Pending action | Remediation actions require review and approval. |
|
||||
| Running | The investigation process has started and is underway. Malicious artifacts that are found are remediated. |
|
||||
| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for specific details. |
|
||||
| No threats found | The investigation has finished and no threats were identified. <br/>If you suspect something was missed (such as a false negative), you can use [advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). |
|
||||
| Pending action | The investigation has found a threat, and an action to remediate that threat is awaiting approval. The Pending Action state is triggered when any threat with a corresponding action is found. However, the list of pending actions can increase as an investigation runs. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to see if other items are still pending completion. |
|
||||
| Remediated | The investigation finished and all actions were approved (fully remediated). |
|
||||
| Partially remediated | The investigation resulted in remediation actions, and some were approved and completed. Other actions are still pending. |
|
||||
| Terminated by system | The investigation stopped. An investigation can stop for several reasons:<br/>- The investigation's pending actions expired. Pending actions can time out after awaiting approval for an extended period of time. <br/>- There are too many actions in the list.<br/>Visit the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) to view and approve any pending actions. |
|
||||
| Failed | At least one investigation analyzer ran into a problem where it could not complete properly. <br/><br/>If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for detailed results. |
|
||||
| Queued | An investigation is being held in a queue. When other investigations complete, queued investigations begin. |
|
||||
| Waiting for machine | Investigation paused. The investigation will resume as soon as the machine is available. |
|
||||
| Queued | Investigation has been queued and will resume as soon as other remediation activities are completed. |
|
||||
| Running | Investigation ongoing. Malicious entities found will be remediated. |
|
||||
| Remediated | Malicious entities found were successfully remediated. |
|
||||
| Terminated by system | Investigation was stopped by the system. |
|
||||
| Terminated by user | A user stopped the investigation before it could complete. |
|
||||
| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. |
|
||||
|
||||
|
||||
## View details about an automated investigation
|
||||
|
||||
@ -92,7 +96,7 @@ In this view, you'll see the name of the investigation, when it started and ende
|
||||
|
||||
### Investigation graph
|
||||
|
||||
The investigation graph provides a graphical representation of an automated investigation. All investigation related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information.
|
||||
The investigation graph provides a graphical representation of an automated investigation. All investigation-related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information.
|
||||
|
||||
A progress ring shows two status indicators:
|
||||
- Orange ring - shows the pending portion of the investigation
|
||||
@ -108,7 +112,7 @@ From this view, you can also view and add comments and tags about the investigat
|
||||
|
||||
### Alerts
|
||||
|
||||
The **Alerts** tab for an automated investigation shows details such as a short description of the alert that initiated the automated investigation, severity, category, the machine associated with the alert, user, time in queue, status, investigation state, and who the investigation is assigned to.
|
||||
The **Alerts** tab for an automated investigation shows details such as a short description of the alert that initiated the automated investigation, severity, category, the machine associated with the alert, user, time in queue, status, investigation state, and to whom the investigation is assigned.
|
||||
|
||||
Additional alerts seen on a machine can be added to an automated investigation as long as the investigation is ongoing.
|
||||
|
||||
@ -124,7 +128,7 @@ Machines that show the same threat can be added to an ongoing investigation and
|
||||
|
||||
Selecting a machine using the checkbox brings up the machine details pane where you can see more information such as machine details and logged-on users.
|
||||
|
||||
Clicking on an machine name brings you the machine page.
|
||||
Clicking on a machine name brings you the machine page.
|
||||
|
||||
### Evidence
|
||||
|
||||
@ -146,7 +150,7 @@ You can also click on an action to bring up the details pane where you'll see in
|
||||
|
||||
### Pending actions
|
||||
|
||||
If there are pending actions on an automated investigation, you'll see a pop up similar to the following image.
|
||||
If there are pending actions on an automated investigation, you'll see a pop-up similar to the following image.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -77,7 +77,6 @@ Not currently available.
|
||||
|
||||
## Integrations
|
||||
Integrations with the following Microsoft products are not currently available:
|
||||
- Azure Security Center
|
||||
- Azure Advanced Threat Protection
|
||||
- Azure Information Protection
|
||||
- Office 365 Advanced Threat Protection
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure HP ArcSight to pull Microsoft Defender ATP detections
|
||||
description: Configure HP ArcSight to receive and pull detections from Microsoft Defender Security Center
|
||||
keywords: configure hp arcsight, security information and events management tools, arcsight
|
||||
title: Configure Micro Focus ArcSight to pull Microsoft Defender ATP detections
|
||||
description: Configure Micro Focus ArcSight to receive and pull detections from Microsoft Defender Security Center
|
||||
keywords: configure Micro Focus ArcSight, security information and events management tools, arcsight
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure HP ArcSight to pull Microsoft Defender ATP detections
|
||||
# Configure Micro Focus ArcSight to pull Microsoft Defender ATP detections
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -28,14 +28,15 @@ ms.topic: article
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink)
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP detections.
|
||||
You'll need to install and configure some files and tools to use Micro Focus ArcSight so that it can pull Microsoft Defender ATP detections.
|
||||
|
||||
>[!Note]
|
||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details.
|
||||
|
||||
## Before you begin
|
||||
Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application.
|
||||
|
||||
Configuring the Micro Focus ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application.
|
||||
|
||||
This section guides you in getting the necessary information to set and use the required configuration files correctly.
|
||||
|
||||
@ -50,7 +51,7 @@ This section guides you in getting the necessary information to set and use the
|
||||
- WDATP-connector.properties
|
||||
- WDATP-connector.jsonparser.properties
|
||||
|
||||
You would have saved a .zip file which contains these two files when you chose HP ArcSight as the SIEM type you use in your organization.
|
||||
You would have saved a .zip file which contains these two files when you chose Micro Focus ArcSight as the SIEM type you use in your organization.
|
||||
|
||||
- Make sure you generate the following tokens and have them ready:
|
||||
- Access token
|
||||
@ -58,7 +59,8 @@ This section guides you in getting the necessary information to set and use the
|
||||
|
||||
You can generate these tokens from the **SIEM integration** setup section of the portal.
|
||||
|
||||
## Install and configure HP ArcSight FlexConnector
|
||||
## Install and configure Micro Focus ArcSight FlexConnector
|
||||
|
||||
The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin).
|
||||
|
||||
1. Install the latest 32-bit Windows FlexConnector installer. You can find this in the HPE Software center. The tool is typically installed in the following default location: `C:\Program Files\ArcSightFlexConnectors\current\bin`.</br></br>You can choose where to save the tool, for example C:\\*folder_location*\current\bin where *folder_location* represents the installation location.
|
||||
@ -79,8 +81,9 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
|
||||
- WDATP-connector.properties: C:\\*folder_location*\current\user\agent\flexagent\
|
||||
|
||||
NOTE:
|
||||
You must put the configuration files in this location, where *folder_location* represents the location where you installed the tool.
|
||||
> [!NOTE]
|
||||
>
|
||||
> You must put the configuration files in this location, where *folder_location* represents the location where you installed the tool.
|
||||
|
||||
4. After the installation of the core connector completes, the Connector Setup window opens. In the Connector Setup window, select **Add a Connector**.
|
||||
|
||||
@ -114,30 +117,36 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
</table><br/>7. A browser window is opened by the connector. Login with your application credentials. After you log in, you'll be asked to give permission to your OAuth2 Client. You must give permission to your OAuth 2 Client so that the connector configuration can authenticate. </br></br>
|
||||
If the <code>redirect_uri</code> is a https URL, you'll be redirected to a URL on the local host. You'll see a page that requests for you to trust the certificate supplied by the connector running on the local host. You'll need to trust this certificate if the redirect_uri is a https. </br></br> If however you specify a http URL for the redirect_uri, you do not need to provide consent in trusting the certificate.
|
||||
</table><br/>
|
||||
|
||||
7. A browser window is opened by the connector. Login with your application credentials. After you log in, you'll be asked to give permission to your OAuth2 Client. You must give permission to your OAuth 2 Client so that the connector configuration can authenticate.
|
||||
|
||||
7. Continue with the connector setup by returning to the HP ArcSight Connector Setup window.
|
||||
If the <code>redirect_uri</code> is a https URL, you'll be redirected to a URL on the local host. You'll see a page that requests for you to trust the certificate supplied by the connector running on the local host. You'll need to trust this certificate if the redirect_uri is a https.
|
||||
|
||||
If however you specify a http URL for the redirect_uri, you do not need to provide consent in trusting the certificate.
|
||||
|
||||
8. Select the **ArcSight Manager (encrypted)** as the destination and click **Next**.
|
||||
8. Continue with the connector setup by returning to the Micro Focus ArcSight Connector Setup window.
|
||||
|
||||
9. Type in the destination IP/hostname in **Manager Hostname** and your credentials in the parameters form. All other values in the form should be retained with the default values. Click **Next**.
|
||||
9. Select the **ArcSight Manager (encrypted)** as the destination and click **Next**.
|
||||
|
||||
10. Type in a name for the connector in the connector details form. All other values in the form are optional and can be left blank. Click **Next**.
|
||||
10. Type in the destination IP/hostname in **Manager Hostname** and your credentials in the parameters form. All other values in the form should be retained with the default values. Click **Next**.
|
||||
|
||||
11. The ESM Manager import certificate window is shown. Select **Import the certificate to connector from destination** and click **Next**. The **Add connector Summary** window is displayed and the certificate is imported.
|
||||
11. Type in a name for the connector in the connector details form. All other values in the form are optional and can be left blank. Click **Next**.
|
||||
|
||||
12. Verify that the details in the **Add connector Summary** window is correct, then click **Next**.
|
||||
12. The ESM Manager import certificate window is shown. Select **Import the certificate to connector from destination** and click **Next**. The **Add connector Summary** window is displayed and the certificate is imported.
|
||||
|
||||
13. Select **Install as a service** and click **Next**.
|
||||
13. Verify that the details in the **Add connector Summary** window is correct, then click **Next**.
|
||||
|
||||
14. Type a name in the **Service Internal Name** field. All other values in the form can be retained with the default values or left blank . Click **Next**.
|
||||
14. Select **Install as a service** and click **Next**.
|
||||
|
||||
15. Type in the service parameters and click **Next**. A window with the **Install Service Summary** is shown. Click **Next**.
|
||||
15. Type a name in the **Service Internal Name** field. All other values in the form can be retained with the default values or left blank . Click **Next**.
|
||||
|
||||
16. Finish the installation by selecting **Exit** and **Next**.
|
||||
16. Type in the service parameters and click **Next**. A window with the **Install Service Summary** is shown. Click **Next**.
|
||||
|
||||
17. Finish the installation by selecting **Exit** and **Next**.
|
||||
|
||||
## Install and configure the Micro Focus ArcSight console
|
||||
|
||||
## Install and configure the HP ArcSight console
|
||||
1. Follow the installation wizard through the following tasks:
|
||||
- Introduction
|
||||
- License Agreement
|
||||
@ -158,18 +167,19 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
|
||||
7. Click **Done** to quit the installer.
|
||||
|
||||
8. Login to the HP ArcSight console.
|
||||
8. Login to the Micro Focus ArcSight console.
|
||||
|
||||
9. Navigate to **Active channel set** > **New Condition** > **Device** > **Device Product**.
|
||||
|
||||
10. Set **Device Product = Microsoft Defender ATP**. When you've verified that events are flowing to the tool, stop the process again and go to Windows Services and start the ArcSight FlexConnector REST.
|
||||
|
||||
You can now run queries in the HP ArcSight console.
|
||||
You can now run queries in the Micro Focus ArcSight console.
|
||||
|
||||
Microsoft Defender ATP detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
|
||||
|
||||
## Troubleshooting HP ArcSight connection
|
||||
## Troubleshooting Micro Focus ArcSight connection
|
||||
|
||||
**Problem:** Failed to refresh the token. You can find the log located in C:\\*folder_location*\current\logs where *folder_location* represents the location where you installed the tool. Open _agent.log_ and look for `ERROR/FATAL/WARN`.
|
||||
|
||||
**Symptom:** You get the following error message:
|
||||
@ -177,7 +187,9 @@ Microsoft Defender ATP detections will appear as discrete events, with "Microsof
|
||||
`Failed to refresh the token. Set reauthenticate to true: com.arcsight.common.al.e: Failed to refresh access token: status=HTTP/1.1 400 Bad Request FATAL EXCEPTION: Could not refresh the access token`
|
||||
|
||||
**Solution:**
|
||||
|
||||
1. Stop the process by clicking Ctrl + C on the Connector window. Click **Y** when asked "Terminate batch job Y/N?".
|
||||
|
||||
2. Navigate to the folder where you stored the WDATP-connector.properties file and edit it to add the following value:
|
||||
`reauthenticate=true`.
|
||||
|
||||
|
||||
@ -34,7 +34,7 @@ For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedTh
|
||||
## Before you begin
|
||||
If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwise, settings will not be applied successfully.
|
||||
|
||||
For more information on enabling MDM with Microsoft Intune, see [Setup Windows Device Management](https://docs.microsoft.com/intune-classic/deploy-use/set-up-windows-device-management-with-microsoft-intune).
|
||||
For more information on enabling MDM with Microsoft Intune, see [Device enrollment (Microsoft Intune)](https://docs.microsoft.com/mem/intune/enrollment/device-enrollment).
|
||||
|
||||
## Onboard machines using Microsoft Intune
|
||||
|
||||
|
||||
@ -15,7 +15,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
ms.date: 04/16/2020
|
||||
---
|
||||
|
||||
# Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
@ -23,7 +23,8 @@ ms.date: 04/24/2018
|
||||
**Applies to:**
|
||||
- Virtual desktop infrastructure (VDI) machines
|
||||
|
||||
|
||||
>[!WARNING]
|
||||
> Micrsosoft Defender ATP currently does not support Windows Virtual Desktop multi-user session.
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configvdi-abovefoldlink)
|
||||
|
||||
@ -80,26 +81,62 @@ The following steps will guide you through onboarding VDI machines and will high
|
||||
|
||||
6. Test your solution:
|
||||
|
||||
a. Create a pool with one machine.
|
||||
a. Create a pool with one machine.
|
||||
|
||||
b. Logon to machine.
|
||||
b. Logon to machine.
|
||||
|
||||
c. Logoff from machine.
|
||||
c. Logoff from machine.
|
||||
|
||||
d. Logon to machine with another user.
|
||||
d. Logon to machine with another user.
|
||||
|
||||
e. **For single entry for each machine**: Check only one entry in Microsoft Defender Security Center.<br>
|
||||
e. **For single entry for each machine**: Check only one entry in Microsoft Defender Security Center.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in Microsoft Defender Security Center.
|
||||
|
||||
7. Click **Machines list** on the Navigation pane.
|
||||
|
||||
8. Use the search function by entering the machine name and select **Machine** as search type.
|
||||
|
||||
## Updating non-persistent virtual desktop infrastructure (VDI) images
|
||||
As a best practice, we recommend using offline servicing tools to patch golden/master images.<br>
|
||||
For example, you can use the below commands to install an update while the image remains offline:
|
||||
|
||||
```
|
||||
DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing"
|
||||
DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu"
|
||||
DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit
|
||||
```
|
||||
|
||||
For more information on DISM commands and offline servicing, please refer to the articles below:
|
||||
- [Modify a Windows image using DISM](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism)
|
||||
- [DISM Image Management Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14)
|
||||
- [Reduce the Size of the Component Store in an Offline Windows Image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reduce-the-size-of-the-component-store-in-an-offline-windows-image)
|
||||
|
||||
If offline servicing is not a viable option for your non-persistent VDI environment, the following steps should be taken to ensure consistency and sensor health:
|
||||
|
||||
1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script).
|
||||
|
||||
2. Ensure the sensor is stopped by running the command below in a CMD window:
|
||||
|
||||
```
|
||||
sc query sense
|
||||
```
|
||||
|
||||
3. Service the image as needed.
|
||||
|
||||
4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot:
|
||||
|
||||
```
|
||||
PsExec.exe -s cmd.exe
|
||||
cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber"
|
||||
del *.* /f /s /q
|
||||
exit
|
||||
```
|
||||
|
||||
5. Re-seal the golden/master image as you normally would.
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md)
|
||||
- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md)
|
||||
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ ms.topic: article
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Microsoft Defender Security Center console.
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
- Windows Server 2008 R2 SP1
|
||||
@ -43,26 +43,19 @@ The service supports the onboarding of the following servers:
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
> [!NOTE]
|
||||
> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services)
|
||||
|
||||
## Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016
|
||||
## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Microsoft Defender Security Center
|
||||
- **Option 1**: Onboard through Microsoft Defender Security Center
|
||||
- **Option 2**: Onboard through Azure Security Center
|
||||
|
||||
### Option 1: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
> [!NOTE]
|
||||
> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services).
|
||||
|
||||
2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Microsoft Defender Security Center
|
||||
### Option 1: Onboard servers through Microsoft Defender Security Center
|
||||
You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center.
|
||||
|
||||
- For Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements:
|
||||
@ -77,17 +70,15 @@ You'll need to take the following steps if you choose to onboard servers through
|
||||
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Microsoft Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
|
||||
> [!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
> [!IMPORTANT]
|
||||
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
@ -100,7 +91,7 @@ The following steps are required to enable this integration:
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment setup. When the setup completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
|
||||
@ -125,8 +116,20 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
|
||||
|
||||
### Option 2: Onboard servers through Azure Security Center
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
|
||||
|
||||
## Windows Server, version 1803 and Windows Server 2019
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, please refer to the supported methods and versions below.
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below.
|
||||
|
||||
> [!NOTE]
|
||||
> The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs).
|
||||
@ -140,11 +143,11 @@ Supported tools include:
|
||||
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
|
||||
Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
Support for Windows Server, provide deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
|
||||
2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly:
|
||||
2. If you're running a third-party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings. Verify that it was configured correctly:
|
||||
|
||||
a. Set the following registry entry:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
@ -165,17 +168,17 @@ Support for Windows Server, version 1803 and Windows 2019 provides deeper insigh
|
||||
|
||||
```sc query Windefend```
|
||||
|
||||
If the result is ‘The specified service does not exist as an installed service’, then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
If the result is 'The specified service does not exist as an installed service', then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
> [!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
> Automated onboarding is only applicable for Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
@ -76,6 +76,9 @@ See the [attack surface reduction](attack-surface-reduction.md) topic for detail
|
||||
|
||||
4. Double-click the **Exclude files and paths from Attack surface reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item.
|
||||
|
||||
> [!WARNING]
|
||||
> Do not use quotes as they are not supported for either the **Value name** column or the **Value** column.
|
||||
|
||||
### Use PowerShell to exclude files and folders
|
||||
|
||||
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator**
|
||||
|
||||
@ -89,7 +89,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
|
||||
>
|
||||
> Mikael then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, he enables the **Override system settings** option and sets the switch to **On**. There are no other apps listed in the **Program settings** section.
|
||||
>
|
||||
> The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied.
|
||||
> The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied.
|
||||
>
|
||||
>
|
||||
> * **Example 2**
|
||||
@ -100,8 +100,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
|
||||
>
|
||||
> Josie also adds the app *miles.exe* to the **Program settings** section and configures **Control flow guard (CFG)** to **On**. She doesn't enable the **Override system settings** option for DEP or any other mitigations for that app.
|
||||
>
|
||||
>The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*.
|
||||
>CFG will be enabled for *miles.exe*.
|
||||
> The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. CFG will be enabled for *miles.exe*.
|
||||
|
||||
> [!NOTE]
|
||||
> If you have found any issues in this article, you can report it directly to a Windows Server/Windows Client partner or use the Microsoft technical support numbers for your country.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Update how long data is stored by MDATP
|
||||
description: Update data retention settings for Microsoft Defender Advanced Threat Protection (MDATP) by selecting between 30 days to 180 days.
|
||||
title: Verify data storage location and update data retention settings
|
||||
description: Verify data storage location and update data retention settings for Microsoft Defender Advanced Threat Protection
|
||||
keywords: data, storage, settings, retention, update
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -15,9 +15,8 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
# Update data retention settings for Microsoft Defender ATP
|
||||
# Verify data storage location and update data retention settings for Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -25,10 +24,18 @@ ms.date: 04/24/2018
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-gensettings-abovefoldlink)
|
||||
|
||||
During the onboarding process, a wizard takes you through the general settings of Microsoft Defender ATP. After onboarding, you might want to update the data retention settings.
|
||||
During the onboarding process, a wizard takes you through the data storage and retention settings of Microsoft Defender ATP.
|
||||
|
||||
After completing the onboarding, you can verify your selection in the data retention settings page.
|
||||
|
||||
## Verify data storage location
|
||||
During the [Set up phase](production-deployment.md), you would have selected the location to store your data.
|
||||
|
||||
You can verify the data location by navigating to **Settings** > **Data retention**.
|
||||
|
||||
## Update data retention settings
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Data retention**.
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@ -131,10 +131,13 @@ Value: c:\path|e:\path|c:\Whitelisted.exe
|
||||
|
||||
5. To exclude files and folders from ASR rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item.
|
||||
|
||||
> [!WARNING]
|
||||
> Do not use quotes as they are not supported for either the **Value name** column or the **Value** column.
|
||||
|
||||
## PowerShell
|
||||
|
||||
>[!WARNING]
|
||||
>If you manage your computers and devices with Intune, Configuration Manager, or other enterprise-level management platform, the management software will overwrite any conflicting PowerShell settings on startup.
|
||||
> [!WARNING]
|
||||
> If you manage your computers and devices with Intune, Configuration Manager, or other enterprise-level management platform, the management software will overwrite any conflicting PowerShell settings on startup.
|
||||
|
||||
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator**.
|
||||
|
||||
|
||||
@ -28,11 +28,31 @@ You can [audit network protection](evaluate-network-protection.md) in a test env
|
||||
|
||||
You can enable network protection by using any of these methods:
|
||||
|
||||
* [PowerShell](#powershell)
|
||||
* [Microsoft Intune](#intune)
|
||||
* [Mobile Device Management (MDM)](#mdm)
|
||||
* [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager)
|
||||
* [Group Policy](#group-policy)
|
||||
* [PowerShell](#powershell)
|
||||
|
||||
## PowerShell
|
||||
|
||||
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection Enabled
|
||||
```
|
||||
|
||||
You can enable the feature in audit mode using the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
|
||||
Use `Disabled` instead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
|
||||
|
||||
|
||||
|
||||
## Intune
|
||||
|
||||
@ -89,22 +109,6 @@ You can confirm network protection is enabled on a local computer by using Regis
|
||||
* 1=On
|
||||
* 2=Audit
|
||||
|
||||
## PowerShell
|
||||
|
||||
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection Enabled
|
||||
```
|
||||
|
||||
You can enable the feature in audit mode using the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
|
||||
Use `Disabled` instead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -67,6 +67,8 @@ Enable security information and event management (SIEM) integration so you can p
|
||||
> [!NOTE]
|
||||
> You'll need to generate a new Refresh token every 90 days.
|
||||
|
||||
6. Follow the instructions for [creating an Azure AD app registration for Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp) and assign the correct permissions to it to read alerts.
|
||||
|
||||
You can now proceed with configuring your SIEM solution or connecting to the detections REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive detections from Microsoft Defender Security Center.
|
||||
|
||||
## Integrate Microsoft Defender ATP with IBM QRadar
|
||||
|
||||
@ -58,6 +58,9 @@ Event ID | Description
|
||||
1124 | Audited controlled folder access event
|
||||
1123 | Blocked controlled folder access event
|
||||
|
||||
> [!TIP]
|
||||
> You can configure a [Windows Event Forwarding subscription](https://docs.microsoft.com/windows/win32/wec/setting-up-a-source-initiated-subscription) to collect the logs centrally.
|
||||
|
||||
## Customize protected folders and apps
|
||||
|
||||
During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 138 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB After Width: | Height: | Size: 55 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 56 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 223 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 53 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 115 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 54 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 145 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 7.6 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB |
@ -21,11 +21,11 @@ manager: dansimp
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](microsoft-defender-advanced-threat-protection.md)
|
||||
|
||||
Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level.
|
||||
|
||||
Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are now included in exploit protection.
|
||||
Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/help/2458544/) are now included in exploit protection.
|
||||
|
||||
You use the Windows Security app or PowerShell to create a set of mitigations (known as a configuration). You can then export this configuration as an XML file and share it with multiple machines on your network so they all have the same set of mitigation settings.
|
||||
|
||||
@ -33,7 +33,7 @@ You can also convert and import an existing EMET configuration XML file into an
|
||||
|
||||
This topic describes how to create a configuration file and deploy it across your network, and how to convert an EMET configuration.
|
||||
|
||||
The [Evaluation Package](https://aka.ms/mp7z2w) contains a sample configuration file (name *ProcessMitigation-Selfhost-v4.xml* that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic.
|
||||
The [Evaluation Package](https://demo.wd.microsoft.com/Page/EP) contains a sample configuration file (name *ProcessMitigation.xml* (Selfhost v4) that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic.
|
||||
|
||||
## Create and export a configuration file
|
||||
|
||||
@ -53,27 +53,28 @@ When you have configured exploit protection to your desired state (including bot
|
||||
|
||||
3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file.
|
||||
> [!IMPORTANT]
|
||||
> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections - either section will export all settings.
|
||||
> [!NOTE]
|
||||
> When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections—either section will export all settings.
|
||||
|
||||
### Use PowerShell to export a configuration file
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**.
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Get-ProcessMitigation -RegistryConfigFilePath filename.xml
|
||||
```
|
||||
|
||||
Change `filename` to any name or location of your choosing.
|
||||
Change `filename` to any name or location of your choosing.
|
||||
|
||||
Example command
|
||||
**Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml**
|
||||
Example command:
|
||||
|
||||
**Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml**
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration file. Ensure you place the file in a shared location.
|
||||
@ -86,17 +87,18 @@ After importing, the settings will be instantly applied and can be reviewed in t
|
||||
|
||||
### Use PowerShell to import a configuration file
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**.
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -PolicyFilePath filename.xml
|
||||
```
|
||||
|
||||
Change `filename` to the location and name of the exploit protection XML file.
|
||||
Change `filename` to the location and name of the exploit protection XML file.
|
||||
|
||||
Example command
|
||||
**Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml**
|
||||
Example command:
|
||||
|
||||
**Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml**
|
||||
|
||||
> [!IMPORTANT]
|
||||
>
|
||||
@ -116,14 +118,14 @@ You can only do this conversion in PowerShell.
|
||||
>
|
||||
> You can then convert that file using the PowerShell cmdlet described here before importing the settings into Exploit protection.
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**.
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
ConvertTo-ProcessMitigationPolicy -EMETFilePath emetFile.xml -OutputFilePath filename.xml
|
||||
```
|
||||
|
||||
Change `emetFile` to the name and location of the EMET configuration file, and change `filename` to whichever location and file name you want to use.
|
||||
Change `emetFile` to the name and location of the EMET configuration file, and change `filename` to whichever location and file name you want to use.
|
||||
|
||||
> [!IMPORTANT]
|
||||
>
|
||||
@ -141,7 +143,7 @@ You can use Group Policy to deploy the configuration you've created to multiple
|
||||
|
||||
### Use Group Policy to distribute the configuration
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
|
||||
@ -151,14 +153,14 @@ You can use Group Policy to deploy the configuration you've created to multiple
|
||||
|
||||
4. Double-click the **Use a common set of Exploit protection settings** setting and set the option to **Enabled**.
|
||||
|
||||
5. In the **Options::** section, enter the location and filename of the Exploit protection configuration file that you want to use, such as in the following examples:
|
||||
5. In the **Options::** section, enter the location and file name of the Exploit protection configuration file that you want to use, such as in the following examples:
|
||||
|
||||
* C:\MitigationSettings\Config.XML
|
||||
* \\\Server\Share\Config.xml
|
||||
* https://localhost:8080/Config.xml
|
||||
* C:\ExploitConfigfile.xml
|
||||
|
||||
6. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx).
|
||||
6. Click **OK** and [Deploy the updated GPO as you normally do](https://docs.microsoft.com/windows/win32/srvnodes/group-policy).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Information protection in Windows overview
|
||||
ms.reviewer:
|
||||
description: Learn about how information protection works in Windows to identify and protect sensitive information
|
||||
keywords: information, protection, dlp, wip, data, loss, prevention, protect
|
||||
keywords: information, protection, dlp, data, loss, prevention, protect
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -35,7 +35,7 @@ Microsoft Defender ATP applies the following methods to discover, classify, and
|
||||
|
||||
- **Data discovery** - Identify sensitive data on Windows devices at risk
|
||||
- **Data classification** - Automatically classify data based on common Microsoft Information Protection (MIP) policies managed in Office 365 Security & Compliance Center. Auto-classification allows you to protect sensitive data even if the end user hasn’t manually classified it.
|
||||
- **Data protection** - Windows Information Protection (WIP) as outcome of Azure Information Protection label
|
||||
|
||||
|
||||
## Data discovery and data classification
|
||||
|
||||
@ -95,6 +95,4 @@ InformationProtectionLogs_CL
|
||||
- Go to **Settings** in Microsoft Defender Security Center, click on **Advanced Settings** under **General**.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [How Windows Information Protection protects files with a sensitivity label](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels)
|
||||
|
||||
@ -43,6 +43,9 @@ The choice of the channel determines the type and frequency of updates that are
|
||||
|
||||
In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
|
||||
|
||||
> [!WARNING]
|
||||
> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
|
||||
|
||||
### RHEL and variants (CentOS and Oracle Linux)
|
||||
|
||||
- Note your distribution and version, and identify the closest entry for it under `https://packages.microsoft.com/config/`.
|
||||
@ -201,15 +204,19 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
4. From a command prompt, verify that you have the file.
|
||||
Extract the contents of the archive:
|
||||
|
||||
```bash
|
||||
ls -l
|
||||
total 8
|
||||
-rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip
|
||||
```bash
|
||||
ls -l
|
||||
```
|
||||
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
Archive: WindowsDefenderATPOnboardingPackage.zip
|
||||
inflating: WindowsDefenderATPOnboarding.py
|
||||
```
|
||||
`total 8`
|
||||
`-rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip`
|
||||
|
||||
```bash
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
```
|
||||
|
||||
`Archive: WindowsDefenderATPOnboardingPackage.zip`
|
||||
`inflating: WindowsDefenderATPOnboarding.py`
|
||||
|
||||
## Client configuration
|
||||
|
||||
@ -231,14 +238,12 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
```bash
|
||||
mdatp --health orgId
|
||||
[your organization identifier]
|
||||
```
|
||||
|
||||
4. A few minutes after you complete the installation, you can see the status by running the following command. A return value of `1` denotes that the product is functioning as expected:
|
||||
|
||||
```bash
|
||||
mdatp --health healthy
|
||||
1
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
@ -248,22 +253,21 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
- Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command):
|
||||
|
||||
```bash
|
||||
mdatp --health realTimeProtectionEnabled
|
||||
1
|
||||
```
|
||||
```bash
|
||||
mdatp --health realTimeProtectionEnabled
|
||||
```
|
||||
|
||||
- Open a Terminal window. Copy and execute the following command:
|
||||
|
||||
``` bash
|
||||
curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
|
||||
```
|
||||
``` bash
|
||||
curl -o ~/Downloads/eicar.com.txt https://www.eicar.org/download/eicar.com.txt
|
||||
```
|
||||
|
||||
- The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats:
|
||||
|
||||
```bash
|
||||
mdatp --threat --list --pretty
|
||||
```
|
||||
```bash
|
||||
mdatp --threat --list --pretty
|
||||
```
|
||||
|
||||
## Log installation issues
|
||||
|
||||
|
||||
@ -139,6 +139,9 @@ Create subtask or role files that contribute to an actual task. First create the
|
||||
|
||||
In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
|
||||
|
||||
> [!WARNING]
|
||||
> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
|
||||
|
||||
Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`.
|
||||
|
||||
In the following commands, replace *[distro]* and *[version]* with the information you've identified.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy Microsoft Defender ATP for Linux with Puppet
|
||||
ms.reviewer:
|
||||
ms.reviewer:
|
||||
description: Describes how to deploy Microsoft Defender ATP for Linux using Puppet.
|
||||
keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -14,7 +14,7 @@ author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
@ -48,7 +48,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
|
||||
4. From a command prompt, verify that you have the file. Extract the contents of the archive:
|
||||
|
||||
|
||||
```bash
|
||||
$ ls -l
|
||||
total 8
|
||||
@ -60,7 +60,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
## Create a Puppet manifest
|
||||
|
||||
You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of the *apt* module available from puppetlabs, and assumes that the apt module has been installed on your Puppet server.
|
||||
You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of the *apt* and *yumrepo* modules available from puppetlabs, and assumes that the modules have been installed on your Puppet server.
|
||||
|
||||
Create the folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your Puppet installation. This is typically located in */etc/puppetlabs/code/environments/production/modules* on your Puppet server. Copy the mdatp_onboard.json file created above to the *install_mdatp/files* folder. Create an *init.pp* file that contains the deployment instructions:
|
||||
|
||||
@ -84,46 +84,74 @@ The choice of the channel determines the type and frequency of updates that are
|
||||
|
||||
In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
|
||||
|
||||
> [!WARNING]
|
||||
> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
|
||||
|
||||
Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`.
|
||||
|
||||
In the below commands, replace *[distro]* and *[version]* with the information you've identified:
|
||||
|
||||
> [!NOTE]
|
||||
> In case of Oracle Linux, replace *[distro]* with “rhel”.
|
||||
> In case of RedHat, Oracle EL, and CentOS 8, replace *[distro]* with 'rhel'.
|
||||
|
||||
```puppet
|
||||
class install_mdatp {
|
||||
# Puppet manifest to install Microsoft Defender ATP.
|
||||
# @param channel The release channel based on your environment, insider-fast or prod.
|
||||
# @param distro The Linux distribution in lowercase. In case of RedHat, Oracle EL, and CentOS 8, the distro variable should be 'rhel'.
|
||||
# @param version The Linux distribution release number, e.g. 7.4.
|
||||
|
||||
if ($osfamily == 'Debian') {
|
||||
apt::source { 'microsoftpackages' :
|
||||
location => 'https://packages.microsoft.com/[distro]/[version]/prod', # change the version and distro based on your OS
|
||||
release => '[channel]',
|
||||
repos => 'main',
|
||||
key => {
|
||||
'id' => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF',
|
||||
'server' => 'https://packages.microsoft.com/keys/microsoft.asc',
|
||||
},
|
||||
class install_mdatp (
|
||||
$channel = 'insiders-fast',
|
||||
$distro = undef,
|
||||
$version = undef
|
||||
){
|
||||
case $::osfamily {
|
||||
'Debian' : {
|
||||
apt::source { 'microsoftpackages' :
|
||||
location => "https://packages.microsoft.com/${distro}/${version}/prod",
|
||||
release => $channel,
|
||||
repos => 'main',
|
||||
key => {
|
||||
'id' => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF',
|
||||
'server' => 'keyserver.ubuntu.com',
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
yumrepo { 'microsoftpackages' :
|
||||
baseurl => 'https://packages.microsoft.com/[distro]/[version]/[channel]', # change the version and distro based on your OS
|
||||
enabled => 1,
|
||||
gpgcheck => 1,
|
||||
gpgkey => 'https://packages.microsoft.com/keys/microsoft.asc'
|
||||
'RedHat' : {
|
||||
yumrepo { 'microsoftpackages' :
|
||||
baseurl => "https://packages.microsoft.com/${distro}/${version}/${channel}",
|
||||
descr => "packages-microsoft-com-prod-${channel}",
|
||||
enabled => 1,
|
||||
gpgcheck => 1,
|
||||
gpgkey => 'https://packages.microsoft.com/keys/microsoft.asc'
|
||||
}
|
||||
}
|
||||
default : { fail("${::osfamily} is currently not supported.") }
|
||||
}
|
||||
|
||||
package { 'mdatp':
|
||||
ensure => 'installed',
|
||||
}
|
||||
case $::osfamily {
|
||||
/(Debian|RedHat)/: {
|
||||
file { ['/etc/opt', '/etc/opt/microsoft', '/etc/opt/microsoft/mdatp']:
|
||||
ensure => directory,
|
||||
owner => root,
|
||||
group => root,
|
||||
mode => '0755'
|
||||
}
|
||||
|
||||
file { ['/etc', '/etc/opt', '/etc/opt/microsoft', '/etc/opt/microsoft/mdatp']:
|
||||
ensure => directory,
|
||||
}
|
||||
file { '/etc/opt/microsoft/mdatp/mdatp_onboard.json':
|
||||
mode => "0644",
|
||||
source => 'puppet:///modules/install_mdatp/mdatp_onboard.json',
|
||||
file { '/etc/opt/microsoft/mdatp/mdatp_onboard.json':
|
||||
source => 'puppet:///modules/mdatp/mdatp_onboard.json',
|
||||
owner => root,
|
||||
group => root,
|
||||
mode => '0600',
|
||||
require => File['/etc/opt/microsoft/mdatp']
|
||||
}
|
||||
|
||||
package { 'mdatp':
|
||||
ensure => 'installed',
|
||||
require => File['/etc/opt/microsoft/mdatp/mdatp_onboard.json']
|
||||
}
|
||||
}
|
||||
default : { fail("${::osfamily} is currently not supported.") }
|
||||
}
|
||||
}
|
||||
```
|
||||
@ -162,7 +190,7 @@ orgId : "[your organization identifier]"
|
||||
You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status:
|
||||
|
||||
```bash
|
||||
$ mdatp --health healthy
|
||||
mdatp --health healthy
|
||||
```
|
||||
|
||||
The above command prints `1` if the product is onboarded and functioning as expected.
|
||||
|
||||
@ -54,7 +54,7 @@ OK https://cdn.x.cp.wd.microsoft.com/ping
|
||||
> [!WARNING]
|
||||
> PAC, WPAD, and authenticated proxies are not supported. Ensure that only a static proxy or transparent proxy is being used.
|
||||
>
|
||||
> Intercepting proxies are also not supported for security reasons. Configure your proxy server to directly pass through data from Microsoft Defender ATP for Linux to the relevant URLs without interception. Adding your proxy certificate to the global store will not allow for interception.
|
||||
> SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Microsoft Defender ATP for Linux to the relevant URLs without interception. Adding your interception certificate to the global store will not allow for interception.
|
||||
|
||||
If a static proxy is required, add a proxy parameter to the above command, where `proxy_address:port` correspond to the proxy address and port:
|
||||
|
||||
@ -64,6 +64,9 @@ $ curl -x http://proxy_address:port -w ' %{url_effective}\n' 'https://x.cp.wd.mi
|
||||
|
||||
Ensure that you use the same proxy address and port as configured in the `/lib/system/system/mdatp.service` file. Check your proxy configuration if there are errors from the above commands.
|
||||
|
||||
> [!WARNING]
|
||||
> The static proxy cannot be configured through a system-wide `HTTPS_PROXY` environment variable. Instead, ensure that `HTTPS_PROXY` is properly set in the `/lib/system/system/mdatp.service` file.
|
||||
|
||||
To use a static proxy, the `mdatp.service` file must be modified. Ensure the leading `#` is removed to uncomment the following line from `/lib/systemd/system/mdatp.service`:
|
||||
|
||||
```bash
|
||||
|
||||
@ -21,6 +21,9 @@ ms.topic: conceptual
|
||||
|
||||
## 100.90.70
|
||||
|
||||
> [!WARNING]
|
||||
> When upgrading the installed package from a product version earlier than 100.90.70, the update may fail on Red Hat-based and SLES distributions. This is because of a major change in a file path. A temporary solution is to remove the older package, and then install the newer one. This issue does not exist in newer versions.
|
||||
|
||||
- Antivirus [exclusions now support wildcards](linux-exclusions.md#supported-exclusion-types)
|
||||
- Added the ability to [troubleshoot performance issues](linux-support-perf.md) through the `mdatp` command-line tool
|
||||
- Improvements to make the package installation more robust
|
||||
|
||||
@ -59,6 +59,9 @@ You'll need to enable the live response capability in the [Advanced features set
|
||||
|
||||
>[!NOTE]
|
||||
>Only users with manage security or global admin roles can edit these settings.
|
||||
|
||||
- **Ensure that the machine has an Automation Remediation level assigned to it**<br>
|
||||
You'll need to enable, at least, the minimum Remdiation Level for a given Machine Group. Otherwise you won't be able to establish a Live Response session to a member of that group.
|
||||
|
||||
- **Enable live response unsigned script execution** (optional) <br>
|
||||
|
||||
|
||||
@ -19,20 +19,40 @@ ms.topic: conceptual
|
||||
|
||||
# Intune-based deployment for Microsoft Defender ATP for Mac
|
||||
|
||||
> [!NOTE]
|
||||
> This documentation explains the legacy method for deploying and configuring Microsoft Defender ATP on macOS devices. The native experience is now available in the MEM console. The release of the native UI in the MEM console provide admins with a much simpler way to configure and dfeploy the application and send it down to macOS devices.
|
||||
> This blog post explains the new features: https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-endpoint-manager-simplifies-deployment-of-microsoft/ba-p/1322995
|
||||
> To configure the app go here: https://docs.microsoft.com/mem/intune/protect/antivirus-microsoft-defender-settings-macos
|
||||
> To deploy the app go here: https://docs.microsoft.com/mem/intune/apps/apps-advanced-threat-protection-macos
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
|
||||
|
||||
This topic describes how to deploy Microsoft Defender ATP for Mac through Intune. A successful deployment requires the completion of all of the following steps:
|
||||
- [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
- [Client device setup](#client-device-setup)
|
||||
- [Create System Configuration profiles](#create-system-configuration-profiles)
|
||||
- [Publish application](#publish-application)
|
||||
|
||||
1. [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
1. [Client device setup](#client-device-setup)
|
||||
1. [Create System Configuration profiles](#create-system-configuration-profiles)
|
||||
1. [Publish application](#publish-application)
|
||||
|
||||
## Prerequisites and system requirements
|
||||
|
||||
Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version.
|
||||
|
||||
## Overview
|
||||
|
||||
The following table summarizes the steps you would need to take to deploy and manage Microsoft Defender ATP for Macs, via Intune. More detailed steps are available below.
|
||||
|
||||
| Step | Sample file names | BundleIdentifier |
|
||||
|-|-|-|
|
||||
| [Download installation and onboarding packages](#download-installation-and-onboarding-packages) | WindowsDefenderATPOnboarding__MDATP_wdav.atp.xml | com.microsoft.wdav.atp |
|
||||
| [Approve Kernel Extension for Microsoft Defender ATP](#download-installation-and-onboarding-packages) | MDATP_KExt.xml | N/A |
|
||||
| [Grant full disk access to Microsoft Defender ATP](#create-system-configuration-profiles-step-8) | MDATP_tcc_Catalina_or_newer.xml | com.microsoft.wdav.tcc |
|
||||
| [Configure Microsoft AutoUpdate (MAU)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates#intune) | MDATP_Microsoft_AutoUpdate.xml | com.microsoft.autoupdate2 |
|
||||
| [Microsoft Defender ATP configuration settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#intune-profile-1)<br/><br/> **Note:** If you are planning to run a 3rd party AV for macOS, set `passiveMode` to `true`. | MDATP_WDAV_and_exclusion_settings_Preferences.xml | com.microsoft.wdav |
|
||||
| [Configure Microsoft Defender ATP and MS AutoUpdate (MAU) notifications](#create-system-configuration-profiles-step-9) | MDATP_MDAV_Tray_and_AutoUpdate2.mobileconfig | com.microsoft.autoupdate2 or com.microsoft.wdavtray |
|
||||
|
||||
## Download installation and onboarding packages
|
||||
|
||||
Download the installation and onboarding packages from Microsoft Defender Security Center:
|
||||
@ -86,23 +106,23 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
||||
|
||||
## Client device setup
|
||||
|
||||
You need no special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/intune-user-help/enroll-your-device-in-intune-macos-cp).
|
||||
You do not need any special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/intune-user-help/enroll-your-device-in-intune-macos-cp).
|
||||
|
||||
1. You are asked to confirm device management.
|
||||
1. Confirm device management.
|
||||
|
||||
|
||||
|
||||
|
||||
Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**:
|
||||
Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**:
|
||||
|
||||
|
||||
|
||||
|
||||
2. Select **Continue** and complete the enrollment.
|
||||
|
||||
You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.
|
||||
You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages.
|
||||
|
||||
3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed:
|
||||
|
||||
|
||||
|
||||
|
||||
## Create System Configuration profiles
|
||||
|
||||
@ -116,7 +136,7 @@ You need no special provisioning for a Mac device beyond a standard [Company Por
|
||||
5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
6. Repeat steps 1 through 5 for more profiles.
|
||||
7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file.
|
||||
8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it.
|
||||
8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it.<a name="create-system-configuration-profiles-step-8" id = "create-system-configuration-profiles-step-8"></a>
|
||||
|
||||
> [!CAUTION]
|
||||
> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device.
|
||||
@ -187,7 +207,7 @@ You need no special provisioning for a Mac device beyond a standard [Company Por
|
||||
</plist>
|
||||
```
|
||||
|
||||
9. To whitelist Defender and Auto Update for displaying notifications in UI on macOS 10.15 (Catalina), import the following .mobileconfig as a custom payload:
|
||||
9. To whitelist Defender and Auto Update for displaying notifications in UI on macOS 10.15 (Catalina), import the following .mobileconfig as a custom payload: <a name = "create-system-configuration-profiles-step-9" id = "create-system-configuration-profiles-step-9"></a>
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
@ -284,9 +304,9 @@ You need no special provisioning for a Mac device beyond a standard [Company Por
|
||||
|
||||
10. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
|
||||
|
||||
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
|
||||
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
|
||||
|
||||
|
||||
|
||||
|
||||
## Publish application
|
||||
|
||||
@ -294,11 +314,13 @@ You need no special provisioning for a Mac device beyond a standard [Company Por
|
||||
2. Select **App type=Other/Line-of-business app**.
|
||||
3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload.
|
||||
4. Select **Configure** and add the required information.
|
||||
5. Use **macOS High Sierra 10.13** as the minimum OS.
|
||||
5. Use **macOS High Sierra 10.13** as the minimum OS.
|
||||
6. Set *Ignore app version* to **Yes**. Other settings can be any arbitrary value.
|
||||
|
||||
> [!CAUTION]
|
||||
> Setting *Ignore app version* to **No** impacts the ability of the application to receive updates through Microsoft AutoUpdate. If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Defender. This could result in a non-functioning application. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. If you deployed Defender with *Ignore app version* set to **No**, please change it to **Yes**. If Defender still cannot be installed on a client machine, then uninstall Defender and push the updated policy.
|
||||
> Setting *Ignore app version* to **No** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated.
|
||||
>
|
||||
> If the version uploaded by Intune is lower than the version on the device, then the lower version will be installed, effectively downgrading Defender. This could result in a non-functioning application. See [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md) for additional information about how the product is updated. If you deployed Defender with *Ignore app version* set to **No**, please change it to **Yes**. If Defender still cannot be installed on a client machine, then uninstall Defender and push the updated policy.
|
||||
|
||||
|
||||
|
||||
@ -311,7 +333,7 @@ You need no special provisioning for a Mac device beyond a standard [Company Por
|
||||
|
||||
|
||||
9. Change **Assignment type** to **Required**.
|
||||
10. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
||||
10. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Select **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**.
|
||||
|
||||
|
||||
|
||||
@ -341,7 +363,7 @@ Solution: Follow the steps above to create a device profile using WindowsDefende
|
||||
|
||||
## Logging installation issues
|
||||
|
||||
For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](mac-resources.md#logging-installation-issues) .
|
||||
For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](mac-resources.md#logging-installation-issues).
|
||||
|
||||
## Uninstallation
|
||||
|
||||
|
||||
@ -15,7 +15,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/03/2020
|
||||
ms.date: 04/10/2020
|
||||
---
|
||||
|
||||
# JAMF-based deployment for Microsoft Defender ATP for Mac
|
||||
@ -25,11 +25,12 @@ ms.date: 04/03/2020
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
|
||||
|
||||
This topic describes how to deploy Microsoft Defender ATP for Mac through JAMF. A successful deployment requires the completion of all of the following steps:
|
||||
- [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
- [Create JAMF policies](#create-jamf-policies)
|
||||
- [Client device setup](#client-device-setup)
|
||||
- [Deployment](#deployment)
|
||||
- [Check onboarding status](#check-onboarding-status)
|
||||
|
||||
1. [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
1. [Create JAMF policies](#create-jamf-policies)
|
||||
1. [Client device setup](#client-device-setup)
|
||||
1. [Deployment](#deployment)
|
||||
1. [Check onboarding status](#check-onboarding-status)
|
||||
|
||||
## Prerequisites and system requirements
|
||||
|
||||
@ -37,6 +38,19 @@ Before you get started, please see [the main Microsoft Defender ATP for Mac page
|
||||
|
||||
In addition, for JAMF deployment, you need to be familiar with JAMF administration tasks, have a JAMF tenant, and know how to deploy packages. This includes having a properly configured distribution point. JAMF has many ways to complete the same task. These instructions provide an example for most common processes. Your organization might use a different workflow.
|
||||
|
||||
## Overview
|
||||
|
||||
The following table summarizes the steps you would need to take to deploy and manage Microsoft Defender ATP for Macs, via JAMF. More detailed steps are available below.
|
||||
|
||||
| Step | Sample file names | BundleIdentifier |
|
||||
|-|-|-|
|
||||
| [Download installation and onboarding packages](#download-installation-and-onboarding-packages) | WindowsDefenderATPOnboarding__MDATP_wdav.atp.xml | com.microsoft.wdav.atp |
|
||||
| [Microsoft Defender ATP configuration settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences#property-list-for-jamf-configuration-profile-1)<br/><br/> **Note:** If you are planning to run a 3rd party AV for macOS, set `passiveMode` to `true`. | MDATP_WDAV_and_exclusion_settings_Preferences.plist | com.microsoft.wdav |
|
||||
| [Configure Microsoft Defender ATP and MS AutoUpdate (MAU) notifications](#notification-settings) | MDATP_MDAV_Tray_and_AutoUpdate2.mobileconfig | com.microsoft.wdavtray |
|
||||
| [Configure Microsoft AutoUpdate (MAU)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates#jamf) | MDATP_Microsoft_AutoUpdate.mobileconfig | com.microsoft.autoupdate2 |
|
||||
| [Grant Full Disk Access to Microsoft Defender ATP](#privacy-preferences-policy-control) | Note: If there was one, MDATP_tcc_Catalina_or_newer.plist | com.microsoft.wdav.tcc |
|
||||
| [Approve Kernel Extension for Microsoft Defender ATP](#approved-kernel-extension) | Note: If there was one, MDATP_KExt.plist | N/A |
|
||||
|
||||
## Download installation and onboarding packages
|
||||
|
||||
Download the installation and onboarding packages from Microsoft Defender Security Center:
|
||||
@ -44,16 +58,16 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
||||
1. In Microsoft Defender Security Center, go to **Settings > Machine management > Onboarding**.
|
||||
2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android**.
|
||||
3. Set the deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
>[!NOTE]
|
||||
>Jamf falls under **Mobile Device Management**.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Jamf falls under **Mobile Device Management**.
|
||||
|
||||
4. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
|
||||
5. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
||||
|
||||
|
||||
|
||||
5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so:
|
||||
6. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so:
|
||||
|
||||
```bash
|
||||
$ ls -l
|
||||
@ -81,6 +95,7 @@ The configuration profile contains a custom settings payload that includes the f
|
||||
|
||||
To set the onboarding information, add a property list file that is named **jamf/WindowsDefenderATPOnboarding.plist** as a custom setting. To do this, select **Computers** > **Configuration Profiles** > **New**, and then select **Application & Custom Settings** > **Configure**. From there, you can upload the property list.
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
> You have to set the **Preference Domain** to **com.microsoft.wdav.atp**. There are some changes to the Custom Payloads and also to the Jamf Pro user interface in version 10.18 and later versions. For more information about the changes, see [Configuration Profile Payload Settings Specific to Jamf Pro](https://www.jamf.com/jamf-nation/articles/217/configuration-profile-payload-settings-specific-to-jamf-pro).
|
||||
|
||||
@ -231,6 +246,7 @@ $ mdatp --health healthy
|
||||
The above command prints "1" if the product is onboarded and functioning as expected.
|
||||
|
||||
If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem:
|
||||
|
||||
- 0 if the device is not yet onboarded
|
||||
- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running
|
||||
|
||||
|
||||
@ -310,17 +310,6 @@ Manage the preferences of the endpoint detection and response (EDR) component of
|
||||
| **Data type** | Dictionary (nested preference) |
|
||||
| **Comments** | See the following sections for a description of the dictionary contents. |
|
||||
|
||||
#### Enable / disable early preview
|
||||
|
||||
Specify whether to enable EDR early preview features.
|
||||
|
||||
|||
|
||||
|:---|:---|
|
||||
| **Domain** | `com.microsoft.wdav` |
|
||||
| **Key** | earlyPreview |
|
||||
| **Data type** | Boolean |
|
||||
| **Possible values** | true (default) <br/> false |
|
||||
|
||||
#### Device tags
|
||||
|
||||
Specify a tag name and its value.
|
||||
|
||||
@ -71,12 +71,13 @@ Filter by the following machine health states:
|
||||
|
||||
For more information on how to address issues on misconfigured machines see, [Fix unhealthy sensors](fix-unhealthy-sensors.md).
|
||||
|
||||
### Security state
|
||||
### Antivirus status
|
||||
|
||||
Filter by machines that are well configured or require attention based on the security controls that are enabled in your organization. Applies to active Windows 10 machines only.
|
||||
Filter machines by antivirus status. Applies to active Windows 10 machines only.
|
||||
|
||||
- **Well configured** - Machines have the security controls well configured.
|
||||
- **Requires attention** - Machines where improvements can be made to increase the overall security posture of your organization.
|
||||
- **Disabled** - Virus & threat protection is turned off.
|
||||
- **Not reporting** - Virus & threat protection is not reporting.
|
||||
- **Not updated** - Virus & threat protection is not up to date.
|
||||
|
||||
For more information, see [View the Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md).
|
||||
|
||||
|
||||
@ -21,39 +21,39 @@ ms.topic: conceptual
|
||||
|
||||
## Remediation actions
|
||||
|
||||
When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *Clean*. Depending on the type of threat and resulting verdict, remediation actions occur automatically or upon approval by your organization’s security operations team. For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed.
|
||||
When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat and resulting verdict, remediation actions occur automatically or upon approval by your organization’s security operations team. For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed.
|
||||
|
||||
When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defender Advanced Threat Protection takes one of the following remediation actions automatically:
|
||||
- Quarantine file
|
||||
- Remove registry key
|
||||
- Kill process
|
||||
- Stop service
|
||||
- Remove registry key
|
||||
- Disable driver
|
||||
- Remove scheduled task
|
||||
- Quarantine a file
|
||||
- Remove a registry key
|
||||
- Kill a process
|
||||
- Stop a service
|
||||
- Remove a registry key
|
||||
- Disable a driver
|
||||
- Remove a scheduled task
|
||||
|
||||
Evidence determined as *Suspicious* results in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible. This helps your automated investigations complete in a timely manner.
|
||||
Evidence determined as *Suspicious* results in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible so that you automated investigations complete in a timely manner.
|
||||
|
||||
No actions are taken when evidence is determined to be *Clean*.
|
||||
No actions are taken when a verdict of *No threats found* is reached for a piece of evidence.
|
||||
|
||||
In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions).
|
||||
|
||||
## Review pending actions
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. This takes you to your Security dashboard.
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the Security dashboard.
|
||||
|
||||
2. On the Security dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**.
|
||||
|
||||
3. Review any items on the **Pending** tab.
|
||||
|
||||
Selecting an investigation from any of the categories opens a panel where you can approve or reject the remediation. Other details such as file or service details, investigation details, and alert details are displayed. From the panel, you can click on the **Open investigation page** link to see the investigation details.
|
||||
Select an investigation from any of the categories to open a panel where you can approve or reject remediation actions. Other details such as file or service details, investigation details, and alert details are displayed. From the panel, you can click on the **Open investigation page** link to see the investigation details.
|
||||
|
||||
You can also select multiple investigations to approve or reject actions on multiple investigations.
|
||||
|
||||
|
||||
## Review completed actions
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. This takes you to your Security dashboard.
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the Security dashboard.
|
||||
|
||||
2. On the Security dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**.
|
||||
|
||||
@ -61,6 +61,12 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and
|
||||
|
||||
4. Select an item to view more details about that remediation action.
|
||||
|
||||
## Next steps
|
||||
|
||||
- [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center)
|
||||
|
||||
- [Get an overview of live response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/live-response)
|
||||
|
||||
## Related articles
|
||||
|
||||
- [Automated investigation and response in Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
---
|
||||
title: Manage indicators
|
||||
ms.reviewer:
|
||||
description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities.
|
||||
description: Create indicators for a file hash, IP address, URLs, or domains that define the detection, prevention, and exclusion of entities.
|
||||
keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -26,7 +26,7 @@ ms.topic: article
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink)
|
||||
|
||||
Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response).
|
||||
Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response).
|
||||
|
||||
Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to.
|
||||
|
||||
@ -54,7 +54,7 @@ You can create an indicator for:
|
||||
- URLs/domains
|
||||
|
||||
>[!NOTE]
|
||||
>There is a limit of 5000 indicators per tenant.
|
||||
>There is a limit of 15,000 indicators per tenant.
|
||||
|
||||
|
||||
|
||||
@ -69,6 +69,7 @@ There are two ways you can create indicators for files:
|
||||
|
||||
### Before you begin
|
||||
It's important to understand the following prerequisites prior to creating indicators for files:
|
||||
|
||||
- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
||||
- The Antimalware client version must be 4.18.1901.x or later.
|
||||
- Supported on machines on Windows 10, version 1703 or later.
|
||||
@ -103,18 +104,18 @@ One of the options when taking [response actions on a file](respond-file-alerts.
|
||||
|
||||
When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it.
|
||||
|
||||
Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue.
|
||||
Files automatically blocked by an indicator won't show up in the file's Action center, but the alerts will still be visible in the Alerts queue.
|
||||
|
||||
## Create indicators for IPs and URLs/domains (preview)
|
||||
## Create indicators for IPs and URLs/domains
|
||||
Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs, through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser.
|
||||
|
||||
The threat intelligence data set for this has been managed by Microsoft.
|
||||
|
||||
By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others.
|
||||
By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others.
|
||||
|
||||
### Before you begin
|
||||
It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains:
|
||||
- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md).
|
||||
It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains:
|
||||
- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Enable network protection](enable-network-protection.md).
|
||||
- The Antimalware client version must be 4.18.1906.x or later.
|
||||
- Supported on machines on Windows 10, version 1709 or later.
|
||||
- Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md).
|
||||
@ -132,7 +133,7 @@ It's important to understand the following prerequisites prior to creating indic
|
||||
>[!NOTE]
|
||||
>There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked.
|
||||
|
||||
### Create an indicator for IPs, URLs or domains from the settings page
|
||||
### Create an indicator for IPs, URLs, or domains from the settings page
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Indicators**.
|
||||
|
||||
@ -147,6 +148,46 @@ It's important to understand the following prerequisites prior to creating indic
|
||||
|
||||
5. Review the details in the Summary tab, then click **Save**.
|
||||
|
||||
## Create indicators for certificates (preview)
|
||||
|
||||
You can create indicators for certificates. Some common use cases include:
|
||||
|
||||
- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) and [controlled folder access](controlled-folders.md) but need to allow behaviors from signed applications by adding the certificate in the allow list.
|
||||
- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same.
|
||||
|
||||
|
||||
### Before you begin
|
||||
|
||||
It's important to understand the following requirements prior to creating indicators for certificates:
|
||||
|
||||
- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md).
|
||||
- The Antimalware client version must be 4.18.1901.x or later.
|
||||
- Supported on machines on Windows 10, version 1703 or later.
|
||||
- The virus and threat protection definitions must be up-to-date.
|
||||
- This feature currently supports entering .CER or .PEM file extensions.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it’s trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities').
|
||||
>- The children or parent of the allow/block certificate IOCs are not included in the allow/block IoC functionality – only leaf certificates are supported.
|
||||
>- Microsoft signed certificates cannot be blocked.
|
||||
|
||||
#### Create an indicator for certificates from the settings page:
|
||||
|
||||
>[!IMPORTANT]
|
||||
> It can take up to 3 hours to create and remove a certificate IoC.
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Indicators**.
|
||||
|
||||
2. Select the **Certificate** tab.
|
||||
|
||||
3. Select **Add indicator**.
|
||||
|
||||
4. Specify the following details:
|
||||
- Indicator - Specify the entity details and define the expiration of the indicator.
|
||||
- Action - Specify the action to be taken and provide a description.
|
||||
- Scope - Define the scope of the machine group.
|
||||
|
||||
5. Review the details in the Summary tab, then click **Save**.
|
||||
|
||||
|
||||
## Manage indicators
|
||||
@ -163,8 +204,33 @@ You can also choose to upload a CSV file that defines the attributes of indicato
|
||||
|
||||
Download the sample CSV to know the supported column attributes.
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Indicators**.
|
||||
|
||||
2. Select the tab of the entity type you'd like to import indicators for.
|
||||
|
||||
3. Select **Import** > **Choose file**.
|
||||
|
||||
4. Select **Import**. Do this for all the files you'd like to import.
|
||||
|
||||
5. Select **Done**.
|
||||
|
||||
The following table shows the supported parameters.
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
indicatorType | Enum | Type of the indicator. Possible values are: "FileSha1", "FileSha256", "IpAddress", "DomainName" and "Url". **Required**
|
||||
indicatorValue | String | Identity of the [Indicator](ti-indicator.md) entity. **Required**
|
||||
action | Enum | The action that will be taken if the indicator will be discovered in the organization. Possible values are: "Alert", "AlertAndBlock", and "Allowed". **Required**
|
||||
title | String | Indicator alert title. **Required**
|
||||
description | String | Description of the indicator. **Required**
|
||||
expirationTime | DateTimeOffset | The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. **Optional**
|
||||
severity | Enum | The severity of the indicator. Possible values are: "Informational", "Low", "Medium" and "High". **Optional**
|
||||
recommendedActions | String | TI indicator alert recommended actions. **Optional**
|
||||
rbacGroupNames | String | Comma-separated list of RBAC group names the indicator would be applied to. **Optional**
|
||||
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file)
|
||||
- [Use the Microsoft Defender ATP indicators API](ti-indicator.md)
|
||||
- [Use partner integrated solutions](partner-applications.md)
|
||||
|
||||
|
||||
@ -85,6 +85,9 @@ If you experience any installation failures, refer to [Troubleshooting installat
|
||||
|
||||
- Minimum kernel version 2.6.38
|
||||
- The `fanotify` kernel option must be enabled
|
||||
> [!CAUTION]
|
||||
> Running Microsoft Defender ATP for Linux side by side with other `fanotify`-based security solutions is not supported. It can lead to unpredictable results, including hanging the operating system.
|
||||
|
||||
- Disk space: 650 MB
|
||||
- The solution currently provides real-time protection for the following file system types:
|
||||
|
||||
@ -111,7 +114,7 @@ The following table lists the services and their associated URLs that your netwo
|
||||
| United States | unitedstates.x.cp.wd.microsoft.com <br/> us-v20.events.data.microsoft.com <br/> ussus1eastprod.blob.core.windows.net <br/> ussus1westprod.blob.core.windows.net |
|
||||
|
||||
> [!NOTE]
|
||||
> For a more specific URL list, see [Configure proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server)
|
||||
> For a more specific URL list, see [Configure proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
Microsoft Defender ATP can discover a proxy server by using the following discovery methods:
|
||||
- Transparent proxy
|
||||
@ -119,7 +122,12 @@ Microsoft Defender ATP can discover a proxy server by using the following discov
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. For transparent proxies, no additional configuration is needed for Microsoft Defender ATP. For static proxy, follow the steps in [Manual Static Proxy Configuration](linux-static-proxy-configuration.md).
|
||||
|
||||
For troubleshooting steps, see the [Troubleshoot cloud connectivity issues for Microsoft Defender ATP for Linux](linux-support-connectivity.md) page.
|
||||
> [!WARNING]
|
||||
> PAC, WPAD, and authenticated proxies are not supported. Ensure that only a static proxy or transparent proxy is being used.
|
||||
>
|
||||
> SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Microsoft Defender ATP for Linux to the relevant URLs without interception. Adding your interception certificate to the global store will not allow for interception.
|
||||
|
||||
For troubleshooting steps, see [Troubleshoot cloud connectivity issues for Microsoft Defender ATP for Linux](linux-support-connectivity.md).
|
||||
|
||||
## How to update Microsoft Defender ATP for Linux
|
||||
|
||||
@ -131,4 +139,4 @@ Guidance for how to configure the product in enterprise environments is availabl
|
||||
|
||||
## Resources
|
||||
|
||||
- For more information about logging, uninstalling, or other topics, see the [Resources](linux-resources.md) page.
|
||||
- For more information about logging, uninstalling, or other topics, see [Resources](linux-resources.md).
|
||||
|
||||
@ -74,16 +74,22 @@ The following table lists the services and their associated URLs that your netwo
|
||||
| Service location | DNS record |
|
||||
| ---------------------------------------- | ----------------------- |
|
||||
| Common URLs for all locations | x.cp.wd.microsoft.com <br/> cdn.x.cp.wd.microsoft.com <br/> eu-cdn.x.cp.wd.microsoft.com <br/> wu-cdn.x.cp.wd.microsoft.com <br/> officecdn-microsoft-com.akamaized.net <br/> crl.microsoft.com <br/> events.data.microsoft.com |
|
||||
| European Union | europe.x.cp.wd.microsoft.com <br/> eu-v20.events.data.microsoft.com <br/> usseu1northprod.blob.core.windows.net <br/> usseu1westprod.blob.core.windows.net |
|
||||
| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com <br/> uk-v20.events.data.microsoft.com <br/> ussuk1southprod.blob.core.windows.net <br/> ussuk1westprod.blob.core.windows.net |
|
||||
| United States | unitedstates.x.cp.wd.microsoft.com <br/> us-v20.events.data.microsoft.com <br/> ussus1eastprod.blob.core.windows.net <br/> ussus1westprod.blob.core.windows.net |
|
||||
| European Union | europe.x.cp.wd.microsoft.com <br/> eu-v20.events.data.microsoft.com <br/> usseu1northprod.blob.core.windows.net <br/> usseu1westprod.blob.core.windows.net <br/> winatp-gw-weu.microsoft.com <br/> winatp-gw-neu.microsoft.com |
|
||||
| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com <br/> uk-v20.events.data.microsoft.com <br/> ussuk1southprod.blob.core.windows.net <br/> ussuk1westprod.blob.core.windows.net <br/> winatp-gw-ukw.microsoft.com <br/> winatp-gw-uks.microsoft.com |
|
||||
| United States | unitedstates.x.cp.wd.microsoft.com <br/> us-v20.events.data.microsoft.com <br/> ussus1eastprod.blob.core.windows.net <br/> ussus1westprod.blob.core.windows.net <br/> winatp-gw-cus.microsoft.com <br/> winatp-gw-eus.microsoft.com |
|
||||
|
||||
Microsoft Defender ATP can discover a proxy server by using the following discovery methods:
|
||||
- Proxy auto-config (PAC)
|
||||
- Web Proxy Auto-discovery Protocol (WPAD)
|
||||
- Manual static proxy configuration
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs.
|
||||
|
||||
> [!WARNING]
|
||||
> Authenticated proxies are not supported. Ensure that only PAC, WPAD, or a static proxy is being used.
|
||||
>
|
||||
> SSL inspection and intercepting proxies are also not supported for security reasons. Configure an exception for SSL inspection and your proxy server to directly pass through data from Microsoft Defender ATP for Mac to the relevant URLs without interception. Adding your interception certificate to the global store will not allow for interception.
|
||||
|
||||
To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) and [https://cdn.x.cp.wd.microsoft.com/ping](https://cdn.x.cp.wd.microsoft.com/ping) in a browser.
|
||||
|
||||
If you prefer the command line, you can also check the connection by running the following command in Terminal:
|
||||
|
||||
@ -13,7 +13,7 @@ author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
@ -24,12 +24,12 @@ ms.topic: conceptual
|
||||
|
||||
There are some minimum requirements for onboarding machines to the service. Learn about the licensing, hardware and software requirements, and other configuration settings to onboard devices to the service.
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-minreqs-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-minreqs-abovefoldlink).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
>- Learn about the latest enhancements in Microsoft Defender ATP:[Microsoft Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced).
|
||||
>- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
> [!TIP]
|
||||
> - Learn about the latest enhancements in Microsoft Defender ATP:[Microsoft Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced).
|
||||
> - Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
|
||||
## Licensing requirements
|
||||
Microsoft Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
|
||||
@ -40,7 +40,7 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr
|
||||
- Microsoft 365 E5 Security
|
||||
- Microsoft 365 A5 (M365 A5)
|
||||
|
||||
For detailed licensing information, see the [Product terms page](https://www.microsoft.com/en-us/licensing/product-licensing/products) and work with your account team to learn the detailed terms and conditions for the product.
|
||||
For detailed licensing information, see the [Product terms page](https://www.microsoft.com/licensing/product-licensing/products) and work with your account team to learn the detailed terms and conditions for the product.
|
||||
|
||||
For more information on the array of features in Windows 10 editions, see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare).
|
||||
|
||||
@ -53,13 +53,14 @@ For more information about licensing requirements for Microsoft Defender ATP pla
|
||||
Access to Microsoft Defender ATP is done through a browser, supporting the following browsers:
|
||||
- Microsoft Edge
|
||||
- Internet Explorer version 11
|
||||
- Google Chrome
|
||||
- Google Chrome
|
||||
|
||||
>[!NOTE]
|
||||
>While other browsers might work, the mentioned browsers are the ones supported.
|
||||
> [!NOTE]
|
||||
> While other browsers might work, the mentioned browsers are the ones supported.
|
||||
|
||||
|
||||
## Hardware and software requirements
|
||||
|
||||
### Supported Windows versions
|
||||
- Windows 7 SP1 Enterprise
|
||||
- Windows 7 SP1 Pro
|
||||
@ -67,6 +68,7 @@ Access to Microsoft Defender ATP is done through a browser, supporting the follo
|
||||
- Windows 8.1 Pro
|
||||
- Windows 10, version 1607 or later
|
||||
- Windows 10 Enterprise
|
||||
- [Windows 10 Enterprise LTSC](https://docs.microsoft.com/windows/whats-new/ltsc/)
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
@ -82,24 +84,25 @@ Machines on your network must be running one of these editions.
|
||||
The hardware requirements for Microsoft Defender ATP on machines is the same as those for the supported editions.
|
||||
|
||||
> [!NOTE]
|
||||
> Machines that are running mobile versions of Windows are not supported.
|
||||
> Machines running mobile versions of Windows are not supported.
|
||||
|
||||
|
||||
### Other supported operating systems
|
||||
- macOSX
|
||||
- Linux
|
||||
- Android
|
||||
- macOSX
|
||||
- Linux (currently, Microsoft Defender ATP is only available in the Public Preview Edition for Linux)
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to know the exact Linux distros, Android, and macOS versions that are compatible with Microsoft Defender ATP for the integration to work.
|
||||
> [!NOTE]
|
||||
> You'll need to know the exact Linux distros, Android, and macOS versions that are compatible with Microsoft Defender ATP for the integration to work.
|
||||
>
|
||||
> Also note that Microsoft Defender ATP is currently only available in the Public Preview Edition for Linux.
|
||||
|
||||
|
||||
### Network and data storage and configuration requirements
|
||||
When you run the onboarding wizard for the first time, you must choose where your Microsoft Defender Advanced Threat Protection-related information is stored: in the European Union, the United Kingdom, or the United States datacenter.
|
||||
|
||||
> [!NOTE]
|
||||
> - You cannot change your data storage location after the first-time setup.
|
||||
> - Review the [Microsoft Defender ATP data storage and privacy](data-storage-privacy.md) for more information on where and how Microsoft stores your data.
|
||||
> - You cannot change your data storage location after the first-time setup.
|
||||
> - Review the [Microsoft Defender ATP data storage and privacy](data-storage-privacy.md) for more information on where and how Microsoft stores your data.
|
||||
|
||||
|
||||
### Diagnostic data settings
|
||||
@ -131,12 +134,11 @@ By default, this service is enabled, but it's good practice to check to ensu
|
||||
If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start.
|
||||
|
||||
|
||||
|
||||
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
|
||||
|
||||
1. Open an elevated command-line prompt on the endpoint:
|
||||
|
||||
a. Go to **Start** and type **cmd**.
|
||||
a. Go to **Start** and type **cmd**.
|
||||
|
||||
b. Right-click **Command prompt** and select **Run as administrator**.
|
||||
|
||||
@ -153,22 +155,18 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the
|
||||
```
|
||||
|
||||
|
||||
|
||||
#### Internet connectivity
|
||||
Internet connectivity on machines is required either directly or through proxy.
|
||||
|
||||
The Microsoft Defender ATP sensor can utilize a daily average bandwidth of 5MB to communicate with the Microsoft Defender ATP cloud service and report cyber data. One-off activities such as file uploads and investigation package collection are not included in this daily average bandwidth.
|
||||
|
||||
For more information on additional proxy configuration settings see, [Configure machine proxy and Internet connectivity settings](configure-proxy-internet.md) .
|
||||
For more information on additional proxy configuration settings, see [Configure machine proxy and Internet connectivity settings](configure-proxy-internet.md).
|
||||
|
||||
Before you onboard machines, the diagnostic data service must be enabled. The service is enabled by default in Windows 10.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Windows Defender Antivirus configuration requirement
|
||||
The Microsoft Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them.
|
||||
The Microsoft Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them.
|
||||
|
||||
You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
|
||||
|
||||
@ -177,7 +175,7 @@ When Windows Defender Antivirus is not the active antimalware in your organizati
|
||||
If you are onboarding servers and Windows Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Windows Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Onboard servers](configure-server-endpoints.md).
|
||||
|
||||
> [!NOTE]
|
||||
> Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.
|
||||
> Your regular group policy doesn't apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.
|
||||
|
||||
|
||||
For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
||||
@ -188,9 +186,6 @@ If you're running Windows Defender Antivirus as the primary antimalware product
|
||||
If you're running a third-party antimalware client and use Mobile Device Management solutions or Microsoft Endpoint Configuration Manager (current branch), you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topic
|
||||
## Related topics
|
||||
- [Validate licensing and complete setup](licensing.md)
|
||||
- [Onboard machines](onboard-configure.md)
|
||||
|
||||
@ -27,7 +27,7 @@ ms.custom: asr
|
||||
|
||||
Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
|
||||
Network protection expands the scope of [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md) to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname).
|
||||
Network protection expands the scope of [Microsoft Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname).
|
||||
|
||||
Network protection is supported beginning with Windows 10, version 1709.
|
||||
|
||||
|
||||
@ -66,7 +66,7 @@ Threat & Vulnerability Management helps customers prioritize and focus on those
|
||||
|
||||
Microsoft Defender ATP's Threat & Vulnerability Management allows security administrators and IT administrators to collaborate seamlessly to remediate issues.
|
||||
|
||||
- Remediation requests to IT. Through Microsoft Defender ATP's integration with Microsoft Intune and Microsoft Endpoint Configuration Manager, security administrators can create a remediation task in Microsoft Intune from the Security recommendation pages. We plan to expand this capability to other IT security management platforms.
|
||||
- Remediation requests to IT. Through Microsoft Defender ATP's integration with Microsoft Intune and Microsoft Endpoint Configuration Manager, security administrators can create a remediation task in Microsoft Intune from the Security recommendation pages. We plan to expand this capability to other IT security management platforms.
|
||||
- Alternate mitigations. Threat & Vulnerability Management provides insights on additional mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
|
||||
- Real-time remediation status. Microsoft Defender ATP provides real-time monitoring of the status and progress of remediation activities across the organization.
|
||||
|
||||
@ -84,10 +84,10 @@ Ensure that your machines:
|
||||
|
||||
> Release | Security update KB number and link
|
||||
> :---|:---
|
||||
> RS3 customers | [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441) and [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071)
|
||||
> RS4 customers| [KB4493464](https://support.microsoft.com/help/4493464) and [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045)
|
||||
> RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077)
|
||||
> 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941)
|
||||
> Windows 10 Version 1709 | [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441) and [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071)
|
||||
> Windows 10 Version 1803 | [KB4493464](https://support.microsoft.com/help/4493464) and [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045)
|
||||
> Windows 10 Version 1809 | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077)
|
||||
> Windows 10 Version 1903 | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941)
|
||||
|
||||
- Are onboarded to Microsoft Intune and Microsoft Endpoint Configuration Manager. If you are using Configuration Manager, update your console to the latest version.
|
||||
- Have at least one security recommendation that can be viewed in the machine page
|
||||
|
||||
@ -123,7 +123,7 @@ Manager and deploy that policy to Windows 10 devices.
|
||||
|
||||
|
||||
|
||||
3. Select **Download package**.
|
||||
3. Select **Download package**.
|
||||
|
||||
|
||||
|
||||
@ -184,11 +184,11 @@ Before the systems can be onboarded into the workspace, the deployment scripts n
|
||||
Edit the InstallMMA.cmd with a text editor, such as notepad and update the
|
||||
following lines and save the file:
|
||||
|
||||
|
||||
|
||||
|
||||
Edit the ConfiguerOMSAgent.vbs with a text editor, such as notepad, and update the following lines and save the file:
|
||||
|
||||
|
||||
|
||||
|
||||
Microsoft Monitoring Agent (MMA) is currently (as of January 2019) supported on the following Windows Operating
|
||||
Systems:
|
||||
|
||||
@ -22,25 +22,24 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
Enterprise security teams can use Microsoft Defender Security Center to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches.
|
||||
Enterprise security teams can use Microsoft Defender Security Center to monitor and assist in responding to alerts of potential advanced persistent threat activity or data breaches.
|
||||
|
||||
You can use [Microsoft Defender Security Center](https://securitycenter.windows.com/) to:
|
||||
|
||||
- View, sort, and triage alerts from your endpoints
|
||||
- Search for more information on observed indicators such as files and IP Addresses
|
||||
- Change Microsoft Defender ATP settings, including time zone and review licensing information.
|
||||
- Change Microsoft Defender ATP settings, including time zone and review licensing information
|
||||
|
||||
## Microsoft Defender Security Center
|
||||
When you open the portal, you’ll see the main areas of the application:
|
||||
|
||||
|
||||
When you open the portal, you'll see:
|
||||
|
||||
- (1) Navigation pane
|
||||
- (2) Main portal
|
||||
- (3) Search, Community center, Time settings, Help and support, Feedback
|
||||
- (1) Navigation pane (select the horizontal lines at the top of the navigation pane to show or hide it)
|
||||
- (2) Search, Community center, Localization, Help and support, Feedback
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Malware related detections will only appear if your machines are using Windows Defender Antivirus as the default real-time protection antimalware product.
|
||||
@ -49,27 +48,27 @@ You can navigate through the portal using the menu options available in all sect
|
||||
|
||||
Area | Description
|
||||
:---|:---
|
||||
**(1) Navigation pane** | Use the navigation pane to move between **Dashboards**, **Incidents**, **Machines list**, **Alerts queue**, **Automated investigations**, **Advanced hunting**, **Reports**, **Interoperability**, **Threat & vulnerability management**, **Evaluation and tutorials**, **Service health**, **Configuration management**, and **Settings**.
|
||||
**Dashboards** | Access the Security operations, the Secure Score, or Threat analytics dashboard.
|
||||
**(1) Navigation pane** | Use the navigation pane to move between **Dashboards**, **Incidents**, **Machines list**, **Alerts queue**, **Automated investigations**, **Advanced hunting**, **Reports**, **Partners & APIs**, **Threat & Vulnerability Management**, **Evaluation and tutorials**, **Service health**, **Configuration management**, and **Settings**. Select the horizontal lines at the top of the navigation pane to show or hide it.
|
||||
**Dashboards** | Access the active automated investigations, active alerts, automated investigations statistics, machines at risk, users at risk, machines with sensor issues, service health, detection sources, and daily machines reporting dashboards.
|
||||
**Incidents** | View alerts that have been aggregated as incidents.
|
||||
**Machines list** | Displays the list of machines that are onboarded to Microsoft Defender ATP, some information about them, and the corresponding number of alerts.
|
||||
**Machines list** | Displays the list of machines that are onboarded to Microsoft Defender ATP, some information about them, and their exposure and risk levels.
|
||||
**Alerts queue** | View alerts generated from machines in your organizations.
|
||||
**Automated investigations** | Displays a list of automated investigations that's been conducted in the network, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
|
||||
**Automated investigations** | Displays automated investigations that have been conducted in the network, triggering alert, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
|
||||
**Advanced hunting** | Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
|
||||
**Reports** | View graphs detailing alert trends over time, and alert summary charts categorizing threats by severity, status, and attack approach
|
||||
**Interoperability** | Lists supported partner applications that can work together with Microsoft Defender, as well as applications that are already connected to Microsoft Defender.
|
||||
**Reports** | View graphs detailing threat protection, machine health and compliance, web protection, and vulnerability.
|
||||
**Partners & APIs** | View supported partner connections, which enhance the detection, investigation, and threat intelligence capabilities of the platform. You can also view connected applications, the API explorer, API usage overview, and data export settings.
|
||||
**Threat & Vulnerability management** | View your configuration score, exposure score, exposed machines, vulnerable software, and take action on top security recommendations.
|
||||
**Evaluation and tutorials** | Manage test machines, attack simulations, and reports. Learn and experience the Microsoft Defender ATP capabilities through a guided walkthrough in a trial environment.
|
||||
**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
|
||||
**Configuration management** | Displays on-boarded machines, your organizations' security baseline, predictive analysis, and allows you to perform attack surface management on your machines.
|
||||
**Settings** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure Score dashboard.
|
||||
**(2) Main portal** | Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list.
|
||||
**(3) Community center, Localization, Help and support, Feedback** | **Community center** -Access the Community center to learn, collaborate, and share experiences about the product. </br></br> **Time settings** - Gives you access to the configuration settings where you can set time zones and view license information. </br></br> **Help and support** - Gives you access to the Microsoft Defender ATP guide, Microsoft support, and Premier support.</br></br> **Feedback** - Access the feedback button to provide comments about the portal.
|
||||
**Evaluation and tutorials** | Manage test machines, attack simulations, and reports. Learn and experience the Microsoft Defender ATP capabilities through a guided walk-through in a trial environment.
|
||||
**Service health** | Provides information on the current status of the Microsoft Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
|
||||
**Configuration management** | Displays on-boarded machines, your organizations' security baseline, predictive analysis, web protection coverage, and allows you to perform attack surface management on your machines.
|
||||
**Settings** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as permissions, APIs, rules, machine management, IT service management, and network assessments.
|
||||
**(2) Search, Community center, Localization, Help and support, Feedback** | **Search** - search by machine, file, user, URL, IP, vulnerability, software, and recommendation. </br></br> **Community center** - Access the Community center to learn, collaborate, and share experiences about the product. </br></br> **Localization** - Set time zones. </br></br> **Help and support** - Access the Microsoft Defender ATP guide, Microsoft and Microsoft Premier support, license information, simulations & tutorials, Microsoft Defender ATP evaluation lab, consult a threat expert.</br></br> **Feedback** - Provide comments about what you like or what we can do better.
|
||||
|
||||
> [!NOTE]
|
||||
> For devices with high resolution DPI scaling issues, please see [Windows scaling issues for high-DPI devices](https://support.microsoft.com/help/3025083/windows-scaling-issues-for-high-dpi-devices) for possible solutions.
|
||||
|
||||
## Microsoft Defender ATP icons
|
||||
|
||||
The following table provides information on the icons used all throughout the portal:
|
||||
|
||||
Icon | Description
|
||||
@ -105,22 +104,23 @@ Icon | Description
|
||||
| Memory allocation
|
||||
| Process injection
|
||||
| Powershell command run
|
||||
 | Community center
|
||||
 | Community center
|
||||
 | Notifications
|
||||
 | Automated investigation - no threats found
|
||||
 | Automated investigation - failed
|
||||
 | Automated investigation - partially investigated
|
||||
 | Automated investigation - terminated by system
|
||||
 | Automated investigation - terminated by system
|
||||
 | Automated investigation - pending
|
||||
 | Automated investigation - running
|
||||
 | Automated investigation - remediated
|
||||
 | Automated investigation - remediated
|
||||
 | Automated investigation - partially remediated
|
||||
 | Threat & Vulnerability Management - threat insights
|
||||
 | Threat & Vulnerability Management - possible active alert
|
||||
 | Threat & Vulnerability Management - possible active alert
|
||||
 | Threat & Vulnerability Management - recommendation insights
|
||||
|
||||
## Related topics
|
||||
- [Understand the Microsoft Defender Advanced Threat Protection portal](use.md)
|
||||
|
||||
- [Overview of Microsoft Defender Security Center](use.md)
|
||||
- [View the Security operations dashboard](security-operations-dashboard.md)
|
||||
- [View the Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
- [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics.md)
|
||||
|
||||
@ -71,6 +71,7 @@ description | String | Description of the indicator. **Required**
|
||||
expirationTime | DateTimeOffset | The expiration time of the indicator. **Optional**
|
||||
severity | Enum | The severity of the indicator. possible values are: "Informational", "Low", "Medium" and "High". **Optional**
|
||||
recommendedActions | String | TI indicator alert recommended actions. **Optional**
|
||||
rbacGroupNames | String | Comma-separated list of RBAC group names the indicator would be applied to. **Optional**
|
||||
|
||||
|
||||
## Response
|
||||
@ -87,16 +88,18 @@ Here is an example of the request.
|
||||
POST https://api.securitycenter.windows.com/api/indicators
|
||||
Content-type: application/json
|
||||
{
|
||||
"indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f",
|
||||
"indicatorType": "FileSha1",
|
||||
"title": "test",
|
||||
"application": "demo-test",
|
||||
"expirationTime": "2020-12-12T00:00:00Z",
|
||||
"action": "AlertAndBlock",
|
||||
"severity": "Informational",
|
||||
"description": "test",
|
||||
"recommendedActions": "nothing"
|
||||
"indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f",
|
||||
"indicatorType": "FileSha1",
|
||||
"title": "test",
|
||||
"application": "demo-test",
|
||||
"expirationTime": "2020-12-12T00:00:00Z",
|
||||
"action": "AlertAndBlock",
|
||||
"severity": "Informational",
|
||||
"description": "test",
|
||||
"recommendedActions": "nothing",
|
||||
"rbacGroupNames": ["group1", "group2"]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topic
|
||||
- [Manage indicators](manage-indicators.md)
|
||||
@ -170,12 +170,12 @@ how the endpoint security suite should be enabled.
|
||||
|
||||
| Component | Description | Adoption Order Rank |
|
||||
|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
|
||||
| Endpoint Detection & Response (EDR) | Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
||||
| Next Generation Protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers. Windows Defender Antivirus includes: | 2 |
|
||||
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP helps protect the devices and applications in the organization from new and emerging threats. [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 3 |
|
||||
| Threat & Vulnerability Management (TVM) | Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: | 4 |
|
||||
| Auto Investigation & Remediation (AIR) | Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) | Not applicable |
|
||||
| Microsoft Threat Experts (MTE) | Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don't get missed. [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts) | Not applicable |
|
||||
| Endpoint Detection & Response (EDR) | Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
||||
|Threat & Vulnerability Management (TVM)|Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: <br> - Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities <br> - Invaluable machine vulnerability context during incident investigations <br> - Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager <br> [Learn more](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Introducing-a-risk-based-approach-to-threat-and-vulnerability/ba-p/377845).| 2 |
|
||||
| Next Generation Protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers. Windows Defender Antivirus includes: <br> -Cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Windows Defender Antivirus. <br> - Always-on scanning using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection"). <br> - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research. <br> [Learn more](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). |3 |
|
||||
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP helps protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
||||
| Auto Investigation & Remediation (AIR) | Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) | Not applicable |
|
||||
| Microsoft Threat Experts (MTE) | Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don't get missed. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts) | Not applicable |
|
||||
|
||||
## Next step
|
||||
|||
|
||||
|
||||
@ -44,9 +44,9 @@ Turn on the preview experience setting to be among the first to try upcoming fea
|
||||
## Preview features
|
||||
|
||||
The following features are included in the preview release:
|
||||
- [Microsoft Defender ATP for Linux](microsoft-defender-atp-linux.md) <br> Microsoft Defender ATP now adds support for Linux. Learn how to install, configure, update, and use Microsoft Defender ATP for Linux.
|
||||
- [Create indicators for certificates](manage-indicators.md) <br> Create indicators to allow or block certificates.
|
||||
|
||||
- [Threat & Vulnerability Management API support](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list) <BR>Run Threat & Vulnerability Management-related API calls such as get your organization's threat exposure score or device secure score, software and machine vulnerability inventory, software version distribution, machine vulnerability information, security recommendation information.
|
||||
- [Microsoft Defender ATP for Linux](microsoft-defender-atp-linux.md) <br> Microsoft Defender ATP now adds support for Linux. Learn how to install, configure, update, and use Microsoft Defender ATP for Linux.
|
||||
|
||||
- [Threat & Vulnerability supported operating systems and platforms](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os) <BR> Ensure that you meet the operating system or platform requisites for Threat & Vulnerability Management so the activities in your devices are properly accounted for. Threat & Vulnerability Management supports Windows 7, Windows 10 1607-1703, Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, Windows Server 2019. <BR> <BR> Secure Configuration Assessment (SCA) supports Windows 10 1709+, Windows Server 2008R2, Windows Server 2012R2, Windows Server 2016, and Windows Server 2019. See [Secure Configuration Assessment (SCA) for Windows Server now in public preview](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/secure-configuration-assessment-sca-for-windows-server-now-in/ba-p/1243885) and [Reducing risk with new Threat & Vulnerability Management capabilities](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/reducing-risk-with-new-threat-amp-vulnerability-management/ba-p/978145) blogs for more information.
|
||||
|
||||
|
||||
@ -57,7 +57,7 @@ In this deployment scenario, you'll be guided through the steps on:
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>For the purpose of guiding you through a typical deployment, this scenario will only cover the use of Microsoft Endpoint Configuration Manager. Microsoft Defnder ATP supports the use of other onboarding tools but will not cover those scenarios in the deployment guide. For more information, see [Onboard machines to Microsoft Defender ATP](onboard-configure.md).
|
||||
>For the purpose of guiding you through a typical deployment, this scenario will only cover the use of Microsoft Endpoint Configuration Manager. Microsoft Defender ATP supports the use of other onboarding tools but will not cover those scenarios in the deployment guide. For more information, see [Onboard machines to Microsoft Defender ATP](onboard-configure.md).
|
||||
|
||||
## Check license state
|
||||
|
||||
|
||||
@ -175,7 +175,7 @@ Here is an example return value:
|
||||
|
||||
## Code examples
|
||||
### Get access token
|
||||
The following code example demonstrates how to obtain an access token and call the Microsoft Defender ATP API.
|
||||
The following code examples demonstrate how to obtain an access token for calling the Microsoft Defender ATP SIEM API.
|
||||
|
||||
```csharp
|
||||
AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));
|
||||
@ -183,19 +183,114 @@ ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret
|
||||
AuthenticationResult authenticationResult = context.AcquireTokenAsync(detectionsResource, clientCredentials).GetAwaiter().GetResult();
|
||||
```
|
||||
|
||||
### Use token to connect to the detections endpoint
|
||||
```PowerShell
|
||||
#Get current working directory
|
||||
$scriptDir = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent
|
||||
|
||||
#Paste below your Tenant ID, App ID and App Secret (App key).
|
||||
$tenantId = '' ### Paste your tenant ID here
|
||||
$appId = '' ### Paste your Application ID here
|
||||
$appSecret = '' ### Paste your Application secret here
|
||||
|
||||
$resourceAppIdUri = 'https://graph.windows.net'
|
||||
$oAuthUri = "https://login.windows.net/$tenantId/oauth2/token"
|
||||
$authBody = [Ordered] @{
|
||||
resource = "$resourceAppIdUri"
|
||||
client_id = "$appId"
|
||||
client_secret = "$appSecret"
|
||||
grant_type = 'client_credentials'
|
||||
}
|
||||
|
||||
#call API
|
||||
$authResponse = Invoke-RestMethod -Method Post -Uri $oAuthUri -Body $authBody -ErrorAction Stop
|
||||
$authResponse
|
||||
Out-File -FilePath "$scriptDir\LatestSIEM-token.txt" -InputObject $authResponse.access_token
|
||||
```
|
||||
|
||||
```Bash
|
||||
tenantId='' ### Paste your tenant ID here
|
||||
appId='' ### Paste your Application ID here
|
||||
appSecret='' ### Paste your Application secret here
|
||||
resourceAppIdUri='https://graph.windows.net'
|
||||
oAuthUri="https://login.windows.net/$tenantId/oauth2/token"
|
||||
scriptDir=$(pwd)
|
||||
|
||||
apiResponse=$(curl -s X POST "$oAuthUri" -d "resource=$resourceAppIdUri&client_id=$appId&client_secret=$appSecret&\
|
||||
grant_type=client_credentials" | cut -d "{" -f2 | cut -d "}" -f1)
|
||||
IFS=","
|
||||
apiResponseArr=($apiResponse)
|
||||
IFS=":"
|
||||
tokenArr=(${apiResponseArr[6]})
|
||||
echo ${tokenArr[1]} | cut -d "\"" -f2 | cut -d "\"" -f1 >> $scriptDir/LatestSIEM-token.txt
|
||||
```
|
||||
|
||||
### Use token to connect to the detections endpoint
|
||||
The following code examples demonstrate how to use an access token for calling the Microsoft Defender ATP SIEM API to get alerts.
|
||||
|
||||
```csharp
|
||||
HttpClient httpClient = new HttpClient();
|
||||
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(authenticationResult.AccessTokenType, authenticationResult.AccessToken);
|
||||
HttpResponseMessage response = httpClient.GetAsync("https://wdatp-alertexporter-eu.windows.com/api/alert").GetAwaiter().GetResult();
|
||||
string detectionsJson = response.Content.ReadAsStringAsync().Result;
|
||||
Console.WriteLine("Got detections list: {0}", detectionsJson);
|
||||
|
||||
```
|
||||
|
||||
```PowerShell
|
||||
#Get current working directory
|
||||
$scriptDir = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent
|
||||
|
||||
#run the script Get-Token.ps1 - make sure you are running this script from the same folder of Get-SIEMToken.ps1
|
||||
$token = Get-Content "$scriptDir\LatestSIEM-token.txt"
|
||||
|
||||
#Get Alert from the last xx hours 200 in this example. Make sure you have alerts in that time frame.
|
||||
$dateTime = (Get-Date).ToUniversalTime().AddHours(-200).ToString("o")
|
||||
|
||||
#test SIEM API
|
||||
$url = 'https://wdatp-alertexporter-us.windows.com/api/alerts?limit=20&sinceTimeUtc=2020-01-01T00:00:00.000'
|
||||
|
||||
#Set the WebRequest headers
|
||||
$headers = @{
|
||||
'Content-Type' = 'application/json'
|
||||
Accept = 'application/json'
|
||||
Authorization = "Bearer $token"
|
||||
}
|
||||
|
||||
#Send the webrequest and get the results.
|
||||
$response = Invoke-WebRequest -Method Get -Uri $url -Headers $headers -ErrorAction Stop
|
||||
$response
|
||||
Write-Host
|
||||
|
||||
#Extract the alerts from the results. This works for SIEM API:
|
||||
$alerts = $response.Content | ConvertFrom-Json | ConvertTo-Json
|
||||
|
||||
#Get string with the execution time. We concatenate that string to the output file to avoid overwrite the file
|
||||
$dateTimeForFileName = Get-Date -Format o | foreach {$_ -replace ":", "."}
|
||||
|
||||
#Save the result as json and as csv
|
||||
$outputJsonPath = "$scriptDir\Latest Alerts $dateTimeForFileName.json"
|
||||
$outputCsvPath = "$scriptDir\Latest Alerts $dateTimeForFileName.csv"
|
||||
|
||||
Out-File -FilePath $outputJsonPath -InputObject $alerts
|
||||
Get-Content -Path $outputJsonPath -Raw | ConvertFrom-Json | Select-Object -ExpandProperty value | Export-CSV $outputCsvPath -NoTypeInformation
|
||||
```
|
||||
|
||||
```Bash
|
||||
#Get current working directory
|
||||
scriptDir=$(pwd)
|
||||
|
||||
#get the token
|
||||
token=$(<$scriptDir/LatestSIEM-token.txt)
|
||||
|
||||
#test the SIEM API, get alerts since 1/1/2020
|
||||
url='https://wdatp-alertexporter-us.windows.com/api/alerts?limit=20&sinceTimeUtc=2020-01-01T00:00:00.000'
|
||||
|
||||
#send web requst to API and echo JSON content
|
||||
apiResponse=$(curl -s X GET "$url" -H "Content-Type: application/json" -H "Accept: application/json"\
|
||||
-H "Authorization: Bearer $token" | cut -d "[" -f2 | cut -d "]" -f1)
|
||||
echo "If you see Alert info in JSON format, congratulations you accessed the MDATP SIEM API!"
|
||||
echo
|
||||
echo $apiResponse
|
||||
```
|
||||
|
||||
## Error codes
|
||||
The Microsoft Defender ATP REST API returns the following error codes caused by an invalid request.
|
||||
|
||||
@ -29,8 +29,10 @@ ms.topic: article
|
||||
|
||||
## APIs
|
||||
|
||||
Threat and vulnerability management supports multiple APIs. See the following topics for related APIs:
|
||||
Run Threat & Vulnerability Management-related API calls such as get your organization's threat exposure score or device secure score, software and machine vulnerability inventory, software version distribution, machine vulnerability information, security recommendation information. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615).
|
||||
See the following topics for related APIs:
|
||||
|
||||
- [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Machine APIs](machine.md)
|
||||
- [Recommendation APIs](vulnerability.md)
|
||||
- [Score APIs](score.md)
|
||||
@ -97,15 +99,16 @@ After you have identified which software and software versions are vulnerable du
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
- [Exposure score](tvm-exposure-score.md)
|
||||
- [Configuration score](configuration-score.md)
|
||||
- [Security recommendations](tvm-security-recommendation.md)
|
||||
- [Remediation and exception](tvm-remediation.md)
|
||||
- [Software inventory](tvm-software-inventory.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [APIs](threat-and-vuln-mgt-scenarios.md#apis)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Advanced hunting overview](overview-hunting.md)
|
||||
- [All advanced hunting tables](advanced-hunting-reference.md)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
|
||||
@ -13,7 +13,7 @@ author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: troubleshooting
|
||||
---
|
||||
|
||||
@ -68,7 +68,7 @@ If the script fails and the event is an error, you can check the event ID in the
|
||||
Event ID | Error Type | Resolution steps
|
||||
:---|:---|:---
|
||||
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
|
||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.<br>Verify that the script was ran as an administrator.
|
||||
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically<br> ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.<br>Verify that the script has been run as an administrator.
|
||||
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). <br> <br> If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
|
||||
15 | Failed to start SENSE service | If the message of the error is: System error 577 or error 1058 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
|
||||
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
|
||||
@ -79,7 +79,7 @@ Event ID | Error Type | Resolution steps
|
||||
### Troubleshoot onboarding issues using Microsoft Intune
|
||||
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
|
||||
|
||||
If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
|
||||
If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
|
||||
|
||||
Use the following tables to understand the possible causes of issues while onboarding:
|
||||
|
||||
@ -87,7 +87,7 @@ Use the following tables to understand the possible causes of issues while onboa
|
||||
- Known issues with non-compliance table
|
||||
- Mobile Device Management (MDM) event logs table
|
||||
|
||||
If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
|
||||
If none of the event logs and troubleshooting steps work, download the Local script from the **Machine management** section of the portal, and run it in an elevated command prompt.
|
||||
|
||||
**Microsoft Intune error codes and OMA-URIs**:
|
||||
|
||||
@ -140,7 +140,7 @@ If the deployment tools used does not indicate an error in the onboarding proces
|
||||
2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**.
|
||||
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Microsoft Defender ATP.
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Microsoft Defender ATP.
|
||||
|
||||
3. Select **Operational** to load the log.
|
||||
|
||||
@ -282,15 +282,15 @@ You might also need to check the following:
|
||||
|
||||
- Check **Event Viewer** > **Applications and Services Logs** > **Operation Manager** to see if there are any errors.
|
||||
|
||||
- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
|
||||
- In **Services**, check if the **Microsoft Monitoring Agent** is running on the server. For example,
|
||||
|
||||
|
||||
|
||||
- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
|
||||
- In **Microsoft Monitoring Agent** > **Azure Log Analytics (OMS)**, check the Workspaces and verify that the status is running.
|
||||
|
||||
|
||||
|
||||
- Check to see that machines are reflected in the **Machines list** in the portal.
|
||||
- Check to see that machines are reflected in the **Machines list** in the portal.
|
||||
|
||||
## Confirming onboarding of newly built machines
|
||||
There may be instances when onboarding is deployed on a newly built machine but not completed.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Threat & Vulnerability Management dashboard overview
|
||||
title: Threat & Vulnerability Management dashboard insights
|
||||
description: The Threat & Vulnerability Management dashboard can help SecOps and security admins address cybersecurity threats and build their organization's security resilience.
|
||||
keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, risk-based threat & vulnerability management, security configuration, configuration score, exposure score
|
||||
search.appverid: met150
|
||||
@ -16,7 +16,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
# Threat & Vulnerability Management dashboard overview
|
||||
# Threat & Vulnerability Management dashboard insights
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
@ -51,20 +51,20 @@ You can remediate the issues based on prioritized [security recommendations](tvm
|
||||
|
||||
To lower your threat and vulnerability exposure, follow these steps.
|
||||
|
||||
1. Review the **Top security recommendations** from your [**Threat & Vulnerability Management dashboard**](tvm-dashboard-insights.md) , and select the first item on the list. The **Security recommendation** page opens.
|
||||
1. Review the **Top security recommendations** from your [**Threat & Vulnerability Management dashboard**](tvm-dashboard-insights.md) and select an item on the list.
|
||||
|
||||
Always prioritize recommendations that are associated with ongoing threats:
|
||||
|
||||
|
||||
-  Threat insight icon
|
||||
-  Active alert icon
|
||||
Always prioritize recommendations that are associated with ongoing threats:
|
||||
|
||||
|
||||
-  Threat insight icon
|
||||
-  Active alert icon
|
||||
|
||||
2. The **Security recommendations** page shows the list of items to remediate. Select the security recommendation that you need to investigate. When you select a recommendation from the list, a fly-out panel will display a description of what you need to remediate, number of vulnerabilities, associated exploits in machines, number of exposed machines and their machine names, business impact, and a list of CVEs. Click **Open software page** option from the flyout panel. 
|
||||
2. The **Security recommendations** page will open, and a flyout for the recommendation you selected will open. The flyout panel will display a description of what you need to remediate, number of vulnerabilities, associated exploits in machines, number of exposed machines and their machine names, business impact, and a list of CVEs. Select **Open software page** option from the flyout panel. 
|
||||
|
||||
3. Select **Installed machines** and then the affected machine from the list. A flyout panel will open with the relevant machine details, exposure and risk levels, alert and incident activities. 
|
||||
3. Select **Installed machines** and then the affected machine from the list. A flyout panel will open with the relevant machine details, exposure and risk levels, alert and incident activities. 
|
||||
|
||||
4. Click **Open machine page** to connect to the machine and apply the selected recommendation. See [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) for details. 
|
||||
4. Click **Open machine page** to connect to the machine and apply the selected recommendation. See [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) for details. 
|
||||
|
||||
5. Allow a few hours for the changes to propagate in the system.
|
||||
|
||||
|
||||
@ -32,48 +32,35 @@ Lower your organization's exposure from vulnerabilities and increase your securi
|
||||
|
||||
## Navigate to the Remediation page
|
||||
|
||||
You can access the remediation page though the navigation menu, and top remediation activities in the dashboard.
|
||||
You can access the Remediation page a few different ways:
|
||||
|
||||
- Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
||||
- Top remediation activities card in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
|
||||
### Navigation menu
|
||||
|
||||
Go to the Threat & Vulnerability Management navigation menu and select **Remediation** to open up the list of remediation activities and exceptions found in your organization. Select the remediation activity that you want to view.
|
||||
|
||||
Go to the Threat & Vulnerability Management navigation menu and select **Remediation** to open up the list of remediation activities and exceptions found in your organization.
|
||||
|
||||
### Top remediation activities in the dashboard
|
||||
|
||||
View **Top remediation activities** in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md). Select any of the entries to go to the **Remediation** page. You can mark the remediation activity as completed after the IT admin team remediates the task.
|
||||
|
||||
|
||||
|
||||
## Remediation activities
|
||||
|
||||
When you [submit a remediation request](tvm-security-recommendation.md#request-remediation) from the [Security recommendations page](tvm-security-recommendation.md), it kicks-off a remediation activity. A security task is created which will be tracked in the Threat & Vulnerability Management **Remediation** page, and a remediation ticket is created in Microsoft Intune.
|
||||
|
||||
Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete.
|
||||
|
||||
|
||||
## Exceptions
|
||||
|
||||
You can file exceptions to exclude certain recommendation from showing up in reports and affecting your [configuration score](configuration-score.md).
|
||||
|
||||
[File for an exception](tvm-security-recommendation.md#file-for-exception) from the [Security recommendations page](tvm-security-recommendation.md).
|
||||
|
||||
### Exception justification
|
||||
|
||||
If the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The following list details the justifications behind the exception options:
|
||||
|
||||
- **Compensating/alternate control** - A 3rd party control that mitigates this recommendation exists, for example, if Network Firewall - - prevents access to a machine, third party antivirus
|
||||
- **Productivity/business need** - Remediation will impact productivity or interrupt business-critical workflow
|
||||
- **Accept risk** - Poses low risk and/or implementing a compensating control is too expensive
|
||||
- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization
|
||||
- **Other** - False positive
|
||||
|
||||
|
||||
|
||||
### Where to find exceptions
|
||||
When you [file for an exception](tvm-security-recommendation.md#file-for-exception) from the [Security recommendations page](tvm-security-recommendation.md), you create an exception for that security recommendation. You can file exceptions to exclude certain recommendation from showing up in reports and affecting your [configuration score](configuration-score.md).
|
||||
|
||||
The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab. You can filter your view based on exception justification, type, and status.
|
||||
|
||||
|
||||
|
||||
You can also select **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard. Selecting the link opens a filtered view in the **Security recommendations** page of recommendations with an "Exception" status.
|
||||
|
||||
|
||||
|
||||
|
||||
### Exception actions and statuses
|
||||
|
||||
@ -98,7 +85,13 @@ Creating an exception can potentially affect the Exposure Score (for both types
|
||||
|
||||
The exception impact shows on both the Security recommendations page column and in the flyout pane.
|
||||
|
||||
|
||||
|
||||
|
||||
### View exceptions in other places
|
||||
|
||||
Select **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard to open a filtered view in the **Security recommendations** page of recommendations with an "Exception" status.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.topic: conceptual
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
@ -31,7 +31,7 @@ Cybersecurity weaknesses identified in your organization are mapped to actionabl
|
||||
|
||||
Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and Microsoft Endpoint Configuration Manager. When the threat landscape changes, the recommendation also changes as it continuously collects information from your environment.
|
||||
|
||||
## Criteria
|
||||
## How it works
|
||||
|
||||
Each machine in the organization is scored based on three important factors to help customers to focus on the right things at the right time.
|
||||
|
||||
@ -41,9 +41,17 @@ Each machine in the organization is scored based on three important factors to h
|
||||
|
||||
- **Business value** - Your organization's assets, critical processes, and intellectual properties
|
||||
|
||||
## Navigate to security recommendations
|
||||
## Navigate to the Security recommendations page
|
||||
|
||||
You can access security recommendations from the Microsoft Defender ATP Threat & Vulnerability Management navigation menu, dashboard, software page, and machine page.
|
||||
Access the Security recommendations page a few different ways:
|
||||
|
||||
- Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
||||
- Top security recommendations in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
|
||||
View related security recommendations in the following places:
|
||||
|
||||
- Software page
|
||||
- Machine page
|
||||
|
||||
### Navigation menu
|
||||
|
||||
@ -53,7 +61,7 @@ Go to the Threat & Vulnerability Management navigation menu and select **Securit
|
||||
|
||||
In a given day as a Security Administrator, you can take a look at the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) to see your [exposure score](tvm-exposure-score.md) side-by-side with your [configuration score](configuration-score.md). The goal is to **lower** your organization's exposure from vulnerabilities, and **increase** your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
||||
|
||||
|
||||
|
||||
|
||||
The top security recommendations lists the improvement opportunities prioritized based on the important factors mentioned in the previous section - threat, likelihood to be breached, and value. Selecting a recommendation will take you to the security recommendations page with more details about the recommendation.
|
||||
|
||||
@ -63,17 +71,17 @@ View recommendations, the number of weaknesses found, related components, threat
|
||||
|
||||
The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the number of exposed machines, the color of the graph will change into green.
|
||||
|
||||
|
||||
|
||||
|
||||
### Icons
|
||||
|
||||
Useful icons also quickly calls your attention to: <ul><li>  possible active alerts</li><li> associated public exploits</li><li> recommendation insights</li></ul><br>
|
||||
Useful icons also quickly calls your attention to: <ul><li>  possible active alerts</li><li> associated public exploits</li><li> recommendation insights</li></ul><br>
|
||||
|
||||
### Investigate
|
||||
|
||||
Select the security recommendation that you want to investigate or process.
|
||||
|
||||
|
||||
|
||||
|
||||
From the flyout, you can do any of the following:
|
||||
|
||||
@ -122,11 +130,17 @@ Exceptions can be created for both Security update and Configuration change reco
|
||||
When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list.
|
||||
|
||||
1. Select a security recommendation you would like create an exception for, and then **Exception options**.
|
||||
|
||||
|
||||
|
||||
2. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration.
|
||||
|
||||
> 
|
||||
The following list details the justifications behind the exception options:
|
||||
|
||||
- **Compensating/alternate control** - A 3rd party control that mitigates this recommendation exists, for example, if Network Firewall - - prevents access to a machine, third party antivirus
|
||||
- **Productivity/business need** - Remediation will impact productivity or interrupt business-critical workflow
|
||||
- **Accept risk** - Poses low risk and/or implementing a compensating control is too expensive
|
||||
- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization
|
||||
- **Other** - False positive
|
||||
|
||||
3. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created.
|
||||
|
||||
@ -140,15 +154,12 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
|
||||
|
||||
2. Select the three dots beside the security recommendation that you want to report, then select **Report inaccuracy**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||
|
||||
|
||||
|
||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
@ -27,51 +27,65 @@ ms.topic: conceptual
|
||||
|
||||
Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the **Software inventory** page. The software inventory includes the name of the product or vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected with it.
|
||||
|
||||
## Navigate through your software inventory
|
||||
|
||||
1. Select **Software inventory** from the Threat & Vulnerability management navigation menu. The **Software inventory** page opens with a list of software installed in your network, vendor name, weaknesses found, threats associated with them, exposed machines, impact to exposure score, tags. You can also filter the software inventory list view based on weaknesses found in the software, threats associated with them, and whether the software or software versions have reached end-of-support.
|
||||
|
||||
|
||||
2. In the **Software inventory** page, select the software that you want to investigate and a flyout panel opens up with the same details mentioned above but in a more compact view. You can either dive deeper into the investigation and select **Open software page** or flag any technical inconsistencies by selecting **Report inaccuracy**.
|
||||
|
||||
3. Select **Open software page** to dive deeper into your software inventory to see how many weaknesses are discovered in the software, devices exposed, installed machines, version distribution, and the corresponding security recommendations for the weaknesses and vulnerabilities identified.
|
||||
|
||||
## How it works
|
||||
|
||||
In the field of discovery, we are leveraging the same set of signals in Microsoft Defender ATP's endpoint detection and response that's responsible for detection, for vulnerability assessment.
|
||||
In the field of discovery, we are leveraging the same set of signals that is responsible for detection and vulnerability assessment in [Microsoft Defender ATP endpoint detection and response capabilities](overview-endpoint-detection-response.md).
|
||||
|
||||
Since it is real-time, in a matter of minutes, you will see vulnerability information as they get discovered. The engine automatically grabs information from multiple security feeds. In fact, you'll will see if a particular software is connected to a live threat campaign. It also provides a link to a Threat Analytics report soon as it's available.
|
||||
|
||||
## Navigate to the Software inventory page
|
||||
|
||||
You can access the Software inventory page by selecting **Software inventory** from the Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md).
|
||||
|
||||
View software on specific machines in the individual machines pages from the [machines list](machines-view-overview.md).
|
||||
|
||||
## Software inventory overview
|
||||
|
||||
The **Software inventory** page opens with a list of software installed in your network, vendor name, weaknesses found, threats associated with them, exposed machines, impact to exposure score, and tags. You can also filter the software inventory list view based on weaknesses found in the software, threats associated with them, and whether the software or software versions have reached end-of-support.
|
||||
|
||||
|
||||
Select the software that you want to investigate and a flyout panel opens up with a more compact view of the information on the page. You can either dive deeper into the investigation and select **Open software page**, or flag any technical inconsistencies by selecting **Report inaccuracy**.
|
||||
|
||||
|
||||
|
||||
## Software pages
|
||||
|
||||
Once you are in the Software inventory page and have opened the flyout panel by selecting a software to investigate, select **Open software page** (see image in the previous section). A full page will appear with all the details of a specific software and the following information:
|
||||
|
||||
- Side panel with vendor information, prevalence of the software in the organization (including number of machines it is installed on, and exposed machines that are not patched), whether and exploit is available, and impact to your exposure score
|
||||
- Data visualizations showing the number of, and severity of, vulnerabilities and misconfigurations. Also, graphs of the number of exposed machines
|
||||
- Tabs with lists of the corresponding security recommendations for the weaknesses and vulnerabilities identified, the named CVEs of discovered vulnerabilities, the names of the machines that the software is installed on, and the specific versions of the software with the number of machines that have each version installed and number of vulnerabilities.
|
||||
|
||||
|
||||
|
||||
## Software evidence
|
||||
|
||||
We now show evidence of where we detected a specific software on a machine from the registry, disk or both machine on where we detected a certain software.
|
||||
You can find it on any machines found in the [machines list](machines-view-overview.md) in a section called "Software Evidence."
|
||||
|
||||
From the Microsoft Defender Security Center navigation panel, go to **Machines list** > select the name of a machine to open the machine page (like Computer1) > select the **Software inventory** tab > select the software name to open the flyout and view software evidence.
|
||||
|
||||
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate version, incomplete, or already remediated software inventory information in the machine page.
|
||||
|
||||
1. Select one of the software rows. A flyout will appear.
|
||||
|
||||
2. Select "Report inaccuracy" in the flyout
|
||||
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate version, incomplete, or already remediated software inventory information.
|
||||
|
||||
1. Open the software flyout on the Software inventory page.
|
||||
2. Select **Report inaccuracy**.
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||
|
||||
|
||||
|
||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
- [Exposure score](tvm-exposure-score.md)
|
||||
- [Configuration score](configuration-score.md)
|
||||
- [Security recommendation](tvm-security-recommendation.md)
|
||||
- [Security recommendations](tvm-security-recommendation.md)
|
||||
- [Remediation and exception](tvm-remediation.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Recommendation APIs](vulnerability.md)
|
||||
- [Machine APIs](machine.md)
|
||||
- [Score APIs](score.md)
|
||||
- [Software APIs](software.md)
|
||||
- [Vulnerability APIs](vulnerability.md)
|
||||
- [APIs](threat-and-vuln-mgt-scenarios.md#apis)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
@ -34,14 +34,14 @@ Windows 7 | Operating System (OS) vulnerabilities
|
||||
Windows 8.1 | Not supported
|
||||
Windows 10 1607-1703 | Operating System (OS) vulnerabilities
|
||||
Windows 10 1709+ |Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2008R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2012R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2008 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2012 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2016 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2019 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
MacOS | Not supported (planned)
|
||||
Linux | Not supported (planned)
|
||||
|
||||
Some of the above prerequisites might be different from the [Minimum requirements for Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements) list.
|
||||
Some of the above prerequisites might be different from the [Minimum requirements for Microsoft Defender ATP](minimum-requirements.md) list.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -27,14 +27,7 @@ ms.topic: conceptual
|
||||
|
||||
Threat & Vulnerability Management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities.
|
||||
|
||||
The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights.
|
||||
|
||||
You can access the list of vulnerabilities in a few places in the portal:
|
||||
|
||||
- Global search
|
||||
- Weaknesses option in the navigation menu
|
||||
- Top vulnerable software widget in the dashboard
|
||||
- Discovered vulnerabilities page in the machine page
|
||||
The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization by listing the Common Vulnerabilities and Exposures (CVE) ID, the severity, Common Vulnerability Scoring System (CVSS) rating, prevalence in your organization, corresponding breach, and threat insights.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>To boost your vulnerability assessment detection rates, you can download the following mandatory security updates and deploy them in your network:
|
||||
@ -45,7 +38,27 @@ You can access the list of vulnerabilities in a few places in the portal:
|
||||
|
||||
## Navigate to the Weaknesses page
|
||||
|
||||
When new vulnerabilities are released, you can find out how many of your assets are exposed in the **Weaknesses** page of the Threat & Vulnerability Management navigation menu. If the **Exposed Machines** column shows 0, that means you are not at risk. If exposed machines exist, the next step is to remediate the vulnerabilities in those machines to reduce the risk to your assets and organization.
|
||||
Access the Weaknesses page a few different ways:
|
||||
|
||||
- Selecting **Weaknesses** from the Threat & Vulnerability Management navigation menu in the [Microsoft Defender Security Center](portal-overview.md)
|
||||
- Global search
|
||||
|
||||
### Navigation menu
|
||||
|
||||
Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open the list of CVEs.
|
||||
|
||||
### Vulnerabilities in global search
|
||||
|
||||
1. Go to the global search drop-down menu.
|
||||
2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then select the search icon. The **Weaknesses** page opens with the CVE information that you are looking for.
|
||||
|
||||
3. Select the CVE and a flyout panel opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates.
|
||||
|
||||
To see the rest of the vulnerabilities in the **Weaknesses** page, type CVE, then click search.
|
||||
|
||||
## Weaknesses overview
|
||||
|
||||
If the **Exposed Machines** column shows 0, that means you are not at risk. If exposed machines exist, the next step is to remediate the vulnerabilities in those machines to reduce the risk to your assets and organization.
|
||||
|
||||
|
||||
|
||||
@ -54,89 +67,64 @@ When new vulnerabilities are released, you can find out how many of your assets
|
||||
You can view the related breach and threat insights in the **Threat** column when the icons are colored red.
|
||||
|
||||
>[!NOTE]
|
||||
> Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight  icon and breach insight  icon.
|
||||
> Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight icon  and breach insight icon .
|
||||
|
||||
The breach insights icon is highlighted if there is a vulnerability found in your organization.
|
||||
|
||||
|
||||
|
||||
The threat insights icon is highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is a part of an exploit kit or connected to specific advanced persistent campaigns or activity groups. Threat Analytics report links are provided that you can read with zero-day exploitation news, disclosures, or related security advisories.
|
||||
|
||||
|
||||
|
||||
|
||||
## View Common Vulnerabilities and Exposures (CVE) entries in other places
|
||||
|
||||
|
||||
## Vulnerabilities in global search
|
||||
|
||||
1. Go to the global search drop-down menu.
|
||||
2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then select the search icon. The **Weaknesses** page opens with the CVE information that you are looking for.
|
||||
|
||||
3. Select the CVE and a flyout panel opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates.
|
||||
|
||||
To see the rest of the vulnerabilities in the **Weaknesses** page, type CVE, then click search.
|
||||
|
||||
## Top vulnerable software in the dashboard
|
||||
### Top vulnerable software in the dashboard
|
||||
|
||||
1. Go to the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time.
|
||||
|
||||
|
||||
2. Select the software that you want to investigate to go a drill down page.
|
||||
3. Select the **Discovered vulnerabilities** tab.
|
||||
4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
|
||||
4. Select the vulnerability that you want to investigate. A flyout panel will appear with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates.
|
||||
|
||||
|
||||
|
||||
|
||||
## Discover vulnerabilities in the machine page
|
||||
### Discover vulnerabilities in the machine page
|
||||
|
||||
1. Go to the left-hand navigation menu bar, then select the machine icon. The **Machines list** page opens.
|
||||
2. In the **Machines list** page, select the machine name that you want to investigate.
|
||||
View related weaknesses information in the machine page.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center navigation menu bar, then select the machine icon. The **Machines list** page opens.
|
||||
2. In the **Machines list** page, select the machine name that you want to investigate.
|
||||
<br></br>
|
||||
3. The machine page will open with details and response options for the machine you want to investigate.
|
||||
3. The machine page will open with details and response options for the machine you want to investigate.
|
||||
4. Select **Discovered vulnerabilities**.
|
||||
<br></br>
|
||||
5. Select the vulnerability that you want to investigate to open up a flyout panel with the CVE details, such as: vulnerability description, threat insights, and detection logic.
|
||||
|
||||
### CVE Detection logic
|
||||
#### CVE Detection logic
|
||||
|
||||
Similar to the software evidence, we now show the detection logic we applied on a machine in order to state that it's vulnerable. This is a new section called "Detection Logic" (in any discovered vulnerability in the machine page) that shows the detection logic and source.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate, missing, or already remediated vulnerability information in the machine page.
|
||||
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information.
|
||||
|
||||
1. Select the **Discovered vulnerabilities** tab.
|
||||
|
||||
2. Click **:** beside the vulnerability that you want to report about, and then select **Report inaccuracy**.
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the **Discovered vulnerability inaccuracy reason** drop-down menu.
|
||||
<br></br>
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
|
||||
5. Include your machine name for investigation context.
|
||||
|
||||
> [!NOTE]
|
||||
> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context.
|
||||
|
||||
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
|
||||
1. Open the CVE on the Weaknesses page.
|
||||
2. Select **Report inaccuracy**.
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
- [Exposure score](tvm-exposure-score.md)
|
||||
- [Configuration score](configuration-score.md)
|
||||
- [Security recommendation](tvm-security-recommendation.md)
|
||||
- [Security recommendations](tvm-security-recommendation.md)
|
||||
- [Remediation and exception](tvm-remediation.md)
|
||||
- [Software inventory](tvm-software-inventory.md)
|
||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Vulnerability APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/vulnerability)
|
||||
- [Machine APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine)
|
||||
- [Software APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/software)
|
||||
- [Recommendation APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/vulnerability)
|
||||
- [Score APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/score)
|
||||
- [APIs](threat-and-vuln-mgt-scenarios.md#apis)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
@ -30,6 +30,10 @@ For more information preview features, see [Preview features](https://docs.micro
|
||||
RSS feed: Get notified when this page is updated by copying and pasting the following URL into your feed reader:
|
||||
`https://docs.microsoft.com/api/search/rss?search=%22Lists+the+new+features+and+functionality+in+Microsoft+Defender+ATP%22&locale=en-us`
|
||||
|
||||
## April 2020
|
||||
|
||||
- [Threat & Vulnerability Management API support](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list) <BR>Run Threat & Vulnerability Management-related API calls such as get your organization's threat exposure score or device secure score, software and machine vulnerability inventory, software version distribution, machine vulnerability information, security recommendation information. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615).
|
||||
|
||||
## November-December 2019
|
||||
|
||||
- [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md) <BR> Microsoft Defender ATP for Mac brings the next-generation protection to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices, including [endpoint detection and response](endpoint-detection-response-mac-preview.md).
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 151 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 106 KiB |
|
Before Width: | Height: | Size: 39 KiB After Width: | Height: | Size: 39 KiB |
|
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 40 KiB |
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows 10)
|
||||
description: A list of all available settings for Windows Defender SmartScreen using Group Policy and mobile device management (MDM) settings.
|
||||
keywords: SmartScreen Filter, Windows SmartScreen, Windows Defender SmartScreen
|
||||
title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows 10)
|
||||
description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings.
|
||||
keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
@ -13,13 +13,13 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: dansimp
|
||||
---
|
||||
# Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings
|
||||
# Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
Windows Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Windows Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely.
|
||||
Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely.
|
||||
|
||||
See [Windows 10 (and later) settings to protect devices using Intune](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune.
|
||||
|
||||
@ -35,48 +35,48 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor
|
||||
<tr>
|
||||
<td><strong>Windows 10, version 1703:</strong><br>Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen<p><strong>Windows 10, Version 1607 and earlier:</strong><br>Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen</td>
|
||||
<td>At least Windows Server 2012, Windows 8 or Windows RT</td>
|
||||
<td>This policy setting turns on Windows Defender SmartScreen.<p>If you enable this setting, it turns on Windows Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Windows Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).<p>If you disable this setting, it turns off Windows Defender SmartScreen and your employees are unable to turn it on.<p>If you don't configure this setting, your employees can decide whether to use Windows Defender SmartScreen.</td>
|
||||
<td>This policy setting turns on Microsoft Defender SmartScreen.<p>If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).<p>If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.<p>If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control</td>
|
||||
<td>Windows 10, version 1703</td>
|
||||
<td>This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.<p>This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.<p><strong>Important:</strong> Using a trustworthy browser helps ensure that these protections work as expected.</td>
|
||||
<td>This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.</br></br>This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.</p><p><strong>Important:</strong> Using a trustworthy browser helps ensure that these protections work as expected.</p></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Windows 10, version 1703:</strong><br>Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen<p><strong>Windows 10, Version 1607 and earlier:</strong><br>Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen</td>
|
||||
<td>Microsoft Edge on Windows 10 or later</td>
|
||||
<td>This policy setting turns on Windows Defender SmartScreen.<p>If you enable this setting, it turns on Windows Defender SmartScreen and your employees are unable to turn it off.<p>If you disable this setting, it turns off Windows Defender SmartScreen and your employees are unable to turn it on.<p>If you don't configure this setting, your employees can decide whether to use Windows Defender SmartScreen.</td>
|
||||
<td>This policy setting turns on Microsoft Defender SmartScreen.<p>If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.<p>If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.<p>If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Windows 10, version 1703:</strong><br>Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files<p><strong>Windows 10, Version 1511 and 1607:</strong><br>Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files</td>
|
||||
<td>Microsoft Edge on Windows 10, version 1511 or later</td>
|
||||
<td>This policy setting stops employees from bypassing the Windows Defender SmartScreen warnings about potentially malicious files.<p>If you enable this setting, it stops employees from bypassing the warning, stopping the file download.<p>If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files.</td>
|
||||
<td>This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious files.<p>If you enable this setting, it stops employees from bypassing the warning, stopping the file download.<p>If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Windows 10, version 1703:</strong><br>Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites<p><strong>Windows 10, Version 1511 and 1607:</strong><br>Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites</td>
|
||||
<td>Microsoft Edge on Windows 10, version 1511 or later</td>
|
||||
<td>This policy setting stops employees from bypassing the Windows Defender SmartScreen warnings about potentially malicious sites.<p>If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.<p>If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site.</td>
|
||||
<td>This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious sites.<p>If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.<p>If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Administrative Templates\Windows Components\Internet Explorer\Prevent managing SmartScreen Filter</td>
|
||||
<td>Internet Explorer 9 or later</td>
|
||||
<td>This policy setting prevents the employee from managing Windows Defender SmartScreen.<p>If you enable this policy setting, the employee isn't prompted to turn on Windows Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the employee.<p>If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Windows Defender SmartScreen during the first-run experience.</td>
|
||||
<td>This policy setting prevents the employee from managing Microsoft Defender SmartScreen.<p>If you enable this policy setting, the employee isn't prompted to turn on Microsoft Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the employee.<p>If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Microsoft Defender SmartScreen during the first-run experience.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings</td>
|
||||
<td>Internet Explorer 8 or later</td>
|
||||
<td>This policy setting determines whether an employee can bypass warnings from Windows Defender SmartScreen.<p>If you enable this policy setting, Windows Defender SmartScreen warnings block the employee.<p>If you disable or don't configure this policy setting, the employee can bypass Windows Defender SmartScreen warnings.</td>
|
||||
<td>This policy setting determines whether an employee can bypass warnings from Microsoft Defender SmartScreen.<p>If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.<p>If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet</td>
|
||||
<td>Internet Explorer 9 or later</td>
|
||||
<td>This policy setting determines whether the employee can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen warns the employee about executable files that Internet Explorer users do not commonly download from the Internet.<p>If you enable this policy setting, Windows Defender SmartScreen warnings block the employee.<p>If you disable or don't configure this policy setting, the employee can bypass Windows Defender SmartScreen warnings.</td>
|
||||
<td>This policy setting determines whether the employee can bypass warnings from Microsoft Defender SmartScreen. Microsoft Defender SmartScreen warns the employee about executable files that Internet Explorer users do not commonly download from the Internet.<p>If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.<p>If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
## MDM settings
|
||||
If you manage your policies using Microsoft Intune, you'll want to use these MDM policy settings. All settings support both desktop computers (running Windows 10 Pro or Windows 10 Enterprise, enrolled with Microsoft Intune) and Windows 10 Mobile devices. <br><br>
|
||||
For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP - InternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer).
|
||||
For Microsoft Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP - InternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer).
|
||||
<table>
|
||||
<tr>
|
||||
<th align="left">Setting</th>
|
||||
@ -91,8 +91,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
|
||||
<li><strong>URI full path.</strong> ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen</li>
|
||||
<li><strong>Data type.</strong> Integer</li>
|
||||
<li><strong>Allowed values:</strong><ul>
|
||||
<li><strong>0 .</strong> Turns off Windows Defender SmartScreen in Edge.</li>
|
||||
<li><strong>1.</strong> Turns on Windows Defender SmartScreen in Edge.</li></ul></li></ul>
|
||||
<li><strong>0 .</strong> Turns off Microsoft Defender SmartScreen in Edge.</li>
|
||||
<li><strong>1.</strong> Turns on Microsoft Defender SmartScreen in Edge.</li></ul></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -115,8 +115,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
|
||||
<li><strong>URI full path.</strong> ./Vendor/MSFT/Policy/Config/SmartScreen/EnableSmartScreenInShell</li>
|
||||
<li><strong>Data type.</strong> Integer</li>
|
||||
<li><strong>Allowed values:</strong><ul>
|
||||
<li><strong>0 .</strong> Turns off Windows Defender SmartScreen in Windows for app and file execution.</li>
|
||||
<li><strong>1.</strong> Turns on Windows Defender SmartScreen in Windows for app and file execution.</li></ul></li></ul>
|
||||
<li><strong>0 .</strong> Turns off Microsoft Defender SmartScreen in Windows for app and file execution.</li>
|
||||
<li><strong>1.</strong> Turns on Microsoft Defender SmartScreen in Windows for app and file execution.</li></ul></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -127,8 +127,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
|
||||
<li><strong>URI full path.</strong> ./Vendor/MSFT/Policy/Config/SmartScreen/PreventOverrideForFilesInShell</li>
|
||||
<li><strong>Data type.</strong> Integer</li>
|
||||
<li><strong>Allowed values:</strong><ul>
|
||||
<li><strong>0 .</strong> Employees can ignore Windows Defender SmartScreen warnings and run malicious files.</li>
|
||||
<li><strong>1.</strong> Employees can't ignore Windows Defender SmartScreen warnings and run malicious files.</li></ul></li></ul>
|
||||
<li><strong>0 .</strong> Employees can ignore Microsoft Defender SmartScreen warnings and run malicious files.</li>
|
||||
<li><strong>1.</strong> Employees can't ignore Microsoft Defender SmartScreen warnings and run malicious files.</li></ul></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -139,8 +139,8 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
|
||||
<li><strong>URI full path.</strong> ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride</li>
|
||||
<li><strong>Data type.</strong> Integer</li>
|
||||
<li><strong>Allowed values:</strong><ul>
|
||||
<li><strong>0 .</strong> Employees can ignore Windows Defender SmartScreen warnings.</li>
|
||||
<li><strong>1.</strong> Employees can't ignore Windows Defender SmartScreen warnings.</li></ul></li></ul>
|
||||
<li><strong>0 .</strong> Employees can ignore Microsoft Defender SmartScreen warnings.</li>
|
||||
<li><strong>1.</strong> Employees can't ignore Microsoft Defender SmartScreen warnings.</li></ul></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -151,16 +151,16 @@ For Windows Defender SmartScreen Internet Explorer MDM policies, see [Policy CSP
|
||||
<li><strong>URI full path.</strong> ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles</li>
|
||||
<li><strong>Data type.</strong> Integer</li>
|
||||
<li><strong>Allowed values:</strong><ul>
|
||||
<li><strong>0 .</strong> Employees can ignore Windows Defender SmartScreen warnings for files.</li>
|
||||
<li><strong>1.</strong> Employees can't ignore Windows Defender SmartScreen warnings for files.</li></ul></li></ul>
|
||||
<li><strong>0 .</strong> Employees can ignore Microsoft Defender SmartScreen warnings for files.</li>
|
||||
<li><strong>1.</strong> Employees can't ignore Microsoft Defender SmartScreen warnings for files.</li></ul></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
## Recommended Group Policy and MDM settings for your organization
|
||||
By default, Windows Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Windows Defender SmartScreen to block high-risk interactions instead of providing just a warning.
|
||||
By default, Microsoft Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning.
|
||||
|
||||
To better help you protect your organization, we recommend turning on and using these specific Windows Defender SmartScreen Group Policy and MDM settings.
|
||||
To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen Group Policy and MDM settings.
|
||||
<table>
|
||||
<tr>
|
||||
<th align="left">Group Policy setting</th>
|
||||
@ -168,7 +168,7 @@ To better help you protect your organization, we recommend turning on and using
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreen</td>
|
||||
<td><strong>Enable.</strong> Turns on Windows Defender SmartScreen.</td>
|
||||
<td><strong>Enable.</strong> Turns on Microsoft Defender SmartScreen.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites</td>
|
||||
@ -191,7 +191,7 @@ To better help you protect your organization, we recommend turning on and using
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Browser/AllowSmartScreen</td>
|
||||
<td><strong>1.</strong> Turns on Windows Defender SmartScreen.</td>
|
||||
<td><strong>1.</strong> Turns on Microsoft Defender SmartScreen.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Browser/PreventSmartScreenPromptOverride</td>
|
||||
@ -203,7 +203,7 @@ To better help you protect your organization, we recommend turning on and using
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SmartScreen/EnableSmartScreenInShell</td>
|
||||
<td><strong>1.</strong> Turns on Windows Defender SmartScreen in Windows.<p>Requires at least Windows 10, version 1703.</td>
|
||||
<td><strong>1.</strong> Turns on Microsoft Defender SmartScreen in Windows.<p>Requires at least Windows 10, version 1703.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SmartScreen/PreventOverrideForFilesInShell</td>
|
||||
@ -214,7 +214,7 @@ To better help you protect your organization, we recommend turning on and using
|
||||
## Related topics
|
||||
- [Threat protection](../index.md)
|
||||
|
||||
- [Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md)
|
||||
- [Microsoft Defender SmartScreen overview](microsoft-defender-smartscreen-overview.md)
|
||||
|
||||
- [Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies)
|
||||
|
||||
@ -0,0 +1,93 @@
|
||||
---
|
||||
title: Microsoft Defender SmartScreen overview (Windows 10)
|
||||
description: Conceptual info about Microsoft Defender SmartScreen.
|
||||
keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
ms.author: macapara
|
||||
audience: ITPro
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 11/27/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Microsoft Defender SmartScreen
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
- Microsoft Edge
|
||||
|
||||
Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
|
||||
|
||||
**Microsoft Defender SmartScreen determines whether a site is potentially malicious by:**
|
||||
|
||||
- Analyzing visited webpages looking for indications of suspicious behavior. If Microsoft Defender SmartScreen determines that a page is suspicious, it will show a warning page to advise caution.
|
||||
|
||||
- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious.
|
||||
|
||||
**Microsoft Defender SmartScreen determines whether a downloaded app or app installer is potentially malicious by:**
|
||||
|
||||
- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious.
|
||||
|
||||
- Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, Microsoft Defender SmartScreen shows a warning, advising caution.
|
||||
|
||||
## Benefits of Microsoft Defender SmartScreen
|
||||
|
||||
Microsoft Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are:
|
||||
|
||||
- **Anti-phishing and anti-malware support.** Microsoft Defender SmartScreen helps to protect users from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Microsoft Defender SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97)
|
||||
|
||||
- **Reputation-based URL and app protection.** Microsoft Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. If a URL, a file, an app, or a certificate has an established reputation, users won't see any warnings. If, however, there's no reputation, the item is marked as a higher risk and presents a warning to the user.
|
||||
|
||||
- **Operating system integration.** Microsoft Defender SmartScreen is integrated into the Windows 10 operating system, meaning that it checks any files an app (including 3rd-party browsers and email clients) attempts to download and run.
|
||||
|
||||
- **Improved heuristics and diagnostic data.** Microsoft Defender SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files.
|
||||
|
||||
- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen-available-settings.md).
|
||||
|
||||
- **Blocking URLs associated with potentially unwanted applications.** In Microsoft Edge (based on Chromium), SmartScreen blocks URLs associated with potentially unwanted applications, or PUAs. For more information on blocking URLs associated with PUAs, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares.
|
||||
|
||||
## Submit files to Microsoft Defender SmartScreen for review
|
||||
|
||||
If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide).
|
||||
|
||||
When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu.
|
||||
|
||||
|
||||
|
||||
## Viewing Microsoft Defender SmartScreen anti-phishing events
|
||||
|
||||
When Microsoft Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx).
|
||||
|
||||
## Viewing Windows event logs for Microsoft Defender SmartScreen
|
||||
Microsoft Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer.
|
||||
|
||||
Windows event log for SmartScreen is disabled by default, users can use Event Viewer UI to enable the log or use the command line to enable it:
|
||||
|
||||
```
|
||||
wevtutil sl Microsoft-Windows-SmartScreen/Debug /e:true
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> For information on how to use the Event Viewer, see [Windows Event Viewer](https://docs.microsoft.com/host-integration-server/core/windows-event-viewer1).
|
||||
|
||||
|
||||
EventID | Description
|
||||
-|-
|
||||
1000 | Application Windows Defender SmartScreen Event
|
||||
1001 | Uri Windows Defender SmartScreen Event
|
||||
1002 | User Decision Windows Defender SmartScreen Event
|
||||
|
||||
## Related topics
|
||||
- [SmartScreen Frequently Asked Questions](https://fb.smartscreen.microsoft.com/smartscreenfaq.aspx)
|
||||
- [Threat protection](../index.md)
|
||||
- [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings)
|
||||
@ -0,0 +1,88 @@
|
||||
---
|
||||
title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows 10)
|
||||
description: Learn how employees can use Windows Security to set up Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects users from running malicious apps.
|
||||
keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/13/2017
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.author: macapara
|
||||
---
|
||||
|
||||
# Set up and use Microsoft Defender SmartScreen on individual devices
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10, version 1703
|
||||
- Windows 10 Mobile
|
||||
- Microsoft Edge
|
||||
|
||||
Microsoft Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files.
|
||||
|
||||
## How users can use Windows Security to set up Microsoft Defender SmartScreen
|
||||
Starting with Windows 10, version 1703, users can use Windows Security to set up Microsoft Defender SmartScreen for an individual device; unless an administrator has used Group Policy or Microsoft Intune to prevent it.
|
||||
|
||||
>[!NOTE]
|
||||
>If any of the following settings are managed through Group Policy or mobile device management (MDM) settings, it appears as unavailable to the employee.
|
||||
|
||||
**To use Windows Security to set up Microsoft Defender SmartScreen on a device**
|
||||
1. Open the Windows Security app, and then select **App & browser control** > **Reputation-based protection settings**.
|
||||
|
||||
2. In the **Reputation-based protection** screen, choose from the following options:
|
||||
|
||||
- In the **Check apps and files** area:
|
||||
|
||||
- **On.** Warns users that the apps and files being downloaded from the web are potentially dangerous but allows the action to continue.
|
||||
|
||||
- **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files.
|
||||
|
||||
- In the **Microsoft Defender SmartScreen for Microsoft Edge** area:
|
||||
|
||||
- **On.** Warns users that sites and downloads are potentially dangerous but allows the action to continue while running in Microsoft Edge.
|
||||
|
||||
- **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from downloading potentially malicious apps and files.
|
||||
- In the **Potentially unwanted app blocking** area:
|
||||
|
||||
- **On.** Turns on both the 'Block apps' and 'Block downloads settings. To learn more, see [How Microsoft identifies malware and potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/intelligence/criteria#potentially-unwanted-application-pua).
|
||||
- **Block apps.** This setting will prevent new apps from installing on the device and warn users of apps that are existing on the device.
|
||||
|
||||
- **Block downloads.** This setting will alert users and stop the downloads of apps in the Microsoft Edge browser (based on Chromium).
|
||||
|
||||
- **Off.** Turns off Potentially unwanted app blocking, so a user isn't alerted or stopped from downloading or installing potentially unwanted apps.
|
||||
|
||||
- In the **Microsoft Defender SmartScreen from Microsoft Store apps** area:
|
||||
|
||||
- **On.** Warns users that the sites and downloads used by Microsoft Store apps are potentially dangerous but allows the action to continue.
|
||||
|
||||
- **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files.
|
||||
|
||||
|
||||
|
||||
## How Microsoft Defender SmartScreen works when a user tries to run an app
|
||||
Microsoft Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Microsoft Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization.
|
||||
|
||||
By default, users can bypass Microsoft Defender SmartScreen protection, letting them run legitimate apps after accepting a warning message prompt. You can also use Group Policy or Microsoft Intune to block your employees from using unrecognized apps, or to entirely turn off Microsoft Defender SmartScreen (not recommended).
|
||||
|
||||
## How users can report websites as safe or unsafe
|
||||
Microsoft Defender SmartScreen can be configured to warn users from going to a potentially dangerous site. Users can then choose to report a website as safe from the warning message or as unsafe from within Microsoft Edge and Internet Explorer 11.
|
||||
|
||||
**To report a website as safe from the warning message**
|
||||
- On the warning screen for the site, click **More Information**, and then click **Report that this site does not contain threats**. The site info is sent to the Microsoft feedback site, which provides further instructions.
|
||||
|
||||
**To report a website as unsafe from Microsoft Edge**
|
||||
- If a site seems potentially dangerous, users can report it to Microsoft by clicking **More (...)**, clicking **Send feedback**, and then clicking **Report unsafe site**.
|
||||
|
||||
**To report a website as unsafe from Internet Explorer 11**
|
||||
- If a site seems potentially dangerous, users can report it to Microsoft by clicking on the **Tools** menu, clicking **Windows Defender SmartScreen**, and then clicking **Report unsafe website**.
|
||||
|
||||
## Related topics
|
||||
- [Threat protection](../index.md)
|
||||
|
||||
- [Microsoft Defender SmartScreen overview](microsoft-defender-smartscreen-overview.md)
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -86,7 +86,7 @@ Windows Defender SmartScreen notifies users if they click on reported phishing a
|
||||
|
||||
For Windows 10, Microsoft improved SmartScreen (now called Windows Defender SmartScreen) protection capability by integrating its app reputation abilities into the operating system itself, which allows Windows Defender SmartScreen to check the reputation of files downloaded from the Internet and warn users when they’re about to run a high-risk downloaded file. The first time a user runs an app that originates from the Internet, Windows Defender SmartScreen checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, Windows Defender SmartScreen warns the user or blocks execution entirely, depending on how the administrator has configured Microsoft Intune or Group Policy settings.
|
||||
|
||||
For more information, see [Windows Defender SmartScreen overview](windows-defender-smartscreen/windows-defender-smartscreen-overview.md).
|
||||
For more information, see [Microsoft Defender SmartScreen overview](microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md).
|
||||
|
||||
### Windows Defender Antivirus
|
||||
|
||||
|
||||
@ -41,7 +41,7 @@ The Security Compliance Toolkit consists of:
|
||||
- Windows Server 2012 R2
|
||||
|
||||
- Microsoft Office security baseline
|
||||
- Office 365 ProPlus (Sept 2019)
|
||||
- Microsoft 365 Apps for enterprise (Sept 2019)
|
||||
|
||||
- Microsoft Edge security baseline
|
||||
- Version 80
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user