mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-07 18:17:22 +00:00
Merge pull request #5477 from MicrosoftDocs/dh-windows-docs-pr-col-abs2
columnandabsfixes
This commit is contained in:
Thomas Raya
GitHub
commit
68846b5887
File diff suppressed because it is too large
Load Diff
@ -89,12 +89,12 @@ Administrators can test whether applying the same restriction earlier versions o
|
||||
|
||||
In other words, the hotfix in each KB article provides the necessary code and functionality, but you need to configure the restriction after you install the hotfix—no restrictions are enabled by default after the hotfix is installed on earlier versions of Windows.
|
||||
|
||||
| |Default SDDL |Translated SDDL| Comments
|
||||
| |Default SDDL |Translated SDDL| Comments |
|
||||
|---|---|---|---|
|
||||
|Windows Server 2016 (or later) domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.|
|
||||
|Earlier domain controller |-|-|No access check is performed by default.|
|
||||
|Windows 10, version 1607 (or later) non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18) <br>Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18) <br>DACL: <br>• Revision: 0x02 <br>• Size: 0x0020 <br>• Ace Count: 0x001 <br>• Ace[00]------------------------- <br> AceType:0x00 <br> (ACCESS\_ALLOWED_ACE_TYPE)<br> AceSize:0x0018 <br> InheritFlags:0x00 <br> Access Mask:0x00020000 <br> AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544) <br><br> SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. |
|
||||
|Earlier non-domain controller |-|-|No access check is performed by default.|
|
||||
|**Windows Server 2016 (or later) domain controller (reading Active Directory)**|“”|-|Everyone has read permissions to preserve compatibility.|
|
||||
|**Earlier domain controller** |-|-|No access check is performed by default.|
|
||||
|**Windows 10, version 1607 (or later) non-domain controller**|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18) <br>Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18) <br>DACL: <br>• Revision: 0x02 <br>• Size: 0x0020 <br>• Ace Count: 0x001 <br>• Ace[00]------------------------- <br> AceType:0x00 <br> (ACCESS\_ALLOWED_ACE_TYPE)<br> AceSize:0x0018 <br> InheritFlags:0x00 <br> Access Mask:0x00020000 <br> AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544) <br><br> SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. |
|
||||
|**Earlier non-domain controller** |-|-|No access check is performed by default.|
|
||||
|
||||
## Policy management
|
||||
|
||||
|
||||
@ -45,7 +45,7 @@ A Windows Defender Application Control (WDAC) policy logs events locally in Wind
|
||||
| 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the script hosts themselves. Note: there is no WDAC enforcement on third-party script hosts. |
|
||||
| 8029 | Block script/MSI file |
|
||||
| 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](allow-com-object-registration-in-windows-defender-application-control-policy.md). |
|
||||
| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | |
|
||||
| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". |
|
||||
|
||||
## Optional Intelligent Security Graph (ISG) or Managed Installer (MI) diagnostic events
|
||||
|
||||
@ -117,7 +117,7 @@ A list of other relevant event IDs and their corresponding description.
|
||||
|
||||
| Event ID | Description |
|
||||
|-------|------|
|
||||
| 3001 | An unsigned driver was attempted to load on the system. |
|
||||
| 3001 | An unsigned driver was attempted to load on the system. |
|
||||
| 3002 | Code Integrity could not verify the boot image as the page hash could not be found. |
|
||||
| 3004 | Code Integrity could not verify the file as the page hash could not be found. |
|
||||
| 3010 | The catalog containing the signature for the file under validation is invalid. |
|
||||
@ -127,27 +127,27 @@ A list of other relevant event IDs and their corresponding description.
|
||||
| 3024 | Windows application control was unable to refresh the boot catalog file. |
|
||||
| 3026 | The catalog loaded is signed by a signing certificate that has been revoked by Microsoft and/or the certificate issuing authority. |
|
||||
| 3033 | The file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3034 | The file under validation would not meet the requirements to pass the application control policy if the policy was enforced. The file was allowed since the policy is in audit mode. |
|
||||
| 3034 | The file under validation would not meet the requirements to pass the application control policy if the policy was enforced. The file was allowed since the policy is in audit mode. |
|
||||
| 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. |
|
||||
| 3064 | If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. |
|
||||
| 3065 | [Ignored] If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. |
|
||||
| 3064 | If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. |
|
||||
| 3065 | [Ignored] If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. |
|
||||
| 3074 | Page hash failure while hypervisor-protected code integrity was enabled. |
|
||||
| 3075 | This event monitors the performance of the Code Integrity policy check a file. |
|
||||
| 3079 | The file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3080 | If the policy was in enforced mode, the file under validation would not have met the requirements to pass the application control policy. |
|
||||
| 3081 | The file under validation did not meet the requirements to pass the application control policy. |
|
||||
| 3082 | If the policy was in enforced mode, the non-WHQL driver would have been denied by the policy. |
|
||||
| 3082 | If the policy was in enforced mode, the non-WHQL driver would have been denied by the policy. |
|
||||
| 3084 | Code Integrity will enforce the WHQL Required policy setting on this session. |
|
||||
| 3085 | Code Integrity will not enforce the WHQL Required policy setting on this session. |
|
||||
| 3086 | The file under validation does not meet the signing requirements for an isolated user mode (IUM) process. |
|
||||
| 3095 | This Code Integrity policy cannot be refreshed and must be rebooted instead. |
|
||||
| 3097 | The Code Integrity policy cannot be refreshed. |
|
||||
| 3095 | This Code Integrity policy cannot be refreshed and must be rebooted instead. |
|
||||
| 3097 | The Code Integrity policy cannot be refreshed. |
|
||||
| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. |
|
||||
| 3101 | Code Integrity started refreshing the policy. |
|
||||
| 3102 | Code Integrity finished refreshing the policy. |
|
||||
| 3103 | Code Integrity is ignoring the policy refresh. |
|
||||
| 3104 | The file under validation does not meet the signing requirements for a PPL (protected process light) process. |
|
||||
| 3105 | Code Integrity is attempting to refresh the policy. |
|
||||
| 3101 | Code Integrity started refreshing the policy. |
|
||||
| 3102 | Code Integrity finished refreshing the policy. |
|
||||
| 3103 | Code Integrity is ignoring the policy refresh. |
|
||||
| 3104 | The file under validation does not meet the signing requirements for a PPL (protected process light) process. |
|
||||
| 3105 | Code Integrity is attempting to refresh the policy. |
|
||||
| 3108 | Windows mode change event was successful. |
|
||||
| 3110 | Windows mode change event was unsuccessful. |
|
||||
| 3111 | The file under validation did not meet the hypervisor-protected code integrity (HVCI) policy. |
|
||||
| 3111 | The file under validation did not meet the hypervisor-protected code integrity (HVCI) policy. |
|
||||
|
||||
@ -29,7 +29,7 @@ Microsoft has strict requirements for code running in kernel. Consequently, mali
|
||||
- Hypervisor-protected code integrity (HVCI) enabled devices
|
||||
- Windows 10 in S mode (S mode) devices
|
||||
|
||||
Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events.
|
||||
Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events.
|
||||
|
||||
> [!Note]
|
||||
> This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. It is recommended that this policy be first validated in audit mode before rolling the rules into enforcement mode.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user