diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
new file mode 100644
index 0000000000..7f6d64ab86
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
@@ -0,0 +1,517 @@
+---
+title: Policy CSP - WindowsDefenderSecurityCenter
+description: Policy CSP - WindowsDefenderSecurityCenter
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: nickbrower
+ms.date: 07/06/2017
+---
+
+# Policy CSP - WindowsDefenderSecurityCenter
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+## WindowsDefenderSecurityCenter policies
+
+
+**WindowsDefenderSecurityCenter/CompanyName**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+  |
+  3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display the contact options.
+
+
Value type is string. Supported operations are Add, Get, Replace and Delete.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableAppBrowserUI**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) The users can see the display of the app and browser protection area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the app and browser protection area in Windows Defender Security Center.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableEnhancedNotifications**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy if you want Windows Defender Security Center to only display notifications which are considered critical. If you disable or do not configure this setting, Windows Defender Security Center will display critical and non-critical notifications to users.
+
+> [!Note]
+> If Suppress notification is enabled then users will not see critical or non-critical messages.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) Windows Defender Security Center will display critical and non-critical notifications to users..
+- 1 - (Enable) Windows Defender Security Center only display notifications which are considered critical on clients.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableFamilyUI**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) The users can see the display of the family options area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the family options area in Windows Defender Security Center.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableHealthUI**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) The users can see the display of the device performance and health area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the device performance and health area in Windows Defender Security Center.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableNetworkUI**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) The users can see the display of the firewall and network protection area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the firewall and network protection area in Windows Defender Security Center.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableNotifications**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. If you disable or do not configure this setting, Windows Defender Security Center notifications will display on devices.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) The users can see the display of Windows Defender Security Center notifications.
+- 1 - (Enable) The users cannot see the display of Windows Defender Security Center notifications.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisableVirusUI**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete. Valid values:
+
+- 0 - (Disable) The users can see the display of the virus and threat protection area in Windows Defender Security Center.
+- 1 - (Enable) The users cannot see the display of the virus and threat protection area in Windows Defender Security Center.
+
+
+
+
+**WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area.
+
+
Value type is integer. Supported operations are Add, Get, Replace and Delete.Valid values:
+
+- 0 - (Disable) Local users are allowed to make changes in the exploit protection settings area.
+- 1 - (Enable) Local users cannot make changes in the exploit protection settings area.
+
+
+
+
+**WindowsDefenderSecurityCenter/Email**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. The email address that is displayed to users. The default mail application is used to initiate email actions. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
+
+
Value type is string. Supported operations are Add, Get, Replace and Delete.
+
+
+
+
+**WindowsDefenderSecurityCenter/EnableCustomizedToasts**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. Enable this policy to display your company name and contact options in the notifications. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will display a default notification text.
+
+
Value type is integer. Supported operations are Add, Get, Replace, and Delete. Valid values:
+
+- 0 - (Disable) Notifications contain a default notification text.
+- 1 - (Enable) Notifications contain the company name and contact options.
+
+
+
+
+
+**WindowsDefenderSecurityCenter/EnableInAppCustomization**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709.Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. If you disable or do not configure this setting, or do not provide CompanyName and a minimum of one contact method (Phone using Skype, Email, Help portal URL) Windows Defender Security Center will not display the contact card fly out notification.
+
+
Value type is integer. Supported operations are Add, Get, Replace, and Delete. Valid values:
+
+- 0 - (Disable) Do not display the company name and contact options in the card fly out notification.
+- 1 - (Enable) Display the company name and contact options in the card fly out notification.
+
+
+
+
+**WindowsDefenderSecurityCenter/Phone**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. The phone number or Skype ID that is displayed to users. Skype is used to initiate the call. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then devices will not display contact options.
+
+
Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+
+
+
+**WindowsDefenderSecurityCenter/URL**
+
+
+
+
+ | Home |
+ Pro |
+ Business |
+ Enterprise |
+ Education |
+ Mobile |
+ MobileEnterprise |
+
+
+ |
+ 3 |
+ 3 |
+ 3 |
+ 3 |
+ |
+ |
+
+
+
+
+
+Added in Windows 10, version 1709. The help portal URL this is displayed to users. The default browser is used to initiate this action. If you disable or do not configure this setting, or do not have EnableCustomizedToasts or EnableInAppCustomization enabled, then the device will not display contact options.
+
+
Value type is Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+
+
\ No newline at end of file
diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md
index c982bb06b0..05e8da9fa3 100644
--- a/windows/client-management/mdm/vpnv2-csp.md
+++ b/windows/client-management/mdm/vpnv2-csp.md
@@ -7,11 +7,13 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 07/07/2017
---
# VPNv2 CSP
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
The VPNv2 configuration service provider allows the mobile device management (MDM) server to configure the VPN profile of the device.
@@ -45,8 +47,6 @@ Supported operations include Get, Add, and Delete.
> **Note** If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard.
-
-
**VPNv2/***ProfileName***/AppTriggerList**
Optional node. List of applications set to trigger the VPN. If any of these apps are launched and the VPN profile is currently the active profile, this VPN profile will be triggered to connect.
@@ -91,6 +91,11 @@ The subnet prefix size part of the destination prefix for the route entry. This,
Value type is int. Supported operations include Get, Add, Replace, and Delete.
+**VPNv2/***ProfileName***/RouteList/***routeRowId***/Metric**
+Added in Windows 10, version 1607. The route's metric.
+
+Value type is int. Supported operations include Get, Add, Replace, and Delete.
+
**VPNv2/***ProfileName***/RouteList/***routeRowId***/ExclusionRoute**
Added in Windows 10, version 1607. A boolean value that specifies if the route being added should point to the VPN Interface or the Physical Interface as the Gateway. Valid values:
@@ -261,7 +266,7 @@ Valid values:
Value type is bool. Supported operations include Get, Add, Replace, and Delete.
-**VPNv2/***ProfileName***/LockDown**
+**VPNv2/***ProfileName***/LockDown** (./Device only profile)
Lockdown profile.
Valid values:
@@ -280,6 +285,24 @@ A Lockdown profile must be deleted before you can add, remove, or connect other
Value type is bool. Supported operations include Get, Add, Replace, and Delete.
+**VPNv2/***ProfileName***/DeviceTunnel** (./Device only profile)
+Device tunnel profile.
+
+Valid values:
+
+- False (default) - this is not a device tunnel profile.
+- True - this is a device tunnel profile.
+
+When the DeviceTunnel profile is turned on, it does the following things:
+
+- First, it automatically becomes an "always on" profile.
+- Second, it does not require the presence or logging in of any user to the machine in order for it to connect.
+- Third, no other device tunnel profile maybe be present on the same machine.
+
+A device tunnel profile must be deleted before another device tunnel profile can be added, removed, or connected.
+
+Value type is bool. Supported operations include Get, Add, Replace, and Delete.
+
**VPNv2/***ProfileName***/DnsSuffix**
Optional. Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList.
@@ -493,6 +516,8 @@ The following list contains the valid values:
- AES128
- AES192
- AES256
+- AES\_GCM_128
+- AES\_GCM_256
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
@@ -542,6 +567,11 @@ Added in Windows 10, version 1607. The preshared key used for an L2TP connectio
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
+**VPNv2/***ProfileName***/NativeProfile/DisableClassBasedDefaultRoute**
+Added in Windows 10, version 1607. Specifies the class based default routes. For example, if the interface IP begins with 10, it assumes a class a IP and pushes the route to 10.0.0.0/8
+
+Value type is bool. Supported operations include Get, Add, Replace, and Delete.
+
## Examples
diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md
index f85acf61e2..1312ba1a63 100644
--- a/windows/client-management/mdm/vpnv2-ddf-file.md
+++ b/windows/client-management/mdm/vpnv2-ddf-file.md
@@ -7,11 +7,13 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: nickbrower
-ms.date: 06/19/2017
+ms.date: 07/07/2017
---
# VPNv2 DDF file
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
This topic shows the OMA DM device description framework (DDF) for the **VPNv2** configuration service provider.
@@ -20,7 +22,7 @@ You can download the DDF files from the links below:
- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
-The XML below is the current version for this CSP.
+The XML below is for Windows 10, version 1709.
``` syntax
@@ -33,7 +35,7 @@ The XML below is the current version for this CSP.
1.2
VPNv2
- ./Vendor/MSFT
+ ./Device/Vendor/MSFT
@@ -48,7 +50,7 @@ The XML below is the current version for this CSP.
- com.microsoft/1.2/MDM/VPNv2
+ com.microsoft/1.3/MDM/VPNv2
@@ -310,7 +312,7 @@ The XML below is the current version for this CSP.
-
+
False = This Route will direct traffic over the VPN
True = This Route will direct traffic over the physical interface
By default, this value is false.
@@ -953,6 +955,43 @@ The XML below is the current version for this CSP.
+
+ DeviceTunnel
+
+
+
+
+
+
+
+
+ False = This is not a Device Tunnel profile and it is the default value.
+ True = This is a Device Tunnel profile.
+
+ If turned on a device tunnel profile does four things.
+ First, it automatically becomes an always on profile.
+ Second, it does not require the presence or logging in
+ of any user to the machine in order for it to connect.
+ Third, no other Device Tunnel profile maybe be present on the
+ Same machine.
+
+ A device tunnel profile must be deleted before another device tunnel
+ profile can be added, removed, or connected.
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
DnsSuffix
@@ -1996,6 +2035,8 @@ The XML below is the current version for this CSP.
-- AES128
-- AES192
-- AES256
+ -- AES_GCM_128
+ -- AES_GCM_256
@@ -2180,7 +2221,7 @@ The XML below is the current version for this CSP.
-
+ com.microsoft/1.3/MDM/VPNv2
@@ -4087,6 +4128,8 @@ The XML below is the current version for this CSP.
-- AES128
-- AES192
-- AES256
+ -- AES_GCM_128
+ -- AES_GCM_256
@@ -4255,14 +4298,4 @@ The XML below is the current version for this CSP.
-```
-
-
-
-
-
-
-
-
-
-
+```
\ No newline at end of file
diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md
index b4b671369b..665ae99cae 100644
--- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md
+++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md
@@ -12,6 +12,9 @@ ms.date: 06/19/2017
# WindowsAdvancedThreatProtection CSP
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
The Windows Defender Advanced Threat Protection (WDATP) configuration service provider (CSP) allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP.
The following diagram shows the WDATP configuration service provider in tree format as used by the Open Mobile Alliance (OMA) Device Management (DM).
diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md
index 00afc29c8a..196883556d 100644
--- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md
+++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md
@@ -12,6 +12,9 @@ ms.date: 06/19/2017
# WindowsAdvancedThreatProtection DDF file
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
This topic shows the OMA DM device description framework (DDF) for the **WindowsAdvancedThreatProtection** configuration service provider. DDF files are used only with OMA DM provisioning XML.
You can download the DDF files from the links below:
diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
index 871ff7e560..41e39dc306 100644
--- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
+++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md
@@ -7,40 +7,31 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
localizationpriority: high
-author: brianlic-msft
-ms.author: brianlic
+author: eross-msft
+ms.author: lizross
---
# Windows 10, version 1703 basic level Windows diagnostic events and fields
-
**Applies to**
-- Windows 10, version 1703
+- Windows 10, version 1703 and later
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. The Basic level also helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
-The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information.
-
-The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
-
-Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data.
-
-You can learn more about Windows functional and diagnostic data through these articles:
-
+Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles:
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
- [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md)
-
-
+>[!Note]
+>Updated July 2017 to document new and modified events. We’ve added new fields to several Appraiser events to prepare for upgrades to the next release of Windows and we’ve added a brand-new event, Census.Speech, to collect basic details about speech settings and configuration.
## Common data extensions
### Common Data Extensions.App
-
-
The following fields are available:
- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
@@ -51,8 +42,6 @@ The following fields are available:
### Common Data Extensions.CS
-
-
The following fields are available:
- **sig** A common schema signature that identifies new and modified event schemas.
@@ -60,8 +49,6 @@ The following fields are available:
### Common Data Extensions.CUET
-
-
The following fields are available:
- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
@@ -258,8 +245,23 @@ This event lists the types of objects and how many of each exist on the client d
The following fields are available:
+- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. on this device.
+- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
+- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
@@ -274,6 +276,7 @@ The following fields are available:
- **SystemWim** The total SystemWim objects that are present on this device
- **SystemTouch** The total SystemTouch objects that are present on this device.
- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureIdHashSha256
@@ -282,6 +285,21 @@ This event lists the types of objects and the hashed values of all the identifie
The following fields are available:
+- **DatasourceApplicationFile_RS3** The total DatasourceApplicationFile objects targeting the next release of Windows on this device.
+- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
- **InventoryApplicationFile** The SHA256 hash of InventoryApplicationFile objects that are present on this device.
- **InventoryMediaCenter** The SHA256 hash of InventoryMediaCenter objects that are present on this device.
@@ -298,6 +316,7 @@ The following fields are available:
- **SystemWim** The SHA256 hash of SystemWim objects that are present on this device.
- **SystemTouch** The SHA256 hash of SystemTouch objects that are present on this device.
- **SystemWindowsActivationStatus** The SHA256 hash of SystemWindowsActivationStatus objects that are present on this device.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
@@ -1617,15 +1636,15 @@ This event is used to gather basic speech settings on the device.
The following fields are available:
-- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
-- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
-- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
-- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
-- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
-- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
-- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
-- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
-- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
+- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
+- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
+- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
+- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
+- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
+- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
+- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities.
+- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
+- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
### Census.Storage
diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md
index 789b57b03a..d479183398 100644
--- a/windows/configuration/change-history-for-configure-windows-10.md
+++ b/windows/configuration/change-history-for-configure-windows-10.md
@@ -14,6 +14,11 @@ author: jdeckerms
This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile.
+## July 2017
+| New or changed topic | Description |
+| --- | --- |
+|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)|Updated several Appraiser events and added Census.Speech.
+
## June 2017
| New or changed topic | Description |
diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md
index 26766b5852..27a5ebe9be 100644
--- a/windows/deployment/TOC.md
+++ b/windows/deployment/TOC.md
@@ -9,7 +9,6 @@
### [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
### [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md)
-
### [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md)
#### [Upgrade Readiness architecture](upgrade/upgrade-readiness-architecture.md)
#### [Upgrade Readiness requirements](upgrade/upgrade-readiness-requirements.md)
@@ -70,9 +69,6 @@
#### [Change history for Plan for Windows 10 deployment](planning/change-history-for-plan-for-windows-10-deployment.md)
-
-
-
### [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md)
#### [Get started with the Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md)
##### [Key features in MDT](deploy-windows-mdt/key-features-in-mdt.md)
@@ -94,8 +90,6 @@
##### [Use web services in MDT](deploy-windows-mdt/use-web-services-in-mdt.md)
##### [Use Orchestrator runbooks with MDT](deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md)
-
-
### [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md)
#### [Integrate Configuration Manager with MDT](deploy-windows-mdt/integrate-configuration-manager-with-mdt.md)
#### [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
@@ -111,11 +105,9 @@
#### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
#### [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md)
+### [Windows 10 deployment tools](windows-10-deployment-tools.md)
-
-
-### [Windows 10 deployment tools](windows-10-deployment-tools-reference.md)
-
+#### [Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md)
#### [Convert MBR partition to GPT](mbr-to-gpt.md)
#### [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md)
#### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md)
@@ -241,8 +233,4 @@
#### [Windows Insider Program for Business Frequently Asked Questions](update/waas-windows-insider-for-business-faq.md)
### [Change history for Update Windows 10](update/change-history-for-update-windows-10.md)
-
-
-
## [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md)
-
diff --git a/windows/deployment/add-store-apps-to-image.md b/windows/deployment/add-store-apps-to-image.md
new file mode 100644
index 0000000000..ca1d3c293d
--- /dev/null
+++ b/windows/deployment/add-store-apps-to-image.md
@@ -0,0 +1,83 @@
+---
+title: Add Microsoft Store for Business applications to a Windows 10 image
+description: This topic describes how to add Microsoft Store for Business applications to a Windows 10 image.
+keywords: upgrade, update, windows, windows 10, deploy, store, image, wim
+ms.prod: w10
+ms.mktglfcycl: deploy
+localizationpriority: high
+ms.sitesec: library
+ms.pagetype: deploy
+author: DaniHalfin
+ms.author: daniha
+ms.date: 07/07/2017
+---
+
+# Add Microsoft Store for Business applications to a Windows 10 image
+
+**Applies to**
+
+- Windows 10
+
+This topic describes the correct way to add Microsoft Store for Business applications to a Windows 10 image. This will enable you to deploy Windows 10 with pre-installed Microsoft Store for Business apps.
+
+>[!IMPORTANT]
+>In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment.
+
+## Prerequisites
+
+* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) for the tools required to mount and edit Windows images.
+
+* Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](/store-for-business/distribute-offline-apps#download-an-offline-licensed-app).
+
+* A Windows Image. For instructions on image creation, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) or [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md).
+
+>[!NOTE]
+> If you'd like to add an internal LOB Microsoft Store application, please follow the instructions on **[Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)**.
+
+## Adding a Store application to your image
+
+On a machine where your image file is accessible:
+1. Open Windows PowerShell with administrator privileges.
+2. Mount the image. At the Windows PowerShell prompt, type:
+`Mount-WindowsImage -ImagePath c:\images\myimage.wim -Index 1 -Path C:\test`
+3. Use the Add-AppxProvisionedPackage cmdlet in Windows PowerShell to preinstall the app. Use the /PackagePath option to specify the location of the Store package and /LicensePath to specify the location of the license .xml file. In Windows PowerShell, type:
+`Add-AppxProvisionedPackage -Path C:\test -PackagePath C:\downloads\appxpackage -LicensePath C:\downloads\appxpackage\license.xml`
+
+>[!NOTE]
+>Paths and file names are examples. Use your paths and file names where appropriate.
+>
+>Do not dismount the image, as you will return to it later.
+
+## Editing the Start Layout
+
+In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment.
+
+On a test machine:
+1. **Install the Microsoft Store for Business application you previously added** to your image.
+2. **Pin these apps to the Start screen**, by typing the name of the app, right-clicking and selecting **Pin to Start**.
+3. Open Windows PowerShell with administrator privileges.
+4. Use `Export-StartLayout -path .xml` where ** is the path and name of the xml file your will later import into your Windows Image.
+5. Copy the XML file you created to a location accessible by the machine you previously used to add Store applications to your image.
+
+Now, on the machine where your image file is accessible:
+1. Import the Start layout. At the Windows PowerShell prompt, type:
+`Import-StartLayout -LayoutPath ".xml" -MountPath "C:\test\"`
+2. Save changes and dismount the image. At the Windows PowerShell prompt, type:
+`Dismount-WindowsImage -Path c:\test -Save`
+
+>[!NOTE]
+>Paths and file names are examples. Use your paths and file names where appropriate.
+>
+>For more information on Start customization see [Windows 10 Start Layout Customization](https://blogs.technet.microsoft.com/deploymentguys/2016/03/07/windows-10-start-layout-customization/)
+
+
+## Related topics
+* [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout)
+* [Export-StartLayout](https://technet.microsoft.com/itpro/powershell/windows/startlayout/export-startlayout)
+* [Import-StartLayout](https://technet.microsoft.com/itpro/powershell/windows/startlayout/import-startlayout)
+* [Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)
+* [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md)
+* [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md)
+* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md)
+
+
diff --git a/windows/deployment/change-history-for-deploy-windows-10.md b/windows/deployment/change-history-for-deploy-windows-10.md
index 7353568c47..c9b44a991f 100644
--- a/windows/deployment/change-history-for-deploy-windows-10.md
+++ b/windows/deployment/change-history-for-deploy-windows-10.md
@@ -12,6 +12,11 @@ ms.date: 06/28/2017
# Change history for Deploy Windows 10
This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](/windows/windows-10).
+## July 2017
+| New or changed topic | Description |
+|----------------------|-------------|
+| The table of contents for deployment topics was reorganized.
+
## June 2017
| New or changed topic | Description |
|----------------------|-------------|
diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md
index 0b33aa08b4..15b695c9ad 100644
--- a/windows/deployment/update/waas-restart.md
+++ b/windows/deployment/update/waas-restart.md
@@ -26,24 +26,24 @@ You can use Group Policy settings, mobile device management (MDM) or Registry (n
In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified instllation time.
-To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the instal**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installtion will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**).
+To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**).
**Always automatically restart at the scheduled time** forces a restart after the specified installation time and lets you configure a timer to warn a signed-in user that a restart is going to occur.
While not recommended, the same result can be achieved through Registry. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4**, set the install time with **ScheduledInstallTime**, enable **AlwaysAutoRebootAtScheduledTime** and specify the delay in minutes through **AlwaysAutoRebootAtScheduledTimeMinutes**. Similar to Group Policy, **AlwaysAutoRebootAtScheduledTimeMinutes** sets the timer to warn a signed-in user that a restart is going to occur.
-For a detailed description of these regsitry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart).
+For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart).
## Delay automatic reboot
-When **Configure Automatic Updates** is enabled in Group Policy, you can enable one of the following additional policies to delay an automatic reboot after update installtion:
+When **Configure Automatic Updates** is enabled in Group Policy, you can enable one of the following additional policies to delay an automatic reboot after update installation:
- **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours.
- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**.
You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting.
-For a detailed description of these regsitry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart).
+For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart).
## Configure active hours
@@ -57,7 +57,7 @@ Administrators can use multiple ways to set active hours for managed devices:
- You can use Group Policy, as described in the procedure that follows.
- You can use MDM, as described in [Configuring active hours with MDM](#configuring-active-hours-with-mdm).
-- While not recommended, you can also configure active hours, as descrbied in [Configuring active hours through Registry](#configuring-active-hours-through-registry).
+- While not recommended, you can also configure active hours, as described in [Configuring active hours through Registry](#configuring-active-hours-through-registry).
### Configuring active hours with Group Policy
@@ -77,7 +77,7 @@ Any settings configured through Registry may conflict with any existing configur
You should set a combination of the following registry values, in order to configure active hours.
Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate** use **SetActiveHours** to enable or disable active hours and **ActiveHoursStart**,**ActiveHoursEnd** to specify the range of active hours.
-For a detailed description of these regsitry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart).
+For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart).
>[!NOTE]
>To configure active hours manually on a single device, go to **Settings** > **Update & security** > **Windows Update** and select **Change active hours**.
@@ -94,7 +94,7 @@ To configure active hours max range through MDM, use [**Update/ActiveHoursMaxRan
## Limit restart delays
-After an update is installed, Windows 10 attemtps automatic restart outside of active hours. If the restart does not succeed after 7 days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from 7 days to a number of days between 2 and 14.
+After an update is installed, Windows 10 attempts automatic restart outside of active hours. If the restart does not succeed after 7 days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from 7 days to a number of days between 2 and 14.
## Control restart notifications
@@ -123,7 +123,7 @@ To do so through MDM, use [**Update/SetAutoRestartNotificationDisable**](https:/
### Scheduled auto-restart warnings
-Since users are not able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled a restart. You can also configure a configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work.
+Since users are not able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled restart. You can also configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work.
To configure both through Group Policy, find **Configure auto-restart warning notifications schedule for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The warning reminder can be configured by **Reminder (hours)** and the warning prior to an imminent auto-restart can be configured by **Warning (mins)**.
@@ -185,7 +185,7 @@ The following tables list registry values that correspond to the Group Policy se
There are 3 different registry combinations for controlling restart behavior:
- To set active hours, **SetActiveHours** should be **1**, while **ActiveHoursStart** and **ActiveHoursEnd** should define the time range.
-- To schedule a specific instllation and reboot time, **AUOptions** should be **4**, **ScheduledInstallTime** should specify the installation time, **AlwaysAutoRebootAtScheduledTime** set to **1** and **AlwaysAutoRebootAtScheduledTimeMinutes** should specify number of minutes to wait before rebooting.
+- To schedule a specific installation and reboot time, **AUOptions** should be **4**, **ScheduledInstallTime** should specify the installation time, **AlwaysAutoRebootAtScheduledTime** set to **1** and **AlwaysAutoRebootAtScheduledTimeMinutes** should specify number of minutes to wait before rebooting.
- To delay rebooting if a user is logged on, **AUOptions** should be **4**, while **NoAutoRebootWithLoggedOnUsers** is set to **1**.
## Related topics
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md
index 3fb9bda5d9..c42d403a33 100644
--- a/windows/deployment/upgrade/windows-10-edition-upgrades.md
+++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md
@@ -21,8 +21,8 @@ With Windows 10, you can quickly upgrade from one edition of Windows 10 to ano
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
X = unsupported
-✔ (green) = supported; reboot required
-✔ (blue) = supported; no reboot required.
+✔ (green) = supported; reboot required
+✔ (blue) = supported; no reboot required
|Method |Home > Pro |Home > Education |Pro > Education |Pro > Enterprise |Ent > Education |Mobile > Mobile Enterprise |
diff --git a/windows/deployment/windows-10-auto-pilot.md b/windows/deployment/windows-10-auto-pilot.md
index 7413ecc71c..adf60da2d7 100644
--- a/windows/deployment/windows-10-auto-pilot.md
+++ b/windows/deployment/windows-10-auto-pilot.md
@@ -1,6 +1,6 @@
---
title: Overview of Windows AutoPilot
-description: This topic goes over Auto-Pilot and how it helps setup OOBE Windows 10 devices.
+description: This topic goes over Windows AutoPilot and how it helps setup OOBE Windows 10 devices.
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
ms.prod: w10
ms.mktglfcycl: deploy
@@ -19,21 +19,21 @@ ms.date: 06/30/2017
- Windows 10
Windows AutoPilot is a collection of technologies used to setup and pre-configure new devices, getting them ready for productive use. In addition, you can use Windows AutoPilot to reset, repurpose and recover devices.
-This solution enables the IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
+This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
## Benefits of Windows AutoPilot
-Traditionally, IT Pros spend a lot of time on building and customizing images that will later be deployed to devices with a perfectly good OS already installed on them. Windows AutoPilot introduces a new approach.
+Traditionally, IT pros spend a lot of time on building and customizing images that will later be deployed to devices with a perfectly good OS already installed on them. Windows AutoPilot introduces a new approach.
From the users' perspective, it only takes a few simple operations to make their device ready to use.
-From the IT Pros' perspective, the only interaction required from the end-user, is to connect to a network and to verify their credentials. Everything past that is automated.
+From the IT pros' perspective, the only interaction required from the end user, is to connect to a network and to verify their credentials. Everything past that is automated.
Windows AutoPilot allows you to:
-* Automatically join devices to Azure Active Directory
-* Auto-enroll devices into MDM services, such as Intune ([*Requires an Azure AD Premium subscription*](#prerequisites))
+* Automatically join devices to Azure Active Directory (Azure AD)
+* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription*](#prerequisites))
* Restrict the Administrator account creation
-* Create and auto-assign devices to configuration groups based on the devices' profile
+* Create and auto-assign devices to configuration groups based on a device's profile
* Customize OOBE content specific to the organization
### Prerequisites
@@ -41,7 +41,7 @@ Windows AutoPilot allows you to:
* [Devices must be registered to the organization](#registering-devices-to-your-organization)
* Devices have to be pre-installed with Windows 10, version 1703 or later
* Devices must have access to the internet
-* [Azure AD premium P1 or P2](https://www.microsoft.com/cloud-platform/azure-active-directory-features)
+* [Azure AD Premium P1 or P2](https://www.microsoft.com/cloud-platform/azure-active-directory-features)
* Microsoft Intune or other MDM services to manage your devices
## Windows AutoPilot Scenarios
@@ -55,9 +55,9 @@ The Cloud-Driven scenario enables you to pre-register devices through the Window
The end user unboxes and turns on a new device. What follows are a few simple configuration steps:
* Select a language and keyboard layout
* Connect to the network
-* Provide email address (the email of the user's Azure Active Directory account) and password
+* Provide email address (the email address of the user's Azure AD account) and password
-Multiple additional settings are skipped here, since the device automatically recognizes that [it belongs to an organization](#registering-devices-to-your-organization). Following this process the device is joined to Azure Active Directory, enrolled in Microsoft Intune (or any other MDM service).
+Multiple additional settings are skipped here, since the device automatically recognizes that [it belongs to an organization](#registering-devices-to-your-organization). Following this process the device is joined to Azure AD, enrolled in Microsoft Intune (or any other MDM service).
MDM enrollment ensures policies are applied, apps are installed and setting are configured on the device. Windows Update for Business applies the latest updates to ensure the device is up to date.
@@ -68,19 +68,15 @@ MDM enrollment ensures policies are applied, apps are installed and setting are
In order to register devices, you will need to acquire their hardware ID and register it. We are actively working with various hardware vendors to enable them to provide the required information to you, or upload it on your behalf.
-If you would like to capture that information by yourself, the following PowerShell script will generate a text file with the device's hardware ID.
+If you would like to capture that information by yourself, you can use the [Get-WindowsAutoPilotInfo PowerShell script](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo), which will generate a .csv file with the device's hardware ID.
-```PowerShell
-$wmi = Get-WMIObject -Namespace root/cimv2/mdm/dmmap -Class MDM_DevDetail_Ext01 -Filter "InstanceID='Ext' AND ParentID='./DevDetail'"
-$wmi.DeviceHardwareData | Out-File "$($env:COMPUTERNAME).txt"
-```
>[!NOTE]
->This PowerShell script requires elevated permissions. The output format might not fit the upload method. Check out the Microsoft Store for Business or [Partner Center](https://msdn.microsoft.com/partner-center/autopilot) for additional guidance.
+>This PowerShell script requires elevated permissions.
By uploading this information to the Microsoft Store for Business or Partner Center admin portal, you'll be able to assign devices to your organization.
Additional options and customization is available through these portals to pre-configure the devices.
-Options available for Windows 10, Version 1703:
+Options available for Windows 10, version 1703:
* Skipping Work or Home usage selection (*Automatic*)
* Skipping OEM registration, OneDrive and Cortana (*Automatic*)
* Skipping privacy settings
@@ -88,19 +84,19 @@ Options available for Windows 10, Version 1703:
We are working to add additional options to further personalize and streamline the setup experience in future releases.
-To see additional details on how to customize the OOBE experience and how to follow this process, see guidance for Microsoft Store for Business or [Partner Center](https://msdn.microsoft.com/partner-center/autopilot).
+To see additional details on how to customize the OOBE experience and how to follow this process, see guidance for [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices) or [Partner Center](https://msdn.microsoft.com/partner-center/autopilot).
### IT-Driven
-If you are planning to use to configure these devices with traditional on-premises or cloud-based solutions, the [Windows Configuration Designer](https://www.microsoft.com/store/p/windows-configuration-designer/9nblggh4tx22) can be used to help automate the process. This is more suited to scenarios in which you require a higher level of control over the provisioning process. For more information on creating provisioning packages with WCD, see [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
+If you are planning to use to configure these devices with traditional on-premises or cloud-based solutions, the [Windows Configuration Designer](https://www.microsoft.com/store/p/windows-configuration-designer/9nblggh4tx22) can be used to help automate the process. This is more suited to scenarios in which you require a higher level of control over the provisioning process. For more information on creating provisioning packages with Windows Configuration Designer, see [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
### Teacher-Driven
-If you're an IT Pro or a technical staff member at a school, your scenario might be simpler. The [Set Up School PCs](http://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) app can be used to quickly set up PCs for students and will get you to a productive state faster and simpler. Please see [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app) for all the details.
+If you're an IT pro or a technical staff member at a school, your scenario might be simpler. The [Set Up School PCs](http://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) app can be used to quickly set up PCs for students and will get you to a productive state faster and simpler. Please see [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app) for all the details.
## Ensuring your device can be auto-enrolled to MDM
-In order for your devices to be auto-enrolled into MDM management, MDM auto-enrollment needs to be configured in Azure AD. To do that with Intune, please follow [Enroll Windows devices for Microsoft Intune](https://docs.microsoft.com/intune/windows-enroll). For other MDM vendors, please consult your vendor for further details.
+In order for your devices to be auto-enrolled into MDM management, MDM auto-enrollment needs to be configured in Azure AD. To do that with Intune, please see [Enroll Windows devices for Microsoft Intune](https://docs.microsoft.com/intune/windows-enroll). For other MDM vendors, please consult your vendor for further details.
>[!NOTE]
->MDM Auto-enrollment requires an Azure AD Premium P1 or P2 subscription.
\ No newline at end of file
+>MDM auto-enrollment requires an Azure AD Premium P1 or P2 subscription.
diff --git a/windows/deployment/windows-10-deployment-tools-reference.md b/windows/deployment/windows-10-deployment-tools-reference.md
index 2a08717439..d6f852cae5 100644
--- a/windows/deployment/windows-10-deployment-tools-reference.md
+++ b/windows/deployment/windows-10-deployment-tools-reference.md
@@ -10,50 +10,14 @@ author: greg-lindsay
# Windows 10 deployment tools
-
Learn about the tools available to deploy Windows 10.
-## In this section
-
-
-
-
-
-
-
-
-
-
-
-
-[Windows 10 deployment tools reference](windows-deployment-scenarios-and-tools.md) |
-To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
-
-
-[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |
-The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
-
-
-[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |
-The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
-
-
-[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |
-The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. |
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+|Topic |Description |
+|------|------------|
+|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
+|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. |
+|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
+|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
+|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
+|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
+|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
diff --git a/windows/deployment/windows-10-deployment-tools.md b/windows/deployment/windows-10-deployment-tools.md
new file mode 100644
index 0000000000..d6f852cae5
--- /dev/null
+++ b/windows/deployment/windows-10-deployment-tools.md
@@ -0,0 +1,23 @@
+---
+title: Windows 10 deployment tools (Windows 10)
+description: Learn about the tools available to deploy Windows 10.
+ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: greg-lindsay
+---
+
+# Windows 10 deployment tools
+
+Learn about the tools available to deploy Windows 10.
+
+|Topic |Description |
+|------|------------|
+|[Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) |To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. |
+|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. |
+|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. |
+|[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. |
+|[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. |
+|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. |
+|[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals |
diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md
index d1fe29aa6f..8290d3383d 100644
--- a/windows/deployment/windows-deployment-scenarios-and-tools.md
+++ b/windows/deployment/windows-deployment-scenarios-and-tools.md
@@ -9,7 +9,7 @@ ms.sitesec: library
author: mtniehaus
---
-# Windows 10 deployment tools reference
+# Windows 10 deployment scenarios and tools
To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment.
diff --git a/windows/device-security/applocker/delete-an-applocker-rule.md b/windows/device-security/applocker/delete-an-applocker-rule.md
index 3d4888fb73..4f50ad433f 100644
--- a/windows/device-security/applocker/delete-an-applocker-rule.md
+++ b/windows/device-security/applocker/delete-an-applocker-rule.md
@@ -32,3 +32,23 @@ AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins
>**Note:** When using Group Policy, for the rule deletion to take effect on computers within the domain, the GPO must be distributed or refreshed.
When this procedure is performed on the local device, the AppLocker policy takes effect immediately.
+
+**To clear AppLocker policies on a single system or remote systems**
+Use the Set-AppLockerPolicy cmdlet with the -XMLPolicy parameter, using an .XML file that contains the following contents:
+
+
+
+
+
+
+
+
+To use the Set-AppLockerPolicy cmdlet, first import the Applocker modules:
+
+ PS C:\Users\Administrator> import-module AppLocker
+
+We will create a file (for example, clear.xml), place it in the same directory where we are executing our cmdlet, and add the preceding XML contents. Then run the following command:
+
+ C:\Users\Administrator> Set-AppLockerPolicy -XMLPolicy .\clear.xml
+
+This will remove all AppLocker Policies on a machine and could be potentially scripted to use on multiple machines using remote execution tools with accounts with proper access.
diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md
index 9714c77347..fd9171827c 100644
--- a/windows/threat-protection/TOC.md
+++ b/windows/threat-protection/TOC.md
@@ -82,9 +82,15 @@
## [Windows Defender Antivirus in Windows 10](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
### [Windows Defender AV in the Windows Defender Security Center app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
-### [Windows Defender Antivirus on Windows Server](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md)
-### [Windows Defender Antivirus and Advanced Threat Protection: Better together](windows-defender-antivirus\windows-defender-antivirus-compatibility.md)
+
+### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md)
+
+### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md)
+
+
### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md)
+
+
### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md)
#### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md)
##### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md)
@@ -95,6 +101,8 @@
##### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md)
##### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md)
##### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
+
+
### [Configure Windows Defender Antivirus features](windows-defender-antivirus\configure-windows-defender-antivirus-features.md)
#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md)
@@ -109,6 +117,8 @@
##### [Configure the notifications that appear on endpoints](windows-defender-antivirus\configure-notifications-windows-defender-antivirus.md)
##### [Prevent users from seeing or interacting with the user interface](windows-defender-antivirus\prevent-end-user-interaction-windows-defender-antivirus.md)
##### [Prevent or allow users to locally modify policy settings](windows-defender-antivirus\configure-local-policy-overrides-windows-defender-antivirus.md)
+
+
### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md)
#### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md)
##### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md)
@@ -120,19 +130,26 @@
#### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md)
#### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md)
#### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md)
+
+
### [Review event logs and error codes to troubleshoot issues](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md)
+
+
+
### [Reference topics for management and configuration tools](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md)
#### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md)
#### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md)
#### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md)
#### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md)
#### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md)
+
## [Windows Defender SmartScreen](windows-defender-smartscreen\windows-defender-smartscreen-overview.md)
### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen\windows-defender-smartscreen-available-settings.md)
### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen\windows-defender-smartscreen-set-individual-device.md)
+
## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md)
### [Create a Windows Information Protection (WIP) policy](windows-information-protection\overview-create-wip-policy.md)
-#### [Create a Windows Information Protection (WIP) using the classic console for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune.md)
+#### [Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune.md)
##### [Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](windows-information-protection\deploy-wip-policy-using-intune.md)
##### [Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune.md)
#### [Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune-azure.md)
@@ -150,10 +167,17 @@
#### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](windows-information-protection\app-behavior-with-wip.md)
#### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](windows-information-protection\recommended-network-definitions-for-wip.md)
#### [Using Outlook Web Access with Windows Information Protection (WIP)](windows-information-protection\using-owa-with-wip.md)
+
## [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md)
+
## [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md)
+
## [How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md)
-## [Secure the windows 10 boot process](secure-the-windows-10-boot-process.md)
+
+## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)
+
## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md)
+
## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md)
-## [Change history for Threat Protection](change-history-for-threat-protection.md)
\ No newline at end of file
+
+## [Change history for Threat Protection](change-history-for-threat-protection.md)
diff --git a/windows/threat-protection/change-history-for-threat-protection.md b/windows/threat-protection/change-history-for-threat-protection.md
index ee84b688ce..f89c5ecee5 100644
--- a/windows/threat-protection/change-history-for-threat-protection.md
+++ b/windows/threat-protection/change-history-for-threat-protection.md
@@ -14,18 +14,18 @@ This topic lists new and updated topics in the [Threat protection](index.md) doc
## June 2017
|New or changed topic |Description |
|---------------------|------------|
-| [How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) | New |
+|[How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) | New |
|[Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
-[Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune](windows-information-protection\deploy-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
-[Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
+|[Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune](windows-information-protection\deploy-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
+|[Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune](windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
|[List of enlightened Microsoft apps for use with Windows Information Protection (WIP)](windows-information-protection\enlightened-microsoft-apps-and-wip.md)|Updated to include newly enlightened and supported apps.|
-[Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)| Updated from existing applicable and relevant Windows 8.1 content |
+|[Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)| Updated from existing applicable and relevant Windows 8.1 content |
## March 2017
|New or changed topic |Description |
|---------------------|------------|
-||[How to collect Windows Information Protection (WIP) audit event logs](windows-information-protection\collect-wip-audit-event-logs.md) |New |
+|[How to collect Windows Information Protection (WIP) audit event logs](windows-information-protection\collect-wip-audit-event-logs.md) |New |
|[Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](windows-information-protection\mandatory-settings-for-wip.md) |Updated based on Windows 10, version 1703. |
|[Limitations while using Windows Information Protection (WIP)](windows-information-protection\limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703.|
|[Windows Defender SmartScreen overview](windows-defender-smartscreen\windows-defender-smartscreen-overview.md)|New |
diff --git a/windows/threat-protection/index.md b/windows/threat-protection/index.md
index 77a4201aad..885e4d9279 100644
--- a/windows/threat-protection/index.md
+++ b/windows/threat-protection/index.md
@@ -14,11 +14,14 @@ Learn more about how to help protect against threats in Windows 10 and Windows
| Section | Description |
|-|-|
-| [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) | Learn more about mitigating threats in Windows 10. |
-| [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. |
-| [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md)| Provides information about Windows Defender Advanced Threat Protection (Windows Defender ATP), an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.|
-| [Windows Defender Antivirus](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)| Provides information about Windows Defender, a built-in antimalware solution that helps provide security and antimalware management for desktops, portable computers, and servers. Includes a list of system requirements and new features.|
-|[Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection/protect-enterprise-data-using-wip.md)|Learn more about how to help protect against potential corporate data leakage. |
-| [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) | Learn more about Windows Defender SmartScreen. |
-| [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. |
-| [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. |
+|[Windows Defender Security Center](windows-defender-security-center/windows-defender-security-center.md)|Learn about the easy-to-use app that brings together common Windows security features.|
+|[Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md)|Provides info about Windows Defender Advanced Threat Protection (Windows Defender ATP), an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.|
+|[Windows Defender Antivirus in Windows 10](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)|Provides info about Windows Defender, a built-in antimalware solution that helps provide security and antimalware management for desktops, portable computers, and servers. Includes a list of system requirements and new features.|
+|[Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) |Learn more about Windows Defender SmartScreen.|
+|[Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection/protect-enterprise-data-using-wip.md)|Provides info about how to create a Windows Information Protection policy that can help protect against potential corporate data leakage.|
+|[Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) |Learn more about mitigating threats in Windows 10.|
+|[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies.|
+|[How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) |Learn about how hardware-based containers can isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.|
+|[Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) |Learn about the Windows 10 security features that help to protect your PC from malware, including rootkits and other applications.|
+|[Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) |Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. |
+|[Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) |Provides info about how to help protect your company from attacks which may originate from untrusted or attacker controlled font files. |
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
index db1498b7bd..eaaccf94c2 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
@@ -10,14 +10,17 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
author: iaanw
+ms.author: iawilt
+ms.date: 06/13/2017
---
-# Configure and validate file, folder, and process-opened file exclusions in Windows Defender AV scans
+# Configure and validate exclusions for Windows Defender AV scans (client)
**Applies to:**
- Windows 10
+- Windows Server 2016
**Audience**
@@ -39,6 +42,8 @@ The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defen
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization.
+Windows Server 2016 also features automatic exclusions that are defined by the server roles you enable. See the [Windows Defender AV exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) topic for more information and a list of the automatic exclusions.
+
>[!WARNING]
>Defining exclusions lowers the protection offered by Windows Defender AV. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
index 3d78deccde..193a5043bf 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
@@ -10,6 +10,8 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
author: iaanw
+ms.author: iawilt
+ms.date: 06/13/2017
---
# Configure and validate exclusions based on file extension and folder location
@@ -18,6 +20,7 @@ author: iaanw
**Applies to:**
- Windows 10
+- Windows Server 2016
**Audience**
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
index 50dbbe12a6..7e45146ca4 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
@@ -10,6 +10,8 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
author: iaanw
+ms.author: iawilt
+ms.date: 06/13/2017
---
# Configure exclusions for files opened by processes
@@ -17,6 +19,7 @@ author: iaanw
**Applies to:**
- Windows 10
+- Windows Server 2016
**Audience**
diff --git a/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
index c293dd3358..6302c7bd01 100644
--- a/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
@@ -10,9 +10,11 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
author: iaanw
+ms.author: iawilt
+ms.date: 06/13/2017
---
-# Configure exclusions in Windows Defender AV on Windows Server 2016
+# Configure exclusions in Windows Defender AV on Windows Server
**Applies to:**
@@ -30,14 +32,28 @@ author: iaanw
- PowerShell
- Windows Management Instrumentation (WMI)
-If you are using Windows Defender Antivirus to protect Windows Server 2016 machines, you are [automatically enrolled in certain exclusions](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender), as defined by your specified Windows Server Role.
+If you are using Windows Defender Antivirus to protect Windows Server 2016 machines, you are automatically enrolled in certain exclusions, as defined by your specified Windows Server Role. A list of these exclusions is provided at [the end of this topic](#list-of-automatic-exclusions).
These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
-You can still add or remove custom exclusions (in addition to the Server Role-defined auto exclusions) as described in the other exclusion-related topics:
+You can still add or remove custom exclusions (in addition to the Server Role-defined automatic exclusions) as described in the other exclusion-related topics:
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
+Custom exclusions take precedence over the automatic exclusions.
+
+> [!TIP]
+> Custom and duplicate exclusions do not conflict with automatic exclusions.
+
+Windows Defender AV uses the Deployment Image Servicing and Management (DSIM) tools to determine which roles are installed on your computer.
+
+
+## Opt out of automatic exclusions
+
+In Windows Server 2016 the predefined exclusions delivered by definition updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, you need to opt-out of the automatic exclusions delivered in definition updates.
+
+> [!WARNING]
+> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 roles.
You can disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI.
@@ -58,7 +74,7 @@ You can disable the auto-exclusions lists with Group Policy, PowerShell cmdlets,
Use the following cmdlets:
```PowerShell
-Set-MpPreference -DisableAutoExclusions
+Set-MpPreference -DisableAutoExclusions $true
```
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
@@ -75,9 +91,312 @@ See the following for more information and allowed parameters:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
+
+
+
+## List of automatic exclusions
+The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types.
+
+### Default exclusions for all roles
+This section lists the default exclusions for all Windows Server 2016 roles.
+
+- Windows "temp.edb" files:
+
+ - *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb
+
+ - *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log
+
+- Windows Update files or Automatic Update files:
+
+ - *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb
+
+ - *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk
+
+ - *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log
+
+ - *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs
+
+ - *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log
+
+- Windows Security files:
+
+ - *%windir%*\Security\database\\*.chk
+
+ - *%windir%*\Security\database\\*.edb
+
+ - *%windir%*\Security\database\\*.jrs
+
+ - *%windir%*\Security\database\\*.log
+
+ - *%windir%*\Security\database\\*.sdb
+
+- Group Policy files:
+
+ - *%allusersprofile%*\NTUser.pol
+
+ - *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol
+
+ - *%SystemRoot%*\System32\GroupPolicy\User\registry.pol
+
+- WINS files:
+
+ - *%systemroot%*\System32\Wins\\*\\\*.chk
+
+ - *%systemroot%*\System32\Wins\\*\\\*.log
+
+ - *%systemroot%*\System32\Wins\\*\\\*.mdb
+
+ - *%systemroot%*\System32\LogFiles\
+
+ - *%systemroot%*\SysWow64\LogFiles\
+
+- File Replication Service (FRS) exclusions:
+
+ - Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory`
+
+ - *%windir%*\Ntfrs\jet\sys\\*\edb.chk
+
+ - *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb
+
+ - *%windir%*\Ntfrs\jet\log\\*\\\*.log
+
+ - FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory`
+
+ - *%windir%*\Ntfrs\\*\Edb\*.log
+
+ - The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage`
+
+ - *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\
+
+ - The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory`
+
+ - *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\
+
+ - The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File`
+
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_normal$
+
+ - *%systemdrive%*\System Volume Information\DFSR\FileIDTable_*
+
+ - *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_*
+
+ - *%systemdrive%*\System Volume Information\DFSR\\*.XML
+
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$
+
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_clean$
+
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$
+
+ - *%systemdrive%*\System Volume Information\DFSR\Dfsr.db
+
+ - *%systemdrive%*\System Volume Information\DFSR\\*.frx
+
+ - *%systemdrive%*\System Volume Information\DFSR\\*.log
+
+ - *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs
+
+ - *%systemdrive%*\System Volume Information\DFSR\Tmp.edb
+
+- Process exclusions
+
+ - *%systemroot%*\System32\dfsr.exe
+
+ - *%systemroot%*\System32\dfsrs.exe
+
+- Hyper-V exclusions:
+
+ - This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role
+
+ - File type exclusions:
+
+ - *.vhd
+
+ - *.vhdx
+
+ - *.avhd
+
+ - *.avhdx
+
+ - *.vsv
+
+ - *.iso
+
+ - *.rct
+
+ - *.vmcx
+
+ - *.vmrs
+
+ - Folder exclusions:
+
+ - *%ProgramData%*\Microsoft\Windows\Hyper-V
+
+ - *%ProgramFiles%*\Hyper-V
+
+ - *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots
+
+ - *%Public%*\Documents\Hyper-V\Virtual Hard Disks
+
+ - Process exclusions:
+
+ - *%systemroot%*\System32\Vmms.exe
+
+ - *%systemroot%*\System32\Vmwp.exe
+
+- SYSVOL files:
+
+ - *%systemroot%*\Sysvol\Domain\\*.adm
+
+ - *%systemroot%*\Sysvol\Domain\\*.admx
+
+ - *%systemroot%*\Sysvol\Domain\\*.adml
+
+ - *%systemroot%*\Sysvol\Domain\Registry.pol
+
+ - *%systemroot%*\Sysvol\Domain\\*.aas
+
+ - *%systemroot%*\Sysvol\Domain\\*.inf
+
+ - *%systemroot%*\Sysvol\Domain\\*.Scripts.ini
+
+ - *%systemroot%*\Sysvol\Domain\\*.ins
+
+ - *%systemroot%*\Sysvol\Domain\Oscfilter.ini
+
+### Active Directory exclusions
+This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services.
+
+- NTDS database files. The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File`
+
+ - %windir%\Ntds\ntds.dit
+
+ - %windir%\Ntds\ntds.pat
+
+- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files`
+
+ - %windir%\Ntds\EDB*.log
+
+ - %windir%\Ntds\Res*.log
+
+ - %windir%\Ntds\Edb*.jrs
+
+ - %windir%\Ntds\Ntds*.pat
+
+ - %windir%\Ntds\EDB*.log
+
+ - %windir%\Ntds\TEMP.edb
+
+- The NTDS working folder. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory`
+
+ - %windir%\Ntds\Temp.edb
+
+ - %windir%\Ntds\Edb.chk
+
+- Process exclusions for AD DS and AD DS-related support files:
+
+ - %systemroot%\System32\ntfrs.exe
+
+ - %systemroot%\System32\lsass.exe
+
+### DHCP Server exclusions
+This section lists the exclusions that are delivered automatically when you install the DHCP Server role. The DHCP Server file locations are specified by the *DatabasePath*, *DhcpLogFilePath*, and *BackupDatabasePath* parameters in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters`
+
+- *%systemroot%*\System32\DHCP\\*\\\*.mdb
+
+- *%systemroot%*\System32\DHCP\\*\\\*.pat
+
+- *%systemroot%*\System32\DHCP\\*\\\*.log
+
+- *%systemroot%*\System32\DHCP\\*\\\*.chk
+
+- *%systemroot%*\System32\DHCP\\*\\\*.edb
+
+### DNS Server exclusions
+This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role.
+
+- File and folder exclusions for the DNS Server role:
+
+ - *%systemroot%*\System32\Dns\\*\\\*.log
+
+ - *%systemroot%*\System32\Dns\\*\\\*.dns
+
+ - *%systemroot%*\System32\Dns\\*\\\*.scc
+
+ - *%systemroot%*\System32\Dns\\*\BOOT
+
+- Process exclusions for the DNS Server role:
+
+ - *%systemroot%*\System32\dns.exe
+
+
+
+### File and Storage Services exclusions
+This section lists the file and folder exclusions that are delivered automatically when you install the File and Storage Services role. The exclusions listed below do not include exclusions for the Clustering role.
+
+- *%SystemDrive%*\ClusterStorage
+
+- *%clusterserviceaccount%*\Local Settings\Temp
+
+- *%SystemDrive%*\mscs
+
+### Print Server exclusions
+This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role.
+
+- File type exclusions:
+
+ - *.shd
+
+ - *.spl
+
+- Folder exclusions. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory`
+
+ - *%system32%*\spool\printers\\*
+
+- Process exclusions:
+
+ - spoolsv.exe
+
+### Web Server exclusions
+This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role.
+
+- Folder exclusions:
+
+ - *%SystemRoot%*\IIS Temporary Compressed Files
+
+ - *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files
+
+ - *%SystemDrive%*\inetpub\temp\ASP Compiled Templates
+
+ - *%systemDrive%*\inetpub\logs
+
+ - *%systemDrive%*\inetpub\wwwroot
+
+- Process exclusions:
+
+ - *%SystemRoot%*\system32\inetsrv\w3wp.exe
+
+ - *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe
+
+ - *%SystemDrive%*\PHP5433\php-cgi.exe
+
+### Windows Server Update Services exclusions
+This section lists the folder exclusions that are delivered automatically when you install the Windows Server Update Services (WSUS) role. The WSUS folder is specified in the registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup`
+
+- *%systemroot%*\WSUS\WSUSContent
+
+- *%systemroot%*\WSUS\UpdateServicesDBFiles
+
+- *%systemroot%*\SoftwareDistribution\Datastore
+
+- *%systemroot%*\SoftwareDistribution\Download
+
+
+
+
## Related topics
-- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
+- [Configure and validate exclusions for Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
diff --git a/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
index 4e7c275117..ed872bc01d 100644
--- a/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
+++ b/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
@@ -10,6 +10,8 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
author: iaanw
+ms.author: iawilt
+ms.date: 06/13/2017
---
# Review event logs and error codes to troubleshoot issues with Windows Defender AV
@@ -17,6 +19,7 @@ author: iaanw
**Applies to**
- Windows 10
+- Windows Server 2016
**Audience**
@@ -27,55 +30,58 @@ If you encounter a problem with Windows Defender Antivirus, you can search the t
The tables list:
-- [Windows Defender AV client event IDs](#windows-defender-av-ids)
+- [Windows Defender AV event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016)
- [Windows Defender AV client error codes](#error-codes)
- [Internal Windows Defender AV client error codes (used by Microsoft during development and testing)](#internal-error-codes)
-## Windows Defender AV client event IDs
+## Windows Defender AV event IDs
Windows Defender AV records event IDs in the Windows event log.
You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client event IDs](troubleshoot-windows-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints.
-The table in this section lists the main Windows Defender Antivirus client event IDs and, where possible, provides suggested solutions to fix or resolve the error.
+The table in this section lists the main Windows Defender AV event IDs and, where possible, provides suggested solutions to fix or resolve the error.
-**To view a Windows Defender client event**
+**To view a Windows Defender AV event**
1. Open **Event Viewer**.
-2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**.
+2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender Antivirus**.
3. Double-click on **Operational**.
4. In the details pane, view the list of individual events to find your event.
5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs.
-
+
+
+
+
+| Event ID: 1000 |
+
-| Event ID: 1000 |
- Symbolic name:
+Symbolic name:
|
-
- MALWAREPROTECTION_SCAN_STARTED
+ |
+MALWAREPROTECTION_SCAN_STARTED
|
|
- Message:
+Message:
|
-
- An antimalware scan started.
-
+ |
+An antimalware scan started.
+
|
-|
- Description:
+ |
+Description:
|
-
-
+ |
- Scan ID: <ID number of the relevant scan.>
- Scan Type: <Scan type>, for example:
@@ -93,32 +99,31 @@ The table in this section lists the main Windows Defender Antivirus client event
- Scan Resources: <Resources (such as files/directories/BHO) that were scanned.>
- User: <Domain>\\<User>
-
|
-| Event ID: 1001 |
-
- Symbolic name:
+ | Event ID: 1001 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SCAN_COMPLETED
+ |
+MALWAREPROTECTION_SCAN_COMPLETED
|
|
- Message:
+Message:
|
-
- An antimalware scan finished.
+ |
+An antimalware scan finished.
|
|
- Description:
+Description:
|
-
-
+ |
- Scan ID: <ID number of the relevant scan.>
- Scan Type: <Scan type>, for example:
@@ -136,34 +141,33 @@ The table in this section lists the main Windows Defender Antivirus client event
- User: <Domain>\\<User>
- Scan Time: <The duration of a scan.>
-
|
-| Event ID: 1002 |
-
- Symbolic name:
+ | Event ID: 1002 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SCAN_CANCELLED
-
+ |
+MALWAREPROTECTION_SCAN_CANCELLED
+
|
|
- Message:
+Message:
|
-
- An antimalware scan was stopped before it finished.
-
+ |
+An antimalware scan was stopped before it finished.
+
|
|
- Description:
+Description:
|
-
-
+ |
- Scan ID: <ID number of the relevant scan.>
- Scan Type: <Scan type>, for example:
@@ -181,34 +185,33 @@ The table in this section lists the main Windows Defender Antivirus client event
- User: <Domain>\<User>
- Scan Time: <The duration of a scan.>
-
|
-| Event ID: 1003 |
-
- Symbolic name:
+ | Event ID: 1003 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SCAN_PAUSED
-
+ |
+MALWAREPROTECTION_SCAN_PAUSED
+
|
|
- Message:
+Message:
|
-
- An antimalware scan was paused.
-
+ |
+An antimalware scan was paused.
+
|
|
- Description:
+Description:
|
-
-
+ |
- Scan ID: <ID number of the relevant scan.>
- Scan Type: <Scan type>, for example:
@@ -225,34 +228,33 @@ The table in this section lists the main Windows Defender Antivirus client event
- User: <Domain>\\<User>
-
|
-| Event ID: 1004 |
-
- Symbolic name:
+ | Event ID: 1004 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SCAN_RESUMED
-
+ |
+MALWAREPROTECTION_SCAN_RESUMED
+
|
|
- Message:
+Message:
|
-
- An antimalware scan was resumed.
-
+ |
+An antimalware scan was resumed.
+
|
|
- Description:
+Description:
|
-
-
+ |
- Scan ID: <ID number of the relevant scan.>
- Scan Type: <Scan type>, for example:
@@ -269,34 +271,33 @@ The table in this section lists the main Windows Defender Antivirus client event
- User: <Domain>\\<User>
-
|
-| Event ID: 1005 |
-
- Symbolic name:
+ | Event ID: 1005 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SCAN_FAILED
-
+ |
+MALWAREPROTECTION_SCAN_FAILED
+
|
|
- Message:
+Message:
|
-
- An antimalware scan failed.
-
+ |
+An antimalware scan failed.
+
|
|
- Description:
+Description:
|
-
-
+ |
- Scan ID: <ID number of the relevant scan.>
- Scan Type: <Scan type>, for example:
@@ -317,52 +318,49 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
|
- User action:
+User action:
|
-
- The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error.
-
-To troubleshoot this event:
+ |
+The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error.
+To troubleshoot this event:
- Run the scan again.
- If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
- Contact Microsoft Technical Support.
-
|
-| Event ID: 1006 |
-
- Symbolic name:
+ | Event ID: 1006 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_MALWARE_DETECTED
-
+ |
+MALWAREPROTECTION_MALWARE_DETECTED
+
|
|
- Message:
+Message:
|
-
- The antimalware engine found malware or other potentially unwanted software.
-
+ |
+The antimalware engine found malware or other potentially unwanted software.
+
|
|
- Description:
+Description:
|
-
-
- For more information please see the following:
+ |
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -408,35 +406,34 @@ UAC
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1007 |
-
- Symbolic name:
+ | Event ID: 1007 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_MALWARE_ACTION_TAKEN
-
+ |
+MALWAREPROTECTION_MALWARE_ACTION_TAKEN
+
|
|
- Message:
+Message:
|
-
- The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
-
+ |
+The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:
+ |
+Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:
- User: <Domain>\\<User>
- Name: <Threat name>
@@ -463,33 +460,32 @@ UAC
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1008 |
-
- Symbolic name:
+ | Event ID: 1008 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_MALWARE_ACTION_FAILED
+ |
+MALWAREPROTECTION_MALWARE_ACTION_FAILED
|
|
- Message:
+Message:
|
-
- The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
+ |
+The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following:
+ |
+Windows Defender has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following:
- User: <Domain>\\<User>
- Name: <Threat name>
@@ -521,35 +517,34 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1009 |
-
- Symbolic name:
+ | Event ID: 1009 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_QUARANTINE_RESTORE
-
+ |
+MALWAREPROTECTION_QUARANTINE_RESTORE
+
|
|
- Message:
+Message:
|
-
- The antimalware platform restored an item from quarantine.
-
+ |
+The antimalware platform restored an item from quarantine.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has restored an item from quarantine. For more information please see the following:
+ |
+Windows Defender has restored an item from quarantine. For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -566,35 +561,34 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1010 |
-
- Symbolic name:
+ | Event ID: 1010 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED
-
+ |
+MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED
+
|
|
- Message:
+Message:
|
-
- The antimalware platform could not restore an item from quarantine.
-
+ |
+The antimalware platform could not restore an item from quarantine.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to restore an item from quarantine. For more information please see the following:
+ |
+Windows Defender has encountered an error trying to restore an item from quarantine. For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -615,35 +609,34 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1011 |
-
- Symbolic name:
+ | Event ID: 1011 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_QUARANTINE_DELETE
+ |
+MALWAREPROTECTION_QUARANTINE_DELETE
|
|
- Message:
+Message:
|
-
- The antimalware platform deleted an item from quarantine.
-
+ |
+The antimalware platform deleted an item from quarantine.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has deleted an item from quarantine.
-For more information please see the following:
+ |
+Windows Defender has deleted an item from quarantine.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -660,35 +653,34 @@ For more information please see the following:
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1012 |
-
- Symbolic name:
+ | Event ID: 1012 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_QUARANTINE_DELETE_FAILED
-
+ |
+MALWAREPROTECTION_QUARANTINE_DELETE_FAILED
+
|
|
- Message:
+Message:
|
-
- The antimalware platform could not delete an item from quarantine.
+ |
+The antimalware platform could not delete an item from quarantine.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to delete an item from quarantine.
-For more information please see the following:
+ |
+Windows Defender has encountered an error trying to delete an item from quarantine.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -709,66 +701,64 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
-| Event ID: 1013 |
-
- Symbolic name:
+ | Event ID: 1013 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_MALWARE_HISTORY_DELETE
-
+ |
+MALWAREPROTECTION_MALWARE_HISTORY_DELETE
+
|
|
- Message:
+Message:
|
-
- The antimalware platform deleted history of malware and other potentially unwanted software.
+ |
+The antimalware platform deleted history of malware and other potentially unwanted software.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has removed history of malware and other potentially unwanted software.
+ |
+Windows Defender has removed history of malware and other potentially unwanted software.
- Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
- User: <Domain>\\<User>
-
|
-| Event ID: 1014 |
-
- Symbolic name:
+ | Event ID: 1014 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_MALWARE_HISTORY_DELETE_FAILED
-
+ |
+MALWAREPROTECTION_MALWARE_HISTORY_DELETE_FAILED
+
|
|
- Message:
+Message:
|
-
- The antimalware platform could not delete history of malware and other potentially unwanted software.
+ |
+The antimalware platform could not delete history of malware and other potentially unwanted software.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to remove history of malware and other potentially unwanted software.
+ |
+Windows Defender has encountered an error trying to remove history of malware and other potentially unwanted software.
- Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
- User: <Domain>\\<User>
@@ -777,35 +767,34 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
-| Event ID: 1015 |
-
- Symbolic name:
+ | Event ID: 1015 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_BEHAVIOR_DETECTED
-
+ |
+MALWAREPROTECTION_BEHAVIOR_DETECTED
+
|
|
- Message:
+Message:
|
-
- The antimalware platform detected suspicious behavior.
+ |
+The antimalware platform detected suspicious behavior.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has detected a suspicious behavior.
-For more information please see the following:
+ |
+Windows Defender has detected a suspicious behavior.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -856,35 +845,34 @@ UAC
- Target File Name: <File name>
Name of the file.
-
|
-| Event ID: 1116 |
-
- Symbolic name:
+ | Event ID: 1116 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_STATE_MALWARE_DETECTED
+ |
+MALWAREPROTECTION_STATE_MALWARE_DETECTED
|
|
- Message:
+Message:
|
-
- The antimalware platform detected malware or other potentially unwanted software.
-
+ |
+The antimalware platform detected malware or other potentially unwanted software.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has detected malware or other potentially unwanted software.
-For more information please see the following:
+ |
+Windows Defender has detected malware or other potentially unwanted software.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -930,44 +918,43 @@ UAC
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
|
- User action:
+User action:
|
-
- No action is required. Windows Defender can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender interface, click Clean Computer.
+ |
+No action is required. Windows Defender can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender interface, click Clean Computer.
|
-| Event ID: 1117 |
-
- Symbolic name:
+ | Event ID: 1117 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN
-
+ |
+MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN
+
|
|
- Message:
+Message:
|
-
- The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
-
+ |
+The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has taken action to protect this machine from malware or other potentially unwanted software.
-For more information please see the following:
+ |
+Windows Defender has taken action to protect this machine from malware or other potentially unwanted software.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -1027,8 +1014,8 @@ Result code associated with threat status. Standard HRESULT values.
Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-NOTE:
- Whenever Windows Defender, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:
+NOTE:
+Whenever Windows Defender, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:
- Default Internet Explorer or Microsoft Edge setting
- User Access Control settings
- Chrome settings
@@ -1044,59 +1031,58 @@ The above context applies to the following client and server versions:
|
|
- Client Operating System
+Client Operating System
|
- Windows Vista (Service Pack 1, or Service Pack 2), Windows 7 and later
+Windows Vista (Service Pack 1, or Service Pack 2), Windows 7 and later
|
|
- Server Operating System
+Server Operating System
|
- Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2016
+Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2016
|
-
|
- User action:
+User action:
|
-
- No action is necessary. Windows Defender removed or quarantined a threat.
+ |
+No action is necessary. Windows Defender removed or quarantined a threat.
|
-| Event ID: 1118 |
-
- Symbolic name:
+ | Event ID: 1118 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED
+ |
+MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED
|
|
- Message:
+Message:
|
-
- The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
-
+ |
+The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered a non-critical error when taking action on malware or other potentially unwanted software.
-For more information please see the following:
+ |
+Windows Defender has encountered a non-critical error when taking action on malware or other potentially unwanted software.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -1157,43 +1143,42 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
|
- User action:
+User action:
|
-
- No action is necessary. Windows Defender failed to complete a task related to the malware remediation. This is not a critical failure.
+ |
+No action is necessary. Windows Defender failed to complete a task related to the malware remediation. This is not a critical failure.
|
-| Event ID: 1119 |
-
- Symbolic name:
+ | Event ID: 1119 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED
-
+ |
+MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED
+
|
|
- Message:
+Message:
|
-
- The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message.
+ |
+The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered a critical error when taking action on malware or other potentially unwanted software.
-For more information please see the following:
+ |
+Windows Defender has encountered a critical error when taking action on malware or other potentially unwanted software.
+For more information please see the following:
- Name: <Threat name>
- ID: <Threat ID>
@@ -1254,15 +1239,14 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
|
- User action:
+User action:
|
-
- The Windows Defender client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below.
+ |
+The Windows Defender client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below.
| Action |
@@ -1270,153 +1254,150 @@ Description of the error.
|
- Remove
+Remove
|
- Update the definitions then verify that the removal was successful.
+Update the definitions then verify that the removal was successful.
|
|
- Clean
+Clean
|
- Update the definitions then verify that the remediation was successful.
+Update the definitions then verify that the remediation was successful.
|
|
- Quarantine
+Quarantine
|
- Update the definitions and verify that the user has permission to access the necessary resources.
+Update the definitions and verify that the user has permission to access the necessary resources.
|
|
- Allow
+Allow
|
- Verify that the user has permission to access the necessary resources.
+Verify that the user has permission to access the necessary resources.
|
-
-If this event persists:
+
+If this event persists:
- Run the scan again.
- If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
- Contact Microsoft Technical Support.
-
|
-| Event ID: 1120 |
-
- Symbolic name:
+ | Event ID: 1120 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_THREAT_HASH
+ |
+MALWAREPROTECTION_THREAT_HASH
|
|
- Message:
+Message:
|
-
- Windows Defender has deduced the hashes for a threat resource.
+ |
+Windows Defender has deduced the hashes for a threat resource.
|
|
- Description:
+Description:
|
-
-
- Windows Defender client is up and running in a healthy state.
+ |
+Windows Defender client is up and running in a healthy state.
- Current Platform Version: <Current platform version>
- Threat Resource Path: <Path>
- Hashes: <Hashes>
-
|
|
-
+ |
Note This event will only be logged if the following policy is set: ThreatFileHashLogging unsigned.
|
-| Event ID: 1150 |
-
- Symbolic name:
+ | Event ID: 1150 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SERVICE_HEALTHY
+ |
+MALWAREPROTECTION_SERVICE_HEALTHY
|
|
- Message:
+Message:
|
-
- If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state.
-
+ |
+If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender client is up and running in a healthy state.
+ |
+Windows Defender client is up and running in a healthy state.
- Platform Version: <Current platform version>
- Signature Version: <Definition version>
- Engine Version: <Antimalware Engine version>
-
|
|
- User action:
+User action:
|
-
- No action is necessary. The Windows Defender Antivirus client is in a healthy state. This event is reported on an hourly basis.
+ |
+No action is necessary. The Windows Defender Antivirus client is in a healthy state. This event is reported on an hourly basis.
|
-| Event ID: 2000 |
-
- Symbolic name:
+ | Event ID: 2000 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_UPDATED
-
+ |
+MALWAREPROTECTION_SIGNATURE_UPDATED
+
|
|
- Message:
+Message:
|
-
- The antimalware definitions updated successfully.
-
+ |
+The antimalware definitions updated successfully.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender signature version has been updated.
+ |
+Windows Defender signature version has been updated.
- Current Signature Version: <Current signature version>
- Previous Signature Version: <Previous signature version>
@@ -1432,42 +1413,41 @@ Description of the error.
- Current Engine Version: <Current engine version>
- Previous Engine Version: <Previous engine version>
-
|
|
- User action:
+User action:
|
-
- No action is necessary. The Windows Defender client is in a healthy state. This event is reported when signatures are successfully updated.
+ |
+No action is necessary. The Windows Defender client is in a healthy state. This event is reported when signatures are successfully updated.
|
-| Event ID: 2001 |
-
- Symbolic name:
+ | Event ID: 2001 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED
+ |
+MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED
|
|
- Message:
+Message:
|
-
- The antimalware definition update failed.
-
+ |
+The antimalware definition update failed.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to update signatures.
+ |
+Windows Defender has encountered an error trying to update signatures.
- New Signature Version: <New version number>
- Previous Signature Version: <Previous signature version>
@@ -1504,99 +1484,89 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
|
- User action:
+User action:
|
-
- This error occurs when there is a problem updating definitions.
-To troubleshoot this event:
+ |
+This error occurs when there is a problem updating definitions.
+To troubleshoot this event:
-- Update the definitions. Either:
-- Click the Update definitions button on the Update tab in Windows Defender.
 Or,
-
-- Download the latest definitions from the Microsoft Malware Protection Center.
-
Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
-
-
-
+- [Update definitions](manage-updates-baselines-windows-defender-antivirus.md) and force a rescan directly on the endpoint.
- Review the entries in the %Windir%\WindowsUpdate.log file for more information about this error.
- Contact Microsoft Technical Support.
-
|
-| Event ID: 2002 |
-
- Symbolic name:
+ | Event ID: 2002 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ENGINE_UPDATED
+ |
+MALWAREPROTECTION_ENGINE_UPDATED
|
|
- Message:
+Message:
|
-
- The antimalware engine updated successfully.
-
+ |
+The antimalware engine updated successfully.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender engine version has been updated.
+ |
+Windows Defender engine version has been updated.
- Current Engine Version: <Current engine version>
- Previous Engine Version: <Previous engine version>
- Engine Type: <Engine type>, either antimalware engine or Network Inspection System engine.
- User: <Domain>\\<User>
-
|
|
- User action:
+User action:
|
-
- No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the antimalware engine is successfully updated.
+ |
+No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the antimalware engine is successfully updated.
|
-| Event ID: 2003 |
-
- Symbolic name:
+ | Event ID: 2003 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ENGINE_UPDATE_FAILED
+ |
+MALWAREPROTECTION_ENGINE_UPDATE_FAILED
|
|
- Message:
+Message:
|
-
- The antimalware engine update failed.
-
+ |
+The antimalware engine update failed.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to update the engine.
+ |
+Windows Defender has encountered an error trying to update the engine.
- New Engine Version:
- Previous Engine Version: <Previous engine version>
@@ -1607,55 +1577,46 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
|
- User action:
+User action:
|
-
- The Windows Defender client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update.
-To troubleshoot this event:
+ |
+The Windows Defender client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update.
+To troubleshoot this event:
-- Update the definitions. Either:
-- Click the Update definitions button on the Update tab in Windows Defender.
Or,
-
-- Download the latest definitions from the Microsoft Malware Protection Center.
-
Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
-
-
-
+- [Update definitions](manage-updates-baselines-windows-defender-antivirus.md) and force a rescan directly on the endpoint.
- Contact Microsoft Technical Support.
-
|
-| Event ID: 2004 |
-
- Symbolic name:
+ | Event ID: 2004 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_REVERSION
+ |
+MALWAREPROTECTION_SIGNATURE_REVERSION
|
|
- Message:
+Message:
|
-
- There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions.
+ |
+There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
+ |
+Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
- Signatures Attempted:
- Error Code: <Error code>
@@ -1665,83 +1626,80 @@ Description of the error.
- Signature Version: <Definition version>
- Engine Version: <Antimalware engine version>
-
|
|
- User action:
+User action:
|
-
- The Windows Defender client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Windows Defender will attempt to revert back to a known-good set of definitions.
-To troubleshoot this event:
+ |
+The Windows Defender client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Windows Defender will attempt to revert back to a known-good set of definitions.
+To troubleshoot this event:
- Restart the computer and try again.
- Download the latest definitions from the Microsoft Malware Protection Center.
-
Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
+Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
- Contact Microsoft Technical Support.
-
|
-| Event ID: 2005 |
-
- Symbolic name:
+ | Event ID: 2005 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE
+ |
+MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE
|
|
- Message:
+Message:
|
-
- The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update.
+ |
+The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update.
|
|
- Description:
+Description:
|
-
-
- Windows Defender could not load antimalware engine because current platform version is not supported. Windows Defender will revert back to the last known-good engine and a platform update will be attempted.
+ |
+Windows Defender could not load antimalware engine because current platform version is not supported. Windows Defender will revert back to the last known-good engine and a platform update will be attempted.
- Current Platform Version: <Current platform version>
-
|
-| Event ID: 2006 |
-
- Symbolic name:
+ | Event ID: 2006 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_PLATFORM_UPDATE_FAILED
-
+ |
+MALWAREPROTECTION_PLATFORM_UPDATE_FAILED
+
|
|
- Message:
+Message:
|
-
- The platform update failed.
-
+ |
+The platform update failed.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to update the platform.
+ |
+Windows Defender has encountered an error trying to update the platform.
- Current Platform Version: <Current platform version>
- Error Code: <Error code>
@@ -1749,65 +1707,63 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
-| Event ID: 2007 |
-
- Symbolic name:
+ | Event ID: 2007 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE
+ |
+MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE
|
|
- Message:
+Message:
|
-
- The platform will soon be out of date. Download the latest platform to maintain up-to-date protection.
+ |
+The platform will soon be out of date. Download the latest platform to maintain up-to-date protection.
|
|
- Description:
+Description:
|
-
-
- Windows Defender will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Windows Defender platform to maintain the best level of protection available.
+ |
+Windows Defender will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Windows Defender platform to maintain the best level of protection available.
- Current Platform Version: <Current platform version>
-
|
-| Event ID: 2010 |
-
- Symbolic name:
+ | Event ID: 2010 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED
-
+ |
+MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED
+
|
|
- Message:
+Message:
|
-
- The antimalware engine used the Dynamic Signature Service to get additional definitions.
-
+ |
+The antimalware engine used the Dynamic Signature Service to get additional definitions.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender used Dynamic Signature Service to retrieve additional signatures to help protect your machine.
+ |
+Windows Defender used Dynamic Signature Service to retrieve additional signatures to help protect your machine.
- Current Signature Version: <Current signature version>
- Signature Type: <Signature type>, for example:
@@ -1838,35 +1794,34 @@ Description of the error.
- Persistence Limit: Persistence limit of the fastpath signature.
-
|
-| Event ID: 2011 |
-
- Symbolic name:
+ | Event ID: 2011 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED
-
+ |
+MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED
+
|
|
- Message:
+Message:
|
-
- The Dynamic Signature Service deleted the out-of-date dynamic definitions.
-
+ |
+The Dynamic Signature Service deleted the out-of-date dynamic definitions.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender used Dynamic Signature Service to discard obsolete signatures.
+ |
+Windows Defender used Dynamic Signature Service to discard obsolete signatures.
- Current Signature Version: <Current signature version>
- Signature Type: <Signature type>, for example:
@@ -1898,43 +1853,42 @@ Description of the error.
- Persistence Limit: Persistence limit of the fastpath signature.
-
|
|
- User action:
+User action:
|
-
- No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions.
+ |
+No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions.
|
-| Event ID: 2012 |
-
- Symbolic name:
+ | Event ID: 2012 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED
-
+ |
+MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED
+
|
|
- Message:
+Message:
|
-
- The antimalware engine encountered an error when trying to use the Dynamic Signature Service.
-
+ |
+The antimalware engine encountered an error when trying to use the Dynamic Signature Service.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to use Dynamic Signature Service.
+ |
+Windows Defender has encountered an error trying to use Dynamic Signature Service.
- Current Signature Version: <Current signature version>
- Signature Type: <Signature type>, for example:
@@ -1969,109 +1923,106 @@ Description of the error.
- Persistence Limit: Persistence limit of the fastpath signature.
-
|
|
- User action:
+User action:
|
-
- Check your Internet connectivity settings.
+ |
+Check your Internet connectivity settings.
|
-| Event ID: 2013 |
-
- Symbolic name:
+ | Event ID: 2013 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED_ALL
-
+ |
+MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED_ALL
+
|
|
- Message:
+Message:
|
-
- The Dynamic Signature Service deleted all dynamic definitions.
-
+ |
+The Dynamic Signature Service deleted all dynamic definitions.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender discarded all Dynamic Signature Service signatures.
+ |
+Windows Defender discarded all Dynamic Signature Service signatures.
- Current Signature Version: <Current signature version>
-
|
-| Event ID: 2020 |
-
- Symbolic name:
+ | Event ID: 2020 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOADED
-
+ |
+MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOADED
+
|
|
- Message:
+Message:
|
-
- The antimalware engine downloaded a clean file.
-
+ |
+The antimalware engine downloaded a clean file.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender downloaded a clean file.
+ |
+Windows Defender downloaded a clean file.
- Filename: <File name>
Name of the file.
- Current Signature Version: <Current signature version>
- Current Engine Version: <Current engine version>
-
|
-| Event ID: 2021 |
-
- Symbolic name:
+ | Event ID: 2021 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED
+ |
+MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED
|
|
- Message:
+Message:
|
-
- The antimalware engine failed to download a clean file.
-
+ |
+The antimalware engine failed to download a clean file.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to download a clean file.
+ |
+Windows Defender has encountered an error trying to download a clean file.
- Filename: <File name>
Name of the file.
@@ -2082,185 +2033,185 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
|
- User action:
+User action:
|
-
- Check your Internet connectivity settings.
-
-The Windows Defender client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue.
-
+ |
+Check your Internet connectivity settings.
+The Windows Defender client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue.
|
-| Event ID: 2030 |
-
- Symbolic name:
+ | Event ID: 2030 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_OFFLINE_SCAN_INSTALLED
+ |
+MALWAREPROTECTION_OFFLINE_SCAN_INSTALLED
|
|
- Message:
+Message:
|
-
- The antimalware engine was downloaded and is configured to run offline on the next system restart.
+ |
+The antimalware engine was downloaded and is configured to run offline on the next system restart.
|
|
- Description:
+Description:
|
-
- Windows Defender downloaded and configured Windows Defender Offline to run on the next reboot.
+ |
+Windows Defender downloaded and configured Windows Defender Offline to run on the next reboot.
|
-| Event ID: 2031 |
-
- Symbolic name:
+ | Event ID: 2031 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED
-
+ |
+MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED
+
|
|
- Message:
+Message:
|
-
- The antimalware engine was unable to download and configure an offline scan.
+ |
+The antimalware engine was unable to download and configure an offline scan.
|
|
- Description:
+Description:
|
-
-
- Windows Defender has encountered an error trying to download and configure Windows Defender Offline.
+ |
+Windows Defender has encountered an error trying to download and configure Windows Defender Offline.
- Error Code: <Error code>
Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
-| Event ID: 2040 |
-
- Symbolic name:
+ | Event ID: 2040 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_OS_EXPIRING
-
+ |
+MALWAREPROTECTION_OS_EXPIRING
+
|
|
- Message:
+Message:
|
-
- Antimalware support for this operating system version will soon end.
-
+ |
+Antimalware support for this operating system version will soon end.
+
|
|
- Description:
+Description:
|
-
- The support for your operating system will expire shortly. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.
+ |
+The support for your operating system will expire shortly. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.
|
-| Event ID: 2041 |
-
- Symbolic name:
+ | Event ID: 2041 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_OS_EOL
-
+ |
+MALWAREPROTECTION_OS_EOL
+
|
|
- Message:
+Message:
|
-
- Antimalware support for this operating system has ended. You must upgrade the operating system for continued support.
-
+ |
+Antimalware support for this operating system has ended. You must upgrade the operating system for continued support.
+
|
|
- Description:
+Description:
|
-
- The support for your operating system has expired. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.
+ |
+The support for your operating system has expired. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.
|
-| Event ID: 2042 |
-
- Symbolic name:
+ | Event ID: 2042 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_PROTECTION_EOL
-
+ |
+MALWAREPROTECTION_PROTECTION_EOL
+
|
|
- Message:
+Message:
|
-
- The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware.
-
+ |
+The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware.
+
|
|
- Description:
+Description:
|
-
- The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.
+ |
+The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.
|
-| Event ID: 3002 |
-
- Symbolic name:
+ | Event ID: 3002 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_RTP_FEATURE_FAILURE
-
+ |
+MALWAREPROTECTION_RTP_FEATURE_FAILURE
+
|
|
- Message:
+Message:
|
-
- Real-time protection encountered an error and failed.
+ |
+Real-time protection encountered an error and failed.
|
|
- Description:
+Description:
|
-
-
- Windows Defender Real-Time Protection feature has encountered an error and failed.
+ |
+Windows Defender Real-Time Protection feature has encountered an error and failed.
- Feature: <Feature>, for example:
@@ -2276,47 +2227,43 @@ Result code associated with threat status. Standard HRESULT values.
Description of the error.
- Reason: The reason Windows Defender real-time protection has restarted a feature.
-
|
|
- User action:
+User action:
|
-
- You should restart the system then run a full scan because it's possible the system was not protected for some time.
-
-The Windows Defender client's real-time protection feature encountered an error because one of the services failed to start.
-
-If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure.
-
+ |
+You should restart the system then run a full scan because it's possible the system was not protected for some time.
+The Windows Defender client's real-time protection feature encountered an error because one of the services failed to start.
+If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure.
|
-| Event ID: 3007 |
-
- Symbolic name:
+ | Event ID: 3007 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_RTP_FEATURE_RECOVERED
+ |
+MALWAREPROTECTION_RTP_FEATURE_RECOVERED
|
|
- Message:
+Message:
|
-
- Real-time protection recovered from a failure. We recommend running a full system scan when you see this error.
-
+ |
+Real-time protection recovered from a failure. We recommend running a full system scan when you see this error.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down.
+ |
+Windows Defender Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down.
- Feature: <Feature>, for example:
@@ -2328,96 +2275,97 @@ Description of the error.
- Reason: The reason Windows Defender real-time protection has restarted a feature.
-
|
|
- User action:
+User action:
|
-
- The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support.
+ |
+The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support.
|
-| Event ID: 5000 |
-
- Symbolic name:
+ | Event ID: 5000 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_RTP_ENABLED
-
+ |
+MALWAREPROTECTION_RTP_ENABLED
+
|
|
- Message:
+Message:
|
-
- Real-time protection is enabled.
-
+ |
+Real-time protection is enabled.
+
|
|
- Description:
+Description:
|
-
- Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was enabled.
+ |
+Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was enabled.
|
-| Event ID: 5001 |
-
- Symbolic name:
+ | Event ID: 5001 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_RTP_DISABLED
+ |
+MALWAREPROTECTION_RTP_DISABLED
|
|
- Message:
+Message:
|
-
- Real-time protection is disabled.
-
+ |
+Real-time protection is disabled.
+
|
|
- Description:
+Description:
|
-
- Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was disabled.
+ |
+Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was disabled.
|
-| Event ID: 5004 |
-
- Symbolic name:
+ | Event ID: 5004 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_RTP_FEATURE_CONFIGURED
-
+ |
+MALWAREPROTECTION_RTP_FEATURE_CONFIGURED
+
|
|
- Message:
+Message:
|
-
- The real-time protection configuration changed.
-
+ |
+The real-time protection configuration changed.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender Real-time Protection feature configuration has changed.
+ |
+Windows Defender Real-time Protection feature configuration has changed.
- Feature: <Feature>, for example:
@@ -2429,67 +2377,65 @@ Description of the error.
- Configuration:
-
|
-| Event ID: 5007 |
-
- Symbolic name:
+ | Event ID: 5007 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_CONFIG_CHANGED
-
+ |
+MALWAREPROTECTION_CONFIG_CHANGED
+
|
|
- Message:
+Message:
|
-
- The antimalware platform configuration changed.
+ |
+The antimalware platform configuration changed.
|
|
- Description:
+Description:
|
-
-
- Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
+ |
+Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
- Old value: <Old value number>
Old Windows Defender configuration value.
- New value: <New value number>
New Windows Defender configuration value.
-
|
-| Event ID: 5008 |
-
- Symbolic name:
+ | Event ID: 5008 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ENGINE_FAILURE
+ |
+MALWAREPROTECTION_ENGINE_FAILURE
|
|
- Message:
+Message:
|
-
- The antimalware engine encountered an error and failed.
+ |
+The antimalware engine encountered an error and failed.
|
|
- Description:
+Description:
|
-
-
- Windows Defender engine has been terminated due to an unexpected error.
+ |
+Windows Defender engine has been terminated due to an unexpected error.
- Failure Type: <Failure type>, for example:
Crash
@@ -2497,15 +2443,14 @@ or Hang
- Exception Code: <Error code>
- Resource: <Resource>
-
|
|
- User action:
+User action:
|
-
- To troubleshoot this event:
+
+To troubleshoot this event:
- Try to restart the service.
- For antimalware, antivirus and spyware, at an elevated command prompt, type net stop msmpsvc, and then type net start msmpsvc to restart the antimalware engine.
- For the Network Inspection System, at an elevated command prompt, type net start nissrv, and then type net start nissrv to restart the Network Inspection System engine by using the NiSSRV.exe file.
@@ -2514,189 +2459,190 @@ or Hang
- If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.
-
|
|
|
- User action:
+User action:
|
-
- The Windows Defender client engine stopped due to an unexpected error.
-To troubleshoot this event:
+ |
+The Windows Defender client engine stopped due to an unexpected error.
+To troubleshoot this event:
- Run the scan again.
- If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
- Contact Microsoft Technical Support.
-
|
-| Event ID: 5009 |
-
- Symbolic name:
+ | Event ID: 5009 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ANTISPYWARE_ENABLED
-
+ |
+MALWAREPROTECTION_ANTISPYWARE_ENABLED
+
|
|
- Message:
+Message:
|
-
- Scanning for malware and other potentially unwanted software is enabled.
-
+ |
+Scanning for malware and other potentially unwanted software is enabled.
+
|
|
- Description:
+Description:
|
-
- Windows Defender scanning for malware and other potentially unwanted software has been enabled.
+ |
+Windows Defender scanning for malware and other potentially unwanted software has been enabled.
|
-| Event ID: 5010 |
-
- Symbolic name:
+ | Event ID: 5010 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ANTISPYWARE_DISABLED
-
+ |
+MALWAREPROTECTION_ANTISPYWARE_DISABLED
+
|
|
- Message:
+Message:
|
-
- Scanning for malware and other potentially unwanted software is disabled.
+ |
+Scanning for malware and other potentially unwanted software is disabled.
|
|
- Description:
+Description:
|
-
- Windows Defender scanning for malware and other potentially unwanted software is disabled.
+ |
+Windows Defender scanning for malware and other potentially unwanted software is disabled.
|
-| Event ID: 5011 |
-
- Symbolic name:
+ | Event ID: 5011 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ANTIVIRUS_ENABLED
+ |
+MALWAREPROTECTION_ANTIVIRUS_ENABLED
|
|
- Message:
+Message:
|
-
- Scanning for viruses is enabled.
+ |
+Scanning for viruses is enabled.
|
|
- Description:
+Description:
|
-
- Windows Defender scanning for viruses has been enabled.
+ |
+Windows Defender scanning for viruses has been enabled.
|
-| Event ID: 5012 |
-
- Symbolic name:
+ | Event ID: 5012 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_ANTIVIRUS_DISABLED
-
+ |
+MALWAREPROTECTION_ANTIVIRUS_DISABLED
+
|
|
- Message:
+Message:
|
-
- Scanning for viruses is disabled.
-
+ |
+Scanning for viruses is disabled.
+
|
|
- Description:
+Description:
|
-
- Windows Defender scanning for viruses is disabled.
+ |
+Windows Defender scanning for viruses is disabled.
|
-| Event ID: 5100 |
-
- Symbolic name:
+ | Event ID: 5100 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_EXPIRATION_WARNING_STATE
-
+ |
+MALWAREPROTECTION_EXPIRATION_WARNING_STATE
+
|
|
- Message:
+Message:
|
-
- The antimalware platform will expire soon.
-
+ |
+The antimalware platform will expire soon.
+
|
|
- Description:
+Description:
|
-
-
- Windows Defender has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software.
+ |
+Windows Defender has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software.
- Expiration Reason: The reason Windows Defender will expire.
- Expiration Date: The date Windows Defender will expire.
-
|
-| Event ID: 5101 |
-
- Symbolic name:
+ | Event ID: 5101 |
+
+|
+Symbolic name:
|
-
- MALWAREPROTECTION_DISABLED_EXPIRED_STATE
-
+ |
+MALWAREPROTECTION_DISABLED_EXPIRED_STATE
+
|
|
- Message:
+Message:
|
-
- The antimalware platform is expired.
-
+ |
+The antimalware platform is expired.
+
|
|
- Description::
+Description:
|
-
-
- Windows Defender grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.
+ |
+Windows Defender grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.
- Expiration Reason:
- Expiration Date:
@@ -2705,7 +2651,6 @@ Result code associated with threat status. Standard HRESULT values.
- Error Description: <Error description>
Description of the error.
-
|
@@ -2719,58 +2664,52 @@ This section provides the following information about Windows Defender Antivirus
- Advice on what to do now
Use the information in these tables to help troubleshoot Windows Defender Antivirus error codes.
-
+
+
+
-| External error codes |
+Error code: 0x80508007 |
-| Error code |
-Message displayed |
-Possible reason for error |
-What to do now |
+Message |
+
+ERR_MP_NO_MEMORY
+ |
|
- 0x80508007
-
+Possible reason
|
- ERR_MP_NO_MEMORY
-
+This error indicates that you might have run out of memory.
|
+
+
+| Resolution |
- This error indicates that you might have run out of memory.
-
- |
-
-
- Check the available memory on your device.
- Close any unused applications that are running to free up memory on your device.
- Restart the device and run the scan again.
-
|
+| Error code: 0x8050800C |
+
| Message |
+ERR_MP_BAD_INPUT_DATA
+ |
| Possible reason |
- 0x8050800C
+This error indicates that there might be a problem with your security product.
|
-
- ERR_MP_BAD_INPUT_DATA
- |
-
- This error indicates that there might be a problem with your security product.
- |
-
-
+ |
| Resolution |
- Update the definitions. Either:
-- Click the Update definitions button on the Update tab in Windows Defender.
Or,
+ - Click the Update definitions button on the Update tab in Windows Defender. Or,
- Download the latest definitions from the Microsoft Malware Protection Center.
-
Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
+Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
@@ -2778,195 +2717,149 @@ Use the information in these tables to help troubleshoot Windows Defender Antivi
- Restart the device and try again.
-
|
+| Error code: 0x80508020 |
+
| Message |
+ERR_MP_BAD_CONFIGURATION
+
+ |
| Possible reason |
- 0x80508020
- |
-
- ERR_MP_BAD_CONFIGURATION
-
- |
-
- This error indicates that there might be an engine configuration error; commonly, this is related to input
+This error indicates that there might be an engine configuration error; commonly, this is related to input
data that does not allow the engine to function properly.
-
|
+| Error code: 0x805080211
+ |
+
| Message |
+ERR_MP_QUARANTINE_FAILED
+
+ |
| Possible reason |
- 0x805080211
-
- |
-
- ERR_MP_QUARANTINE_FAILED
-
- |
-
- This error indicates that Windows Defender failed to quarantine a threat.
-
+This error indicates that Windows Defender failed to quarantine a threat.
|
+| Error code: 0x80508022
+ |
+
| Message |
+ERR_MP_REBOOT_REQUIRED
+
+ |
| Possible reason |
- 0x80508022
-
- |
-
- ERR_MP_REBOOT_REQUIRED
-
- |
-
- This error indicates that a reboot is required to complete threat removal.
-
+This error indicates that a reboot is required to complete threat removal.
|
-|
- 0x80508023
-
+ |
+0x80508023
+ |
+
| Message |
+ERR_MP_THREAT_NOT_FOUND
+
+ |
| Possible reason |
+
+This error indicates that the threat might no longer be present on the media, or malware might be stopping you from scanning your device.
+ |
| Resolution
|
- ERR_MP_THREAT_NOT_FOUND
-
- |
-
- This error indicates that the threat might no longer be present on the media, or malware might be stopping you from scanning your device.
-
- |
-
- Run the Microsoft Safety Scanner then update your security software and try again.
-
+Run the Microsoft Safety Scanner then update your security software and try again.
|
-|
- ERR_MP_FULL_SCAN_REQUIRED
-
- |
-
- This error indicates that a full system scan might be required.
-
- |
-
- Run a full system scan.
-
+ | Error code: 0x80508024 |
+
+| Message |
+ERR_MP_FULL_SCAN_REQUIRED
+
+ |
| Possible reason |
+
+This error indicates that a full system scan might be required.
+ |
+
+| Resolution |
+Run a full system scan.
|
+| Error code: 0x80508025
+ |
+
| Message |
+ERR_MP_MANUAL_STEPS_REQUIRED
+
+ |
| Possible reason |
- 0x80508024
-
+This error indicates that manual steps are required to complete threat removal.
+ |
| Resolution |
+Follow the manual remediation steps outlined in the Microsoft Malware Protection Encyclopedia. You can find a threat-specific link in the event history.
|
+| Error code: 0x80508026
+ |
+
| Message |
+ERR_MP_REMOVE_NOT_SUPPORTED
+
+ |
| Possible reason |
- 0x80508025
-
- |
-
- ERR_MP_MANUAL_STEPS_REQUIRED
-
- |
-
- This error indicates that manual steps are required to complete threat removal.
-
- |
-
- Follow the manual remediation steps outlined in the Microsoft Malware Protection Encyclopedia. You can find a threat-specific link in the event history.
-
+This error indicates that removal inside the container type might not be not supported.
+ |
| Resolution |
+Windows Defender is not able to remediate threats detected inside the archive. Consider manually removing the detected resources.
|
+| Error code: 0x80508027
+ |
+
| Message |
+ERR_MP_REMOVE_LOW_MEDIUM_DISABLED
+
+ |
| Possible reason |
- 0x80508026
-
- |
-
- ERR_MP_REMOVE_NOT_SUPPORTED
-
- |
-
- This error indicates that removal inside the container type might not be not supported.
-
- |
-
- Windows Defender is not able to remediate threats detected inside the archive. Consider manually removing the detected resources.
-
+This error indicates that removal of low and medium threats might be disabled.
+ |
| Resolution |
+Check the detected threats and resolve them as required.
|
+| Error code: 0x80508029
+ |
+
| Message |
+ERROR_MP_RESCAN_REQUIRED
+
+ |
| Possible reason |
- 0x80508027
-
- |
-
- ERR_MP_REMOVE_LOW_MEDIUM_DISABLED
-
- |
-
- This error indicates that removal of low and medium threats might be disabled.
-
- |
-
- Check the detected threats and resolve them as required.
-
+This error indicates a rescan of the threat is required.
+ |
| Resolution |
+Run a full system scan.
|
+| Error code: 0x80508030
+ |
+
| Message |
+ERROR_MP_CALLISTO_REQUIRED
+
+ |
| Possible reason |
- 0x80508029
-
- |
-
- ERROR_MP_RESCAN_REQUIRED
-
- |
-
- This error indicates a rescan of the threat is required.
-
- |
-
- Run a full system scan.
-
+This error indicates that an offline scan is required.
+ |
| Resolution |
+Run Windows Defender Offline. You can read about how to do this in the Windows Defender Offline
+article.
|
+| Error code: 0x80508031
+ |
+
| Message |
+ERROR_MP_PLATFORM_OUTDATED
+
+ |
| Possible reason |
- 0x80508030
-
- |
-
- ERROR_MP_CALLISTO_REQUIRED
-
- |
-
- This error indicates that an offline scan is required.
-
- |
-
- Run Windows Defender Offline. You can read about how to do this in the Windows Defender Offline
-article.
- |
-
-
-|
- 0x80508031
-
- |
-
- ERROR_MP_PLATFORM_OUTDATED
-
- |
-
- This error indicates that Windows Defender does not support the current version of the platform and requires a new version of the platform.
-
- |
-
- You can only use Windows Defender in Windows 10. For Windows 8, Windows 7 and Windows Vista, you can use System Center Endpoint Protection.
-
+This error indicates that Windows Defender does not support the current version of the platform and requires a new version of the platform.
+ |
| Resolution |
+You can only use Windows Defender in Windows 10. For Windows 8, Windows 7 and Windows Vista, you can use System Center Endpoint Protection.
|
@@ -2974,349 +2867,330 @@ article.
The following error codes are used during internal testing of Windows Defender AV.
-
+If you see these errors, you can try to [update definitions](manage-updates-baselines-windows-defender-antivirus.md) and force a rescan directly on the endpoint.
+
+
+
-| Internal error codes |
+Internal error codes |
-| Error code |
+Error code |
Message displayed |
-Possible reason for error |
-What to do now |
+Possible reason for error and resolution |
|
- 0x80501004
+0x80501004
|
- ERROR_MP_NO_INTERNET_CONN
-
+ERROR_MP_NO_INTERNET_CONN
+
|
- Check your Internet connection, then run the scan again.
- |
-
- Check your Internet connection, then run the scan again.
+Check your Internet connection, then run the scan again.
|
|
- 0x80501000
+0x80501000
|
- ERROR_MP_UI_CONSOLIDATION_BASE
+ERROR_MP_UI_CONSOLIDATION_BASE
|
- This is an internal error. The cause is not clearly defined.
+This is an internal error. The cause is not clearly defined.
|
-
-
-- Update the definitions. Either:
-- Click the Update definitions button on the Update tab in Windows Defender.
Or,
-
-- Download the latest definitions from the Microsoft Malware Protection Center.
-
Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.
-
-
-
-- Run a full scan.
-
-- Restart the device and try again.
-
-
+
|
|
- 0x80501001
+0x80501001
|
- ERROR_MP_ACTIONS_FAILED
+ERROR_MP_ACTIONS_FAILED
|
|
- 0x80501002
+0x80501002
|
- ERROR_MP_NOENGINE
+ERROR_MP_NOENGINE
|
|
- 0x80501003
+0x80501003
|
- ERROR_MP_ACTIVE_THREATS
+ERROR_MP_ACTIVE_THREATS
|
|
- 0x805011011
+0x805011011
|
- MP_ERROR_CODE_LUA_CANCELLED
+MP_ERROR_CODE_LUA_CANCELLED
|
|
- 0x80501101
+0x80501101
|
- ERROR_LUA_CANCELLATION
+ERROR_LUA_CANCELLATION
|
|
- 0x80501102
+0x80501102
|
- MP_ERROR_CODE_ALREADY_SHUTDOWN
+MP_ERROR_CODE_ALREADY_SHUTDOWN
|
|
- 0x80501103
+0x80501103
|
- MP_ERROR_CODE_RDEVICE_S_ASYNC_CALL_PENDING
+MP_ERROR_CODE_RDEVICE_S_ASYNC_CALL_PENDING
|
|
- 0x80501104
+0x80501104
|
- MP_ERROR_CODE_CANCELLED
+MP_ERROR_CODE_CANCELLED
|
|
- 0x80501105
+0x80501105
|
- MP_ERROR_CODE_NO_TARGETOS
+MP_ERROR_CODE_NO_TARGETOS
|
|
- 0x80501106
+0x80501106
|
- MP_ERROR_CODE_BAD_REGEXP
+MP_ERROR_CODE_BAD_REGEXP
|
|
- 0x80501107
+0x80501107
|
- MP_ERROR_TEST_INDUCED_ERROR
+MP_ERROR_TEST_INDUCED_ERROR
|
|
- 0x80501108
+0x80501108
|
- MP_ERROR_SIG_BACKUP_DISABLED
+MP_ERROR_SIG_BACKUP_DISABLED
|
|
- 0x80508001
+0x80508001
|
- ERR_MP_BAD_INIT_MODULES
+ERR_MP_BAD_INIT_MODULES
|
|
- 0x80508002
+0x80508002
|
- ERR_MP_BAD_DATABASE
+ERR_MP_BAD_DATABASE
|
|
- 0x80508004
+0x80508004
|
- ERR_MP_BAD_UFS
+ERR_MP_BAD_UFS
|
|
- 0x8050800C
+0x8050800C
|
- ERR_MP_BAD_INPUT_DATA
+ERR_MP_BAD_INPUT_DATA
|
|
- 0x8050800D
+0x8050800D
|
- ERR_MP_BAD_GLOBAL_STORAGE
+ERR_MP_BAD_GLOBAL_STORAGE
|
|
- 0x8050800E
+0x8050800E
|
- ERR_MP_OBSOLETE
+ERR_MP_OBSOLETE
|
|
- 0x8050800F
+0x8050800F
|
- ERR_MP_NOT_SUPPORTED
+ERR_MP_NOT_SUPPORTED
|
|
- 0x8050800F
+0x8050800F
0x80508010
-
|
- ERR_MP_NO_MORE_ITEMS
+ERR_MP_NO_MORE_ITEMS
|
|
- 0x80508011
+0x80508011
|
- ERR_MP_DUPLICATE_SCANID
+ERR_MP_DUPLICATE_SCANID
|
|
- 0x80508012
+0x80508012
|
- ERR_MP_BAD_SCANID
+ERR_MP_BAD_SCANID
|
|
- 0x80508013
+0x80508013
|
- ERR_MP_BAD_USERDB_VERSION
+ERR_MP_BAD_USERDB_VERSION
|
|
- 0x80508014
+0x80508014
|
- ERR_MP_RESTORE_FAILED
+ERR_MP_RESTORE_FAILED
|
|
- 0x80508016
+0x80508016
|
- ERR_MP_BAD_ACTION
+ERR_MP_BAD_ACTION
|
|
- 0x80508019
+0x80508019
|
- ERR_MP_NOT_FOUND
+ERR_MP_NOT_FOUND
|
|
- 0x80509001
+0x80509001
|
- ERR_RELO_BAD_EHANDLE
+ERR_RELO_BAD_EHANDLE
|
|
- 0x80509003
+0x80509003
|
- ERR_RELO_KERNEL_NOT_LOADED
+ERR_RELO_KERNEL_NOT_LOADED
|
|
- 0x8050A001
+0x8050A001
|
- ERR_MP_BADDB_OPEN
+ERR_MP_BADDB_OPEN
|
|
- 0x8050A002
+0x8050A002
|
- ERR_MP_BADDB_HEADER
+ERR_MP_BADDB_HEADER
|
|
- 0x8050A003
+0x8050A003
|
- ERR_MP_BADDB_OLDENGINE
+ERR_MP_BADDB_OLDENGINE
|
|
- 0x8050A004
+0x8050A004
|
- ERR_MP_BADDB_CONTENT
+ERR_MP_BADDB_CONTENT
|
|
- 0x8050A005
+0x8050A005
|
- ERR_MP_BADDB_NOTSIGNED
+ERR_MP_BADDB_NOTSIGNED
|
|
- 0x8050801
+0x8050801
|
- ERR_MP_REMOVE_FAILED
+ERR_MP_REMOVE_FAILED
|
- This is an internal error. It might be triggered when malware removal is not successful.
-
+This is an internal error. It might be triggered when malware removal is not successful.
|
|
- 0x80508018
-
+0x80508018
|
- ERR_MP_SCAN_ABORTED
-
+ERR_MP_SCAN_ABORTED
+
|
- This is an internal error. It might have triggered when a scan fails to complete.
-
+This is an internal error. It might have triggered when a scan fails to complete.
|
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
index 6bef064955..7eba149ae9 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
@@ -10,6 +10,8 @@ ms.sitesec: library
ms.pagetype: security
localizationpriority: medium
author: iaanw
+ms.author: iawilt
+ms.date: 06/13/2017
---
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
index d331e9d39e..942587b25b 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
@@ -1,6 +1,6 @@
---
title: Windows Defender Antivirus
-description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10.
+description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016
keywords: windows defender antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -12,16 +12,17 @@ localizationpriority: medium
author: iaanw
---
-# Windows Defender Antivirus in Windows 10
+# Windows Defender Antivirus in Windows 10 and Windows Server 2016
**Applies to**
- Windows 10
+- Windows Server 2016
Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers.
This library of documentation is aimed for enterprise security administrators who are either considering deployment, or have already deployed and are wanting to manage and configure Windows Defender AV on PC endpoints in their network.
-For more important information about running Windows Defender AV on a server platform, see [Windows Defender Overview for Windows Server](https://technet.microsoft.com/library/dn765478.aspx).
+For more important information about running Windows Defender on a server platform, see [Windows Defender Antivirus on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md).
Windows Defender AV can be managed with:
- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP)
@@ -57,14 +58,14 @@ See the [In this library](#in-this-library) list at the end of this topic for li
## Minimum system requirements
-Windows Defender has the same hardware requirements as Windows 10. For more information, see:
+Windows Defender AV has the same hardware requirements as Windows 10. For more information, see:
- [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086.aspx)
- [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049.aspx)
Some features require a certain version of Windows 10 - the minimum version required is specified at the top of each topic.
-Functionality, configuration, and management is largely the same when using Windows Defender Antivirus on Windows Server 2016, however [there are some differences](windows-defender-antivirus-on-windows-server-2016.md).
+Functionality, configuration, and management is largely the same when using Windows Defender AV on Windows Server 2016, however [there are some differences](windows-defender-antivirus-on-windows-server-2016.md).
@@ -73,10 +74,13 @@ Functionality, configuration, and management is largely the same when using Wind
Topic | Description
:---|:---
-[Evaluate Windows Defender Antivirus protection](evaluate-windows-defender-antivirus.md) | Evaluate the protection capabilities of Windows Defender Antivirus with a specialized evaluation guide and PowerShell script
-[Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) | While traditional client deployment is not required for Windows Defender AV, you will need to enable the service. You can also manage how protection and product updates are applies, and receive reports from Configuration Manager, Intune, and with some security information and event monitoring (SIEM) tools
-[Configure Windows Defender features](configure-windows-defender-antivirus-features.md) | Windows Defender AV has a large set of configurable features and options. You can configure options such as cloud-delivered protection, always-on monitoring and scanning, and how end-users can interact or override global policy settings
+[Windows Defender AV in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md) | The Windows Defender Security Center combines the settings and notifications from the previous Windows Defender AV app and Windows Settings in one easy-to-manage place
+[Windows Defender AV on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md) | Windows Defender AV can be used on Windows Server 2016, and features the same configuration and management capabilities as the Windows 10 version - with some added features for automatic exclusions
+[Windows Defender AV compatibility](windows-defender-antivirus-compatibility.md) | Windows Defender AV operates in different modes depending on whether it detects other AV products or if you are using Windows Defender Advanced Threat Protection
+[Evaluate Windows Defender AV protection](evaluate-windows-defender-antivirus.md) | Evaluate the protection capabilities of Windows Defender Antivirus with a specialized evaluation guide and PowerShell script
+[Deploy, manage updates, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md) | While traditional client deployment is not required for Windows Defender AV, you will need to enable the service. You can also manage how protection and product updates are applies, and receive reports from Configuration Manager, Intune, and with some security information and event monitoring (SIEM) tools
+[Configure Windows Defender AV features](configure-windows-defender-antivirus-features.md) | Windows Defender AV has a large set of configurable features and options. You can configure options such as cloud-delivered protection, always-on monitoring and scanning, and how end-users can interact or override global policy settings
[Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) | You can set up scheduled scans, run on-demand scans, and configure how remediation works when threats are detected
-[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-antivirus.md)|Review event IDs and error codes in Windows Defender Antivirus to determine causes of problems and troubleshoot issues
+[Review event logs and error codes to troubleshoot issues](troubleshoot-windows-defender-antivirus.md)|Review event IDs and error codes in Windows Defender Antivirus to determine causes of problems and troubleshoot issues
[Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)|The management and configuration tools that you can use with Windows Defender AV are listed and described here
diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
index b3305b6b1c..29fbb9377a 100644
--- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
+++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
@@ -1,6 +1,6 @@
---
title: Windows Defender Antivirus on Windows Server 2016
-description: Compare the differences when Windows Defender AV is on a Windows Server SKU versus a Windows 10 endpoint
+description: Enable and configure Windows Defender AV on Windows Server 2016
keywords: windows defender, server, scep, system center endpoint protection, server 2016, current branch, server 2012
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -13,7 +13,7 @@ author: iaanw
---
-# Windows Defender Antivirus on Windows Server
+# Windows Defender Antivirus on Windows Server 2016
**Applies to:**
@@ -36,15 +36,124 @@ author: iaanw
Windows Defender Antivirus is available on Windows Server 2016. In some instances it is referred to as Endpoint Protection - however, the protection engine is the same.
-See the [Windows Defender Overview for Windows Server](https://technet.microsoft.com/windows-server-docs/security/windows-defender/windows-defender-overview-windows-server) for more information on enabling the client interface and configuring roles and specific server features.
-
While the functionality, configuration, and management is largely the same for Windows Defender AV either on Windows 10 or Windows Server 2016, there are a few key differences:
- In Windows Server 2016, [automatic exclusions](configure-server-exclusions-windows-defender-antivirus.md) are applied based on your defined Server Role.
- In Windows Server 2016, Windows Defender AV will not disable itself if you are running another antivirus product.
+This topic includes the following instructions for setting up and running Windows Defender AV on a server platform:
+
+- [Enable the interface](#BKMK_UsingDef)
+
+- [Verify Windows Defender AV is running](#BKMK_DefRun)
+
+- [Update antimalware definitions](#BKMK_UpdateDef)
+
+- [Submit Samples](#BKMK_DefSamples)
+
+- [Configure automatic exclusions](#BKMK_DefExclusions)
+
+
+## Enable the interface
+By default, Windows Defender AV is installed and functional on Windows Server 2016. The user interface is installed by default on some SKUs.
+
+You can enable or disable the interface by using the **Add Roles and Features Wizard** or PowerShellCmdlets, as described in the [Install or uninstall roles, role services, or features](https://docs.microsoft.com/en-us/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features) topic.
+
+The following PowerShell cmdlet will enable the interface:
+
+```PowerShell
+Install-WindowsFeature -Name Windows-Defender-GUI
+```
+
+The following cmdlet will disable the interface:
+
+```PS
+Uninstall-WindowsFeature -Name Windows-Server-Antimalware
+```
+
+> [!TIP]
+> Event messages for the antimalware engine included with Windows Defender AV can be found in [Windows Defender AV Events](troubleshoot-windows-defender-antivirus.md).
+
+
+
+## Verify Windows Defender is running
+To verify that Windows Defender AV is running on the server, run the following command from a command prompt:
+
+```DOS
+sc query Windefend
+```
+
+The `sc query` command returns information about the Windows Defender service. If Windows Defender is running, the `STATE` value displays `RUNNING`.
+
+
+## Update antimalware definitions
+In order to get updated antimalware definitions, you must have the Windows Update service running. If you use an update management service, like Windows Server Update Services (WSUS), make sure that updates for Windows Defender AV definitions are approved for the computers you manage.
+
+By default, Windows Update does not download and install updates automatically on Windows Server 2016. You can change this configuration by using one of the following methods:
+
+- **Windows Update** in Control Panel.
+
+ - **Install updates automatically** results in all updates being automatically installed, including Windows Defender definition updates.
+
+ - **Download updates but let me choose whether to install them** allows Windows Defender to download and install definition updates automatically, but other updates are not automatically installed.
+
+- **Group Policy**. You can set up and manage Windows Update by using the settings available in Group Policy, in the following path: **Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates**
+
+- The **AUOptions** registry key. The following two values allow Windows Update to automatically download and install definition updates.
+
+ - **4** Install updates automatically. This value results in all updates being automatically installed, including Windows Defender definition updates.
+
+ - **3** Download updates but let me choose whether to install them. This value allows Windows Defender to download and install definition updates automatically, but other updates are not automatically installed.
+
+To ensure that protection from malware is maintained, we recommend that you enable the following services:
+
+- Windows Defender Network Inspection service
+
+- Windows Error Reporting service
+
+- Windows Update service
+
+The following table lists the services for Windows Defender and the dependent services.
+
+|Service Name|File Location|Description|
+|--------|---------|--------|
+|Windows Defender Service (Windefend)|C:\Program Files\Windows Defender\MsMpEng.exe|This is the main Windows Defender Antivirus service that needs to be running at all times.|
+|Windows Defender Network Inspection Service (Wdnissvc)|C:\Program Files\Windows Defender\NisSrv.exe|This service is invoked when Windows Defender Antivirus encounters a trigger to load it.|
+|Windows Error Reporting Service (Wersvc)|C:\WINDOWS\System32\svchost.exe -k WerSvcGroup|This service sends error reports back to Microsoft.|
+|Windows Firewall (MpsSvc)|C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork|We recommend leaving the Windows Firewall service enabled.|
+|Windows Update (Wuauserv)|C:\WINDOWS\system32\svchost.exe -k netsvcs|Windows Update is needed to get definition updates and antimalware engine updates|
+
+
+
+
+## Submit Samples
+Sample submission allows Microsoft to collect samples of potentially malicious software. To help provide continued and up-to-date protection, Microsoft researchers use these samples to analyze suspicious activities and produce updated antimalware definitions.
+
+We collect program executable files, such as .exe files and .dll files. We do not collect files that contain personal data, like Microsoft Word documents and PDF files.
+
+### Enable automatic sample submission
+
+- To enable automatic sample submission, start a Windows PowerShell console as an administrator, and set the **SubmitSamplesConsent** value data according to one of the following settings:
+
+ - **0** Always prompt. The Windows Defender service prompts you to confirm submission of all required files. This is the default setting for Windows Defender, but is not recommended for Windows Server 2016 installations without a GUI.
+
+ - **1** Send safe samples automatically. The Windows Defender service sends all files marked as "safe" and prompts for the remainder of the files.
+
+ - **2** Never send. The Windows Defender service does not prompt and does not send any files.
+
+ - **3** Send all samples automatically. The Windows Defender service sends all files without a prompt for confirmation.
+
+
+## Configure automatic exclusions
+To help ensure security and performance, certain exclusions are automatically added based on the roles and features you install when using Windows Defender AV on Server 2016.
+
+See the [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) topic for more information.
+
+
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
\ No newline at end of file
+- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
+
+
diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
index cbdd0a70de..17cfdf7f54 100644
--- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
+++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md
@@ -1,5 +1,5 @@
---
-title: Create a Windows Information Protection (WIP) with enrollment policy using the classic console for Microsoft Intune (Windows 10)
+title: Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune (Windows 10)
description: Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
ms.assetid: 4b307c99-3016-4d6a-9ae7-3bbebd26e721
ms.prod: w10
@@ -10,7 +10,7 @@ author: eross-msft
localizationpriority: high
---
-# Create a Windows Information Protection (WIP) using the classic console for Microsoft Intune
+# Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
**Applies to:**
diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md
index c963eb975e..460964a3ed 100644
--- a/windows/whats-new/contribute-to-a-topic.md
+++ b/windows/whats-new/contribute-to-a-topic.md
@@ -31,7 +31,7 @@ If you've previously contributed to topics in the Microsoft repositories, congra
5. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see:
- - **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide)
+ - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring)
- **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/)
+ 
+ 
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ ++
+ 
+ 
+ 
+ 
+ 
+