From cfa97c0011078c0f673d1025762e8f329002e6f5 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 3 Aug 2020 08:21:11 -0700 Subject: [PATCH 01/36] Edit pass: provisioning-create-package Changes coming, do not review/merge yet. --- .../provisioning-packages/provisioning-create-package.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 035bdf4010..3c75f63d1f 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -21,12 +21,12 @@ manager: dansimp - Windows 10 - Windows 10 Mobile -You use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. +You can use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings, and then apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. >[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) ->[!TIP] ->We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. +> [!TIP] +> We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. ## Start a new project From a75c6ecfffa08ea71fe6c5ddfb10ff6a4267ad4d Mon Sep 17 00:00:00 2001 From: Adam Gross Date: Wed, 5 Aug 2020 10:36:42 -0500 Subject: [PATCH 02/36] Updated several app names that have changed I have updated the names of several apps. Can someone also update this list for Windows 10 2004? --- .../application-management/apps-in-windows-10.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index c27ad32063..9d150d9583 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -51,13 +51,13 @@ Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, a | Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | x | x | x | No | | Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.MicrosoftOfficeHub | [My Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | Yes | +| Microsoft.MicrosoftOfficeHub | [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | Yes | | Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | Yes | | Microsoft.MicrosoftStickyNotes | [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | x | x | x | No | | Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Office.OneNote | [OneNote](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.OneConnect | [Paid Wi-Fi & Cellular](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.Office.OneNote | [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | Yes | +| Microsoft.OneConnect | [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Outlook.DesktopIntegrationServices | | | | | x | | | Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | No | @@ -77,10 +77,10 @@ Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, a | Microsoft.WindowsMaps | [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.WindowsSoundRecorder | [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.WindowsStore | [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Xbox.TCUI | [Xbox TCUI](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxApp | [Xbox](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGameOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGamingOverlay | [Xbox Gaming Overlay](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.Xbox.TCUI | [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.XboxApp | [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.XboxGameOverlay | [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | No | +| Microsoft.XboxGamingOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.XboxIdentityProvider | [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.XboxSpeechToTextOverlay | | x | x | x | x | No | | Microsoft.YourPhone | [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | | x | x | x | No | From e401b14fa5746aabd67000c2180a87ef70b3b772 Mon Sep 17 00:00:00 2001 From: Russ Rimmerman Date: Sat, 8 Aug 2020 19:56:12 -0500 Subject: [PATCH 03/36] Update open-the-group-policy-management-console-to-windows-firewall.md This heading doesn't seem to make sense and it's lacking sufficient wording in the navigation pane --- ...e-group-policy-management-console-to-windows-firewall.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md index bce220a506..134a6bb928 100644 --- a/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md +++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md @@ -1,6 +1,6 @@ --- -title: Open a GPO to Windows Defender Firewall (Windows 10) -description: Open the Group Policy Management Console to Windows Defender Firewall with Advanced Security +title: Group Policy Management of Windows Defender Firewall (Windows 10) +description: Group Policy Management of Windows Defender Firewall with Advanced Security ms.assetid: 5090b2c8-e038-4905-b238-19ecf8227760 ms.reviewer: ms.author: dansimp @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 04/02/2017 --- -# Open the Group Policy Management Console to Windows Defender Firewall +# Group Policy Management of Windows Defender Firewall **Applies to** - Windows 10 From 0556754e06163a59cb6327d134f90fa04f54ce34 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 12 Aug 2020 09:39:45 +0500 Subject: [PATCH 04/36] Update bitlocker-to-go-faq.md --- .../information-protection/bitlocker/bitlocker-to-go-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index e8bd11f12b..275443414a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -24,7 +24,7 @@ ms.date: 07/10/2018 ## What is BitLocker To Go? -BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. +BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](https://docs.microsoft.com/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements). As with BitLocker, drives that are encrypted using BitLocker To Go can be opened with a password or smart card on another computer by using **BitLocker Drive Encryption** in Control Panel. From 6a3aabb8663ecefec0c988147f4beea056cd1ac4 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 12 Aug 2020 17:13:42 +0500 Subject: [PATCH 05/36] Update network-access-restrict-clients-allowed-to-make-remote-sam-calls.md --- ...ccess-restrict-clients-allowed-to-make-remote-sam-calls.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md index f5a0e5c08f..ed9022b411 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -91,9 +91,9 @@ In other words, the hotfix in each KB article provides the necessary code and fu | |Default SDDL |Translated SDDL| Comments |---|---|---|---| -|Windows Server 2016 domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.| +|Windows Server 2016 (or later) domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.| |Earlier domain controller |-|-|No access check is performed by default.| -|Windows 10, version 1607 non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
  AceType:0x00
  (ACCESS\_ALLOWED_ACE_TYPE)
  AceSize:0x0018
  InheritFlags:0x00
  Access Mask:0x00020000
  AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

  SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. | +|Windows 10, version 1607 (or later) non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
  AceType:0x00
  (ACCESS\_ALLOWED_ACE_TYPE)
  AceSize:0x0018
  InheritFlags:0x00
  Access Mask:0x00020000
  AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

  SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. | |Earlier non-domain controller |-|-|No access check is performed by default.| ## Policy management From 69428242703c27f768b02fcd5b8845563324f56a Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 12 Aug 2020 14:26:33 -0700 Subject: [PATCH 06/36] adding topic, started formatting --- .../troubleshooting-uwp-firewall.md | 2074 +++++++++++++++++ 1 file changed, 2074 insertions(+) create mode 100644 windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md new file mode 100644 index 0000000000..dbc2f8af22 --- /dev/null +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -0,0 +1,2074 @@ +--- +title: Troubleshooting UWP App Connectivity Issues in Windows Firewall +description: Troubleshooting UWP App Connectivity Issues in Windows Firewall + +ms.reviewer: +ms.author: dansimp +ms.prod: w10 +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: dansimp +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: troubleshooting +--- + +# Troubleshooting UWP App Connectivity Issues + +This document is intended to help network admins, support engineers, and developers to +investigate UWP app network connectivity issues. + +# Introduction + +This document guides you through steps to debug different Universal Windows Platform (UWP) app network connectivity issues by providing practical case examples. + +UWP app network connectivity issues typically stem from one of the following causes: + +1. The UWP app was not permitted to receive loopback traffic (this must be configured as, by default, a UWP app is not allowed to receive loopback traffic). +2. The UWP app is missing the proper capability tokens. +3. The private range is configured incorrectly (i.e. set incorrectly through GP/MDM policies, etc.) + +To understand these causes more thoroughly, there are several concepts that should be reviewed. + +The traffic of network packets (e.g. what's permitted and what’s not) on Windows is ultimately determined by the Windows Filtering Platform (WFP). When a UWP app +or the private range is configured incorrectly, it affects how the UWP app’s network traffic will be processed by WFP. + +When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet does not match the filter conditions of any filters, leading the packet to be dropped by a default block filter. The presence of the default block +filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that does not have the correct capabilities for the resource it is trying to reach, ensuring the application’s granular access to each resource type and preventing the application from “escaping” its environment. + +For more information on the filter arbitration algorithm and network isolation, +please read [Filter +Arbitration](https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) +and +[Isolation](https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation). + +The next sections will cover debugging case examples for loopback and +non-loopback UWP app network connectivity issues. + +> [!NOTE] +> As improvements to debugging and diagnostics around the Windows Filtering Platform are made, the trace examples in this document may not exactly match the +traces collected on an older Windows build. + +# Debugging UWP App Loopback scenarios + +If you have a scenario where you are establishing a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. + +To enable loopback for client outbound connections, run the following in a command prompt: + +`CheckNetIsolation.exe LoopbackExempt -a -n=\` + +To enable loopback for server inbound connections, please run the following in a +command prompt: + +`CheckNetIsolation.exe LoopbackExempt -is -n=\` + +You can ensure loopback is enabled by checking the appx manifests of both the +sender and receiver. + +For more information about loopback scenarios, please read [Communicating with +localhost +(loopback)](https://docs.microsoft.com/en-us/windows/iot-core/develop-your-app/loopback) + +# Debugging Live Drops + +If the issue happened recently, but you find you are not able to reproduce the +issue, go to Debugging Past Drops for the appropriate trace commands. + +If you can consistently reproduce the issue, then you can run the following in +an admin command prompt to gather a fresh trace: + +``` +Netsh wfp capture start keywords=19 +\ +Netsh wfp capture stop +``` + +The above commands will generate a wfpdiag.cab. Inside the .cab exists a +wfpdiag.xml, which contains any allow or drop netEvents and filters that existed +during that repro. Without “keywords=19”, the trace will only collect drop +netEvents. + +Inside the wfpdiag.xml, search for netEvents which have +FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant +drop events, search for the drop events with matching destination IP address, +package SID, or application ID name. The characters in the application ID name +will be separated by periods: +``` +(ex) + +\ + +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... + +\ +``` +The netEvent will have more information about the packet that was dropped +including information about its capabilities, the filter that dropped the +packet, and much more. + +## Case 1: UWP app connects to Internet target address with all capabilities + +In this example, the UWP app successfully connects to bing.com +[2620:1ec:c11::200]. + +A packet from a UWP app needs the correct networking capability token for the +resource it is trying to reach. + +In this scenario, the app could successfully send a packet to the Internet +target because it had an Internet capability token. + +The following shows the allow netEvent of the app connecting to the target IP. +The netEvent contains information about the packet including its local address, +remote address, capabilities, etc. + +```**Classify Allow netEvent, Wfpdiag-Case-1.xml** + +\ +\ +> \2020-05-21T17:25:59.070Z\ +> \ +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ +> \ +> \FWP_IP_VERSION_V6\ +> \6\ +> \2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ +\52127\ +\443\ +\0\ +\ +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ +\ +\S-1-5-21-2993214446-1947230185-131795049-1000\ +\FWP_AF_INET6\ +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ +\ +\0\ +\ +\ +\FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ +\ +> \125918\ +> \50\ +> \0\ +> \1\ +> \1\ +\ +\ +\ +\0000000000000000\ +\ +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ +> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ +\ +\0\ +\ +\ +> \ + \125918\ +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + \FWP_ACTION_PERMIT\ +> \ +> \ + \121167\ + \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + \FWP_ACTION_PERMIT\ + \ +\ +\ +\ +``` + +The following is the filter that permitted the packet to be sent to the target +address according to the terminatingFiltersInfo in the netEvent. This packet was +allowed by Filter \#125918 which is from the InternetClient Default Rule. + +**InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** +``` +\ + +> \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ + +> \ + +> \InternetClient Default Rule\ + +> \InternetClient Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \ad2b000000000000\ + +> \.+......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_RANGE\ + +> \ + +> \FWP_RANGE_TYPE\ + +> \ + +> \ + +> \FWP_BYTE_ARRAY16_TYPE\ + +> \::\ + +> \ + +> \ + +> \FWP_BYTE_ARRAY16_TYPE\ + +> \ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\ + +> \ + +> \ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \125918\ + +> \ + +> \FWP_UINT64\ + +> \103079219136\ + +> \ + +\ +``` +One condition is + +**Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** +``` +\ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +\ +``` +which is the condition for checking capabilities in this filter. + +The important part of this condition is S-1-15-3-1, which is the capability SID +for INTERNET_CLIENT privileges. + +From the netEvent’s capabilities section, +``` +Capabilities from netEvent, Wfpdiag-Case-1.xml + +\ + +> **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + +\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +\ +``` +it shows the packet came from an app with an Internet client token +(FWP_CAPABILITIES_FLAG_INTERNET_CLIENT) which matches the capability SID in the +filter. All the other conditions are also met for the filter, so the packet is +allowed. + +Something to note is that the only capability token required for the packet to +reach bing.com was the Internet client token, even though this example showed +the packet having all capabilities. + +## Case 2: UWP APP cannot reach Internet target address and has no capabilities + +In this example, the UWP app is unable to connect to bing.com +[2620:1ec:c11::200]. + +The following is a drop netEvent that was captured in the traces during this +repro. + +**Classify Drop netEvent, Wfpdiag-Case-2.xml** +``` +\ +\ +\2020-03-30T23:53:09.720Z\ +\ +\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ +\FWPM_NET_EVENT_FLAG_APP_ID_SET\ +\FWPM_NET_EVENT_FLAG_USER_ID_SET\ +\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ +\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ +\ +\FWP_IP_VERSION_V6\ +\6\ +\2001:4898:1a:1045:8469:3351:e6e2:543\ +\2620:1ec:c11::200\ +\63187\ +\443\ +\0\ +\ +\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0034002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ +\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...4...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ +\ +\S-1-5-21-2788718703-1626973220-3690764900-1000\ +\FWP_AF_INET6\ +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ +\ +\0\ +\ +\ +\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ +\ +\68893\ +\50\ +\0\ +\1\ +\1\ +\MS_FWP_DIRECTION_OUT\ +\false\ +\ +\0\ +\0\ +\ +\ +\ +\0000000000000000\ +\ +\0\ +\ +\ +\ +\68893\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ +\FWP_ACTION_BLOCK\ +\ +\ +\68879\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ +\FWP_ACTION_PERMIT\ +\ +\ +\ +\ +``` +The first thing that should be checked in the netEvent is the capabilities +field\*. In this example, the capabilities field is empty, indicating that the +UWP app was not configured with any capability tokens to allow it to connect to +a network. + +**Internal Fields from netEvent, Wfpdiag-Case-2.xml** +``` +\ +\ +\0000000000000000\ +**\** +\0\ +\ +\ +\ +\68893\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ +\FWP_ACTION_BLOCK\ +\ +\ +\68879\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ +\FWP_ACTION_PERMIT\ +\ +\ +\ +``` +The netEvent also gives us information about the filter that explicitly dropped +this packet, like the FilterId, listed under classify drop + +**Classify Drop from netEvent, Wfpdiag-Case-2.xml** +``` +\ +**\68893\** +\50\ +\0\ +\1\ +\1\ +\MS_FWP_DIRECTION_OUT\ +\false\ +\ +\0\ +\0\ +\ +``` +If we search for that filter, \#68893, in Wfpdiag-Case2.xml, we will see that +the packet was dropped by a Block Outbound Default Rule filter. + +**Block Outbound Default Rule Filter \#68893, Wfpdiag-Case-2.xml** + +``` +\ +> \{6d51582f-bcf8-42c4-afc9-e2ce7155c11b}\ +> \ +> \**Block Outbound Default Rule**\ +> \Block Outbound Default Rule\ +> \ +> \ +> \{4b153735-1049-4480-aab4-d1b9bdc03710}\ +> \ +> \b001000000000000\ +> \........\ +> \ +> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ +> \{b3cdd441-af90-41ba-a745-7c6008ff2300}\ +> \ +> \FWP_EMPTY\ +> \ +> \ +> \ +> \FWPM_CONDITION_ALE_PACKAGE_ID\ +> \FWP_MATCH_NOT_EQUAL\ +> \ +> \FWP_SID\ +> \S-1-0-0\ +> \ +> \ +> \ +> \ +> \FWP_ACTION_BLOCK\ +> \ +> \ +> \0\ +> \ +> \68893\ +> \ +> \FWP_UINT64\ +> \68719476736\ +> \ +\ +``` + +A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and thus not allowed by the other filters in +the same sublayer. + +If the packet had the correct capability token, +FWP_CAPABILITIES_FLAG_INTERNET_CLIENT, it would have matched a condition for a +non-default block filter and would have been permitted to reach bing.com. +Without the correct capability tokens, the packet will be explicitly dropped by +a default block outbound filter. + +## Case 3: UWP app cannot reach Internet target address without Internet Client capability + +In this example, the app is unable to connect to bing.com [2620:1ec:c11::200]. + +The app in this scenario only has private network capabilities (Client and +Server). The app is trying to connect to an Internet resource (bing.com), but +only has a private network token. Therefore, the packet will be dropped. + +**Classify Drop netEvent, Wfpdiag-Case-3.xml** +``` +\ +\ +\2020-03-31T16:57:18.570Z\ +\ +\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ +\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ +\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ +\FWPM_NET_EVENT_FLAG_APP_ID_SET\ +\FWPM_NET_EVENT_FLAG_USER_ID_SET\ +\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ +\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ +\ +\FWP_IP_VERSION_V6\ +\6\ +\2001:4898:1a:1045:9c65:7805:dd4a:cc4b\ +\2620:1ec:c11::200\ +\64086\ +\443\ +\0\ +\ +\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0035002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ +\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...5...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ +\ +\S-1-5-21-2788718703-1626973220-3690764900-1000\ +\FWP_AF_INET6\ +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ +\ +\0\ +\ +\ +\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ +\ +\68893\ +\50\ +\0\ +\1\ +\1\ +\MS_FWP_DIRECTION_OUT\ +\false\ +\ +\0\ +\0\ +\ +\ +\ +\0000000000000000\ +**\** +**\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\** +**\** +\0\ +\ +\ +\ +\68893\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ +\FWP_ACTION_BLOCK\ +\ +\ +\68879\ +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ +\FWP_ACTION_PERMIT\ +\ +\ +\ +\ +``` + +## Case 4: UWP app cannot reach Intranet target address without Private Network capability + +In this example, the UWP app is unable to reach the Intranet target address, +10.50.50.50, because it does not have a Private Network capability. + +**Classify Drop netEvent, Wfpdiag-Case-4.xml** + +\ + +\ + +> \2020-05-22T21:29:28.601Z\ + +> \ + +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +> \ + +> \FWP_IP_VERSION_V4\ + +> \6\ + +> \10.216.117.17\ + +> \10.50.50.50\ + +> \52998\ + +> \53\ + +> \0\ + +> \ + +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +> \ + +> \S-1-5-21-2993214446-1947230185-131795049-1000\ + +> \FWP_AF_INET\ + +> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +> \ + +> \0\ + +> \ + +\ + +> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ + +> \ + +> \121180\ + +> \48\ + +> \0\ + +> \1\ + +> \1\ + +> \MS_FWP_DIRECTION_OUT\ + +> \false\ + +> \ + +> \0\ + +> \0\ + +\ + +\ + +> \ + +> \0000000000000000\ + +> \ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + +> \ + +> \0\ + +> \ + +> \ + +> \ + +> \121180\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +> \FWP_ACTION_BLOCK\ + +> \ + +> \ + +> \121165\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +\ + +\ + +## Case 5: UWP app cannot reach “Intranet” target address with Private Network capability + +In this example, the UWP app is unable to reach the Intranet target address, +10.1.1.1, even though it has a Private Network capability token. + +**Classify Drop netEvent, Wfpdiag-Case-5.xml** + +\ + +> \ + +> \2020-05-22T20:54:53.499Z\ + +> \ + +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +> \ + +> \FWP_IP_VERSION_V4\ + +> \6\ + +> \10.216.117.17\ + +> \10.1.1.1\ + +> \52956\ + +> \53\ + +> \0\ + +> \ + +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +> \ + +> \S-1-5-21-2993214446-1947230185-131795049-1000\ + +> \FWP_AF_INET\ + +> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +> \ + +> \0\ + +> \ + +\ + +> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ + +> \ + +> \121180\ + +> \48\ + +> \0\ + +> \1\ + +> \1\ + +> \MS_FWP_DIRECTION_OUT\ + +> \false\ + +> \ + +> \0\ + +> \0\ + +> \ + +> \ + +> \ + +> \0000000000000000\ + +> \ + +> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +> \ + +> \0\ + +> \ + +> \ + +> \ + +> \121180\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +> \FWP_ACTION_BLOCK\ + +> \ + +> \ + +> \121165\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \ + +\ + +The following shows the filter that blocked the event: + +**Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** + +\ + +> \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ + +> \ + +> \Block Outbound Default Rule\ + +> \Block Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \c029000000000000\ + +> \.)......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_BLOCK\ + +> \ + +> \ + +> \0\ + +> \ + +> \121180\ + +> \ + +> \FWP_UINT64\ + +> \274877906944\ + +> \ + +\ + +If the target was in the private range, then it should have been allowed by a +PrivateNetwork Outbound Default Rule filter. + +The following PrivateNetwork Outbound Default Rule filters have conditions for +matching Intranet IP addresses. Since the expected Intranet target address, +10.1.1.1, is not included in these filters it becomes clear that the address is +not in the private range. Check the policies which configure the private range +on the machine (MDM, GP, etc) and make sure it includes the private target +address you wanted to reach. + +**PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** + +\ + +> \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ + +> \ + +> \PrivateNetwork Outbound Default Rule\ + +> \PrivateNetwork Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \f22d000000000000\ + +> \.-......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1.1.1.1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \129656\ + +> \ + +> \FWP_UINT64\ + +> \144115600392724416\ + +> \ + +> \ + +> \ + +> \{b11b4f8a-222e-49d6-8d69-02728681d8bc}\ + +> \ + +> \PrivateNetwork Outbound Default Rule\ + +> \PrivateNetwork Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \f22d000000000000\ + +> \.-......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_RANGE\ + +> \ + +> \FWP_RANGE_TYPE\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \172.16.0.0\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \172.31.255.255\ + +> \ + +> \ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \129657\ + +> \ + +> \FWP_UINT64\ + +> \36029209335832512\ + +> \ + +\ + +\ + +> \{21cd82bc-6077-4069-94bf-750e5a43ca23}\ + +> \ + +> \PrivateNetwork Outbound Default Rule\ + +> \PrivateNetwork Outbound Default Rule\ + +> \ + +> \ + +> \FWPM_PROVIDER_MPSSVC_WSH\ + +> \ + +> \f22d000000000000\ + +> \.-......\ + +> \ + +> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +> \FWPM_SUBLAYER_MPSSVC_WSH\ + +> \ + +> \FWP_EMPTY\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_PACKAGE_ID\ + +> \FWP_MATCH_NOT_EQUAL\ + +> \ + +> \FWP_SID\ + +> \S-1-0-0\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + +> \FWP_MATCH_RANGE\ + +> \ + +> \FWP_RANGE_TYPE\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \192.168.0.0\ + +> \ + +> \ + +> \FWP_UINT32\ + +> \192.168.255.255\ + +> \ + +> \ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_CURRENT_PROFILE_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_UINT32\ + +> \1\ + +> \ + +> \ + +> \ + +> \FWPM_CONDITION_ALE_USER_ID\ + +> \FWP_MATCH_EQUAL\ + +> \ + +> \FWP_SECURITY_DESCRIPTOR_TYPE\ + +> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ + +> \ + +> \ + +> \ + +> \ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \0\ + +> \ + +> \129658\ + +> \ + +> \FWP_UINT64\ + +> \36029209335832512\ + +> \ + +\ + +# Debugging Past Drops + +If you are debugging a network drop from the past or from a remote machine, you +may have traces already collected from Feedback Hub, such as nettrace.etl and +wfpstate.xml. Once nettrace.etl is converted, nettrace.txt will have the +netEvents of the reproduced event, and wfpstate.xml will contain the filters +that were present on the machine at the time. + +If you **do not** have a live repro or traces already collected, you can still +collect traces after the UWP network connectivity issue has happened by running +these commands in an Admin command prompt + +> \ + +> Netsh wfp show netevents + +> Netsh wfp show state + +“Netsh wfp show netevents” will generate netevents.xml, which contains the past +net events. “Netsh wfp show state” will generate wfpstate.xml, which contains +the current filters present on the machine. + +Unfortunately, collecting traces after the UWP network connectivity issue is not +always reliable. + +NetEvents on the machine are stored in a buffer. Once that buffer has reached +max capacity, the buffer will overwrite older net events. Due to the buffer +overwrite, it is possible that the collected netevents.xml will not contain the +net event associated with the UWP network connectivity issue if it was +overwritten. Additionally, filters on the machine can get deleted and re-added +with different filterIds due to miscellaneous events on the machine. Because of +this, a filterId from “netsh wfp show netevents” may not necessarily match any +filter in “netsh wfp show state” because that filterId may be outdated. + +If you can reproduce the UWP network connectivity issue consistently, we would +recommend using the commands from Debugging Live Drops instead. + +Additionally, you can still follow the examples from Debugging Live Drops +section using the trace commands in this section, even if you do not have a live +repro. The netEvents and filters are stored in one file in Debugging Live Drops +as opposed to two separate files in the following Debugging Past Drops examples. + +## Case 7: Debugging Past Drop - UWP app cannot reach Internet target address and has no capabilities + +In this example, the UWP app is unable to connect to bing.com. + +Classify Drop Net Event, NetEvents-Case-7.xml + +\ + +\ + +\2020-05-04T22:04:07.039Z\ + +\ + +\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +\FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +\FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +\ + +\FWP_IP_VERSION_V4\ + +\6\ + +\10.195.36.30\ + +\204.79.197.200\ + +\57062\ + +\443\ + +\0\ + +\ + +\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +\ + +\S-1-5-21-1578316205-4060061518-881547182-1000\ + +\FWP_AF_INET\ + +\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +\ + +\0\ + +\ + +\ + +\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ + +\ + +\206064\ + +\48\ + +\0\ + +\1\ + +\1\ + +\MS_FWP_DIRECTION_OUT\ + +\false\ + +\ + +\0\ + +\0\ + +\ + +\ + +\ + +\0000000000000000\ + +\ + +\0\ + +\ + +\ + +\ + +\206064\ + +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +\FWP_ACTION_BLOCK\ + +\ + +\ + +\206049\ + +\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +\FWP_ACTION_PERMIT\ + +\ + +\ + +\ + +\ + +The Internal fields lists no active capabilities, and the packet is dropped at +filter 206064. + +This is a default block rule filter, meaning the packet passed through every +filter that could have allowed it, but because conditions didn’t match for any +those filters, the packet fell to the filter which blocks any packet that the +Security Descriptor doesn’t match. + +**Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** + +\ + +\{f138d1ad-9293-478f-8519-c3368e796711}\ + +\ + +\Block Outbound Default Rule\ + +\Block Outbound Default Rule\ + +\ + +\ + +\FWPM_PROVIDER_MPSSVC_WSH\ + +\ + +\2e65000000000000\ + +\.e......\ + +\ + +\FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + +\FWPM_SUBLAYER_MPSSVC_WSH\ + +\ + +\FWP_EMPTY\ + +\ + +\ + +\ + +\FWPM_CONDITION_ALE_PACKAGE_ID\ + +\FWP_MATCH_NOT_EQUAL\ + +\ + +\FWP_SID\ + +\S-1-0-0\ + +\ + +\ + +\ + +\ + +\FWP_ACTION_BLOCK\ + +\ + +\ + +\0\ + +\ + +\206064\ + +\ + +\FWP_UINT64\ + +\274877906944\ + +\ + +\ + +## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities + +In this example, the UWP app successfully connects to bing.com [204.79.197.200]. + +**Classify Allow Net Event, NetEvents-Case-8.xml** + +\ + +> \ + +> \2020-05-04T18:49:55.101Z\ + +> \ + +> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + +> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + +> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ + +> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + +> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + +> \ + +> \FWP_IP_VERSION_V4\ + +> \6\ + +> \10.195.36.30\ + +> \204.79.197.200\ + +> \61673\ + +> \443\ + +> \0\ + +> \ + +> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + +> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +> \ + +> \S-1-5-21-1578316205-4060061518-881547182-1000\ + +> \FWP_AF_INET\ + +> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +> \ + +> \0\ + +> \ + +> \ + +> \FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ + +> \ + +> \208757\ + +> \48\ + +> \0\ + +> \1\ + +> \1\ + +> \ + +> \ + +> \ + +> \0000000000000000\ + +> \ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ + +> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + +> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +> \ + +> \0\ + +> \ + +> \ + +> \ + +> \208757\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \206049\ + +> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + +> \FWP_ACTION_PERMIT\ + +> \ + +> \ + +> \ + +\ + +Important things to note: all capabilities are enabled and the resulting filter +determining the flow of the packet is 208757. + +The filter stated above with action permit: + +**InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** + + \ + + \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ + + \ + + \InternetClient Default Rule\ + + \InternetClient Default Rule\ + + \ + + \ + + \FWPM_PROVIDER_MPSSVC_WSH\ + + \ + + \e167000000000000\ + + \.g......\ + + \ + + \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ + + \FWPM_SUBLAYER_MPSSVC_WSH\ + + \ + + \FWP_EMPTY\ + + \ + + \ + + \ + + \FWPM_CONDITION_ALE_PACKAGE_ID\ + + \FWP_MATCH_NOT_EQUAL\ + + \ + + \FWP_SID\ + + \S-1-0-0\ + + \ + + \ + + \ + + \FWPM_CONDITION_IP_REMOTE_ADDRESS\ + + \FWP_MATCH_RANGE\ + + \ + + \FWP_RANGE_TYPE\ + + \ + + \ + + \FWP_UINT32\ + + \0.0.0.0\ + + \ + + \ + + \FWP_UINT32\ + + \255.255.255.255\ + + \ + + \ + + \ + + \ + + \ + + \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ + + \FWP_MATCH_EQUAL\ + + \ + + \FWP_UINT32\ + + \1\ + + \ + + \ + + \ + + \FWPM_CONDITION_CURRENT_PROFILE_ID\ + + \FWP_MATCH_EQUAL\ + + \ + + \FWP_UINT32\ + + \1\ + + \ + + \ + + \ + + \FWPM_CONDITION_ALE_USER_ID\ + + \FWP_MATCH_EQUAL\ + + \ + + \FWP_SECURITY_DESCRIPTOR_TYPE\ + + \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ + + \ + + \ + + \ + + \ + + \FWP_ACTION_PERMIT\ + + \ + + \ + + \0\ + + \ + + \208757\ + + \ + + \FWP_UINT64\ + + \412316868544\ + + \ + + \ + +\*The capabilities field in a netEvent was added to the traces in the Windows 10 +May 2019 Update From db87b515c2506dbf18ccf4aa6a60c9bb97527579 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 12 Aug 2020 16:11:04 -0700 Subject: [PATCH 07/36] move topics in toc --- .../threat-protection/windows-firewall/TOC.md | 99 ++++++++++++++----- 1 file changed, 77 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index e3271818c1..791aa26a20 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -1,44 +1,54 @@ # [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) -## [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) -## [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md) -## [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) -## [Design Guide](windows-firewall-with-advanced-security-design-guide.md) + +## [Plan/Design]() + +### [Design Guide](windows-firewall-with-advanced-security-design-guide.md) + ### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) ### [Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) #### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) + ### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) #### [Basic Design](basic-firewall-policy-design.md) #### [Domain Isolation Design](domain-isolation-policy-design.md) #### [Server Isolation Design](server-isolation-policy-design.md) #### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) + ### [Evaluating Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) #### [Basic Design Example](firewall-policy-design-example.md) #### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) #### [Server Isolation Design Example](server-isolation-policy-design-example.md) #### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) + ### [Designing a Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) + #### [Gathering the Info You Need](gathering-the-information-you-need.md) ##### [Network](gathering-information-about-your-current-network-infrastructure.md) ##### [Active Directory](gathering-information-about-your-active-directory-deployment.md) ##### [Computers](gathering-information-about-your-devices.md) ##### [Other Relevant Information](gathering-other-relevant-information.md) #### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-devices.md) + ### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) #### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) + #### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) ##### [Exemption List](exemption-list.md) ##### [Isolated Domain](isolated-domain.md) ##### [Boundary Zone](boundary-zone.md) ##### [Encryption Zone](encryption-zone.md) #### [Planning Server Isolation Zones](planning-server-isolation-zones.md) + #### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) ##### [Documenting the Zones](documenting-the-zones.md) + ##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) ###### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) ###### [Planning Network Access Groups](planning-network-access-groups.md) + ###### [Planning the GPOs](planning-the-gpos.md) ####### [Firewall GPOs](firewall-gpos.md) ######## [GPO_DOMISO_Firewall](gpo-domiso-firewall.md) @@ -50,25 +60,29 @@ ####### [Encryption Zone GPOs](encryption-zone-gpos.md) ######## [GPO_DOMISO_Encryption](gpo-domiso-encryption.md) ####### [Server Isolation GPOs](server-isolation-gpos.md) + ###### [Planning GPO Deployment](planning-gpo-deployment.md) -### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) -## [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) -### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) -### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) -### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) -### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) -### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) -### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) -### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) -### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) -#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) -#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) -#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) -#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) -### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) -#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) + + +## [Deployment guide]() +### [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) +#### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) +#### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) + + + + +## [Best practices]() +### [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md) +### [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) +### [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) + + + + + + +## [How-to]() ### [Procedures Used in This Guide](procedures-used-in-this-guide.md) #### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) #### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) @@ -108,3 +122,44 @@ #### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) #### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) #### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) +#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) + + + + +## [References]() +### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) +### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) +### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) +### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) +### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) +### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) +#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) +#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) +#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) +#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) +### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) +#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) +#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) + +### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) + +### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) + + + +## [Troubleshooting]() + + + + + + + + + + + + + + From 847ebd5a2f280aa41bb1bfaac54ff7f143879238 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 12 Aug 2020 16:25:33 -0700 Subject: [PATCH 08/36] checking in formatting --- .../troubleshooting-uwp-firewall.md | 518 +----------------- 1 file changed, 13 insertions(+), 505 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index dbc2f8af22..4874e16c5e 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -196,163 +196,84 @@ allowed by Filter \#125918 which is from the InternetClient Default Rule. **InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** ``` \ - > \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ - > \ - > \InternetClient Default Rule\ - > \InternetClient Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \ad2b000000000000\ - > \.+......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_RANGE\ - > \ - > \FWP_RANGE_TYPE\ - > \ - > \ - > \FWP_BYTE_ARRAY16_TYPE\ - > \::\ - > \ - > \ - > \FWP_BYTE_ARRAY16_TYPE\ - > \ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\ - > \ - > \ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \125918\ - > \ - > \FWP_UINT64\ - > \103079219136\ - > \ - \ ``` One condition is @@ -360,19 +281,12 @@ One condition is **Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** ``` \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - \ ``` which is the condition for checking capabilities in this filter. @@ -381,15 +295,12 @@ The important part of this condition is S-1-15-3-1, which is the capability SID for INTERNET_CLIENT privileges. From the netEvent’s capabilities section, -``` + Capabilities from netEvent, Wfpdiag-Case-1.xml - +``` \ - > **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - \ ``` it shows the packet came from an app with an Internet client token @@ -665,842 +576,439 @@ In this example, the UWP app is unable to reach the Intranet target address, 10.50.50.50, because it does not have a Private Network capability. **Classify Drop netEvent, Wfpdiag-Case-4.xml** - +``` \ - \ - > \2020-05-22T21:29:28.601Z\ - > \ - > \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - > \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - > \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - > \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - > \ - > \FWP_IP_VERSION_V4\ - > \6\ - > \10.216.117.17\ - > \10.50.50.50\ - > \52998\ - > \53\ - > \0\ - > \ - > \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - > \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. > .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - > \ - > \S-1-5-21-2993214446-1947230185-131795049-1000\ - > \FWP_AF_INET\ - > \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - > \ - > \0\ - > \ - \ - > \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ - > \ - > \121180\ - > \48\ - > \0\ - > \1\ - > \1\ - > \MS_FWP_DIRECTION_OUT\ - > \false\ - > \ - > \0\ - > \0\ - \ - \ - > \ - > \0000000000000000\ - > \ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - > \ - > \0\ - > \ - > \ - > \ - > \121180\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - > \FWP_ACTION_BLOCK\ - > \ - > \ - > \121165\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - \ - \ - +``` ## Case 5: UWP app cannot reach “Intranet” target address with Private Network capability In this example, the UWP app is unable to reach the Intranet target address, 10.1.1.1, even though it has a Private Network capability token. **Classify Drop netEvent, Wfpdiag-Case-5.xml** - +``` \ - > \ - > \2020-05-22T20:54:53.499Z\ - > \ - > \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - > \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - > \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - > \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - > \ - > \FWP_IP_VERSION_V4\ - > \6\ - > \10.216.117.17\ - > \10.1.1.1\ - > \52956\ - > \53\ - > \0\ - > \ - > \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - > \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. > .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - > \ - > \S-1-5-21-2993214446-1947230185-131795049-1000\ - > \FWP_AF_INET\ - > \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - > \ - > \0\ - > \ - \ - > \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ - > \ - > \121180\ - > \48\ - > \0\ - > \1\ - > \1\ - > \MS_FWP_DIRECTION_OUT\ - > \false\ - > \ - > \0\ - > \0\ - > \ - > \ - > \ - > \0000000000000000\ - > \ - > \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - > \ - > \0\ - > \ - > \ - > \ - > \121180\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - > \FWP_ACTION_BLOCK\ - > \ - > \ - > \121165\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \ - \ - +``` The following shows the filter that blocked the event: **Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** +``` \ - > \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ - > \ - > \Block Outbound Default Rule\ - > \Block Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \c029000000000000\ - > \.)......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_BLOCK\ - > \ - > \ - > \0\ - > \ - > \121180\ - > \ - > \FWP_UINT64\ - > \274877906944\ - > \ - \ - +``` If the target was in the private range, then it should have been allowed by a PrivateNetwork Outbound Default Rule filter. -The following PrivateNetwork Outbound Default Rule filters have conditions for -matching Intranet IP addresses. Since the expected Intranet target address, -10.1.1.1, is not included in these filters it becomes clear that the address is -not in the private range. Check the policies which configure the private range -on the machine (MDM, GP, etc) and make sure it includes the private target -address you wanted to reach. +The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, +10.1.1.1, is not included in these filters it becomes clear that the address isnot in the private range. Check the policies which configure the private range +on the machine (MDM, GP, etc) and make sure it includes the private targetaddress you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** - +``` \ - > \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ - > \ - > \PrivateNetwork Outbound Default Rule\ - > \PrivateNetwork Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \f22d000000000000\ - > \.-......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1.1.1.1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \129656\ - > \ - > \FWP_UINT64\ - > \144115600392724416\ - > \ - > \ - > \ - > \{b11b4f8a-222e-49d6-8d69-02728681d8bc}\ - > \ - > \PrivateNetwork Outbound Default Rule\ - > \PrivateNetwork Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \f22d000000000000\ - > \.-......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_RANGE\ - > \ - > \FWP_RANGE_TYPE\ - > \ - > \ - > \FWP_UINT32\ - > \172.16.0.0\ - > \ - > \ - > \FWP_UINT32\ - > \172.31.255.255\ - > \ - > \ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \129657\ - > \ - > \FWP_UINT64\ - > \36029209335832512\ - > \ - \ - \ - > \{21cd82bc-6077-4069-94bf-750e5a43ca23}\ - > \ - > \PrivateNetwork Outbound Default Rule\ - > \PrivateNetwork Outbound Default Rule\ - > \ - > \ - > \FWPM_PROVIDER_MPSSVC_WSH\ - > \ - > \f22d000000000000\ - > \.-......\ - > \ - > \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - > \FWPM_SUBLAYER_MPSSVC_WSH\ - > \ - > \FWP_EMPTY\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_PACKAGE_ID\ - > \FWP_MATCH_NOT_EQUAL\ - > \ - > \FWP_SID\ - > \S-1-0-0\ - > \ - > \ - > \ - > \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - > \FWP_MATCH_RANGE\ - > \ - > \FWP_RANGE_TYPE\ - > \ - > \ - > \FWP_UINT32\ - > \192.168.0.0\ - > \ - > \ - > \FWP_UINT32\ - > \192.168.255.255\ - > \ - > \ - > \ - > \ - > \ - > \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_CURRENT_PROFILE_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_UINT32\ - > \1\ - > \ - > \ - > \ - > \FWPM_CONDITION_ALE_USER_ID\ - > \FWP_MATCH_EQUAL\ - > \ - > \FWP_SECURITY_DESCRIPTOR_TYPE\ - > \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ - > \ - > \ - > \ - > \ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \0\ - > \ - > \129658\ - > \ - > \FWP_UINT64\ - > \36029209335832512\ - > \ - \ - +``` # Debugging Past Drops If you are debugging a network drop from the past or from a remote machine, you From 8771fdd2ae4e44ffc834f3afca8252328b3a5f9b Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 12 Aug 2020 17:03:33 -0700 Subject: [PATCH 09/36] more formatting --- .../troubleshooting-uwp-firewall.md | 300 ++---------------- 1 file changed, 30 insertions(+), 270 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index 4874e16c5e..fc7c29c60d 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -122,8 +122,8 @@ The following shows the allow netEvent of the app connecting to the target IP. The netEvent contains information about the packet including its local address, remote address, capabilities, etc. -```**Classify Allow netEvent, Wfpdiag-Case-1.xml** - +**Classify Allow netEvent, Wfpdiag-Case-1.xml** +```xml \ \ > \2020-05-21T17:25:59.070Z\ @@ -194,7 +194,7 @@ address according to the terminatingFiltersInfo in the netEvent. This packet was allowed by Filter \#125918 which is from the InternetClient Default Rule. **InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** -``` +```xml \ > \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ > \ @@ -279,7 +279,7 @@ allowed by Filter \#125918 which is from the InternetClient Default Rule. One condition is **Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** -``` +```xml \ > \FWPM_CONDITION_ALE_USER_ID\ > \FWP_MATCH_EQUAL\ @@ -297,7 +297,7 @@ for INTERNET_CLIENT privileges. From the netEvent’s capabilities section, Capabilities from netEvent, Wfpdiag-Case-1.xml -``` +```xml \ > **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ @@ -321,7 +321,7 @@ The following is a drop netEvent that was captured in the traces during this repro. **Classify Drop netEvent, Wfpdiag-Case-2.xml** -``` +```xml \ \ \2020-03-30T23:53:09.720Z\ @@ -395,7 +395,7 @@ UWP app was not configured with any capability tokens to allow it to connect to a network. **Internal Fields from netEvent, Wfpdiag-Case-2.xml** -``` +```xml \ \ \0000000000000000\ @@ -420,7 +420,7 @@ The netEvent also gives us information about the filter that explicitly dropped this packet, like the FilterId, listed under classify drop **Classify Drop from netEvent, Wfpdiag-Case-2.xml** -``` +```xml \ **\68893\** \50\ @@ -439,7 +439,7 @@ the packet was dropped by a Block Outbound Default Rule filter. **Block Outbound Default Rule Filter \#68893, Wfpdiag-Case-2.xml** -``` +```xml \ > \{6d51582f-bcf8-42c4-afc9-e2ce7155c11b}\ > \ @@ -499,7 +499,7 @@ Server). The app is trying to connect to an Internet resource (bing.com), but only has a private network token. Therefore, the packet will be dropped. **Classify Drop netEvent, Wfpdiag-Case-3.xml** -``` +```xml \ \ \2020-03-31T16:57:18.570Z\ @@ -576,7 +576,7 @@ In this example, the UWP app is unable to reach the Intranet target address, 10.50.50.50, because it does not have a Private Network capability. **Classify Drop netEvent, Wfpdiag-Case-4.xml** -``` +```xml \ \ > \2020-05-22T21:29:28.601Z\ @@ -653,7 +653,7 @@ In this example, the UWP app is unable to reach the Intranet target address, 10.1.1.1, even though it has a Private Network capability token. **Classify Drop netEvent, Wfpdiag-Case-5.xml** -``` +```xml \ > \ > \2020-05-22T20:54:53.499Z\ @@ -727,7 +727,7 @@ The following shows the filter that blocked the event: **Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** -``` +```xml \ > \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ > \ @@ -776,7 +776,7 @@ The following PrivateNetwork Outbound Default Rule filters have conditions for m on the machine (MDM, GP, etc) and make sure it includes the private targetaddress you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** -``` +```xml \ > \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ > \ @@ -1021,11 +1021,11 @@ If you **do not** have a live repro or traces already collected, you can still collect traces after the UWP network connectivity issue has happened by running these commands in an Admin command prompt +```xml > \ - > Netsh wfp show netevents - > Netsh wfp show state +``` “Netsh wfp show netevents” will generate netevents.xml, which contains the past net events. “Netsh wfp show state” will generate wfpstate.xml, which contains @@ -1057,136 +1057,74 @@ In this example, the UWP app is unable to connect to bing.com. Classify Drop Net Event, NetEvents-Case-7.xml +```xml \ - \ - \2020-05-04T22:04:07.039Z\ - \ - \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - \ - \FWP_IP_VERSION_V4\ - \6\ - \10.195.36.30\ - \204.79.197.200\ - \57062\ - \443\ - \0\ - \ - \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - \ - \S-1-5-21-1578316205-4060061518-881547182-1000\ - \FWP_AF_INET\ - \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - \ - \0\ - \ - \ - \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ - \ - \206064\ - \48\ - \0\ - \1\ - \1\ - \MS_FWP_DIRECTION_OUT\ - \false\ - \ - \0\ - \0\ - \ - \ - \ - \0000000000000000\ - \ - \0\ - \ - \ - \ - \206064\ - \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - \FWP_ACTION_BLOCK\ - \ - \ - \206049\ - \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - \FWP_ACTION_PERMIT\ - \ - \ - \ - \ +``` The Internal fields lists no active capabilities, and the packet is dropped at filter 206064. @@ -1198,385 +1136,207 @@ Security Descriptor doesn’t match. **Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** +```xml \ - \{f138d1ad-9293-478f-8519-c3368e796711}\ - \ - \Block Outbound Default Rule\ - \Block Outbound Default Rule\ - \ - \ - \FWPM_PROVIDER_MPSSVC_WSH\ - \ - \2e65000000000000\ - \.e......\ - \ - \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - \FWPM_SUBLAYER_MPSSVC_WSH\ - \ - \FWP_EMPTY\ - \ - \ - \ - \FWPM_CONDITION_ALE_PACKAGE_ID\ - \FWP_MATCH_NOT_EQUAL\ - \ - \FWP_SID\ - \S-1-0-0\ - \ - \ - \ - \ - \FWP_ACTION_BLOCK\ - \ - \ - \0\ - \ - \206064\ - \ - \FWP_UINT64\ - \274877906944\ - \ - \ - +``` ## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities In this example, the UWP app successfully connects to bing.com [204.79.197.200]. **Classify Allow Net Event, NetEvents-Case-8.xml** +```xml \ - > \ - > \2020-05-04T18:49:55.101Z\ - > \ - > \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - > \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - > \FWPM_NET_EVENT_FLAG_APP_ID_SET\ - > \FWPM_NET_EVENT_FLAG_USER_ID_SET\ - > \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - > \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - > \ - > \FWP_IP_VERSION_V4\ - > \6\ - > \10.195.36.30\ - > \204.79.197.200\ - > \61673\ - > \443\ - > \0\ - > \ - > \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - > \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. > .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - > \ - > \S-1-5-21-1578316205-4060061518-881547182-1000\ - > \FWP_AF_INET\ - > \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - > \ - > \0\ - > \ - > \ - > \FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ - > \ - > \208757\ - > \48\ - > \0\ - > \1\ - > \1\ - > \ - > \ - > \ - > \0000000000000000\ - > \ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ - > \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - > \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - > \ - > \0\ - > \ - > \ - > \ - > \208757\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \206049\ - > \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - > \FWP_ACTION_PERMIT\ - > \ - > \ - > \ - \ - +``` Important things to note: all capabilities are enabled and the resulting filter determining the flow of the packet is 208757. The filter stated above with action permit: **InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** - - \ - - \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ - - \ - - \InternetClient Default Rule\ - - \InternetClient Default Rule\ - +```xml +\ + \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ + \ + \InternetClient Default Rule\ + \InternetClient Default Rule\ \ - \ - \FWPM_PROVIDER_MPSSVC_WSH\ - \ - \e167000000000000\ - \.g......\ - \ - \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - \FWPM_SUBLAYER_MPSSVC_WSH\ - \ - \FWP_EMPTY\ - \ - \ - \ - \FWPM_CONDITION_ALE_PACKAGE_ID\ - \FWP_MATCH_NOT_EQUAL\ - \ - \FWP_SID\ - \S-1-0-0\ - \ - \ - \ - \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - \FWP_MATCH_RANGE\ - \ - \FWP_RANGE_TYPE\ - \ - \ - \FWP_UINT32\ - \0.0.0.0\ - \ - \ - \FWP_UINT32\ - \255.255.255.255\ - \ - \ - \ - \ - \ - \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_CURRENT_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_ALE_USER_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_SECURITY_DESCRIPTOR_TYPE\ - \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - \ - \ - \ - \ - \FWP_ACTION_PERMIT\ - \ - \ - \0\ - \ - \208757\ - \ - \FWP_UINT64\ - \412316868544\ - \ - \ - -\*The capabilities field in a netEvent was added to the traces in the Windows 10 +``` +The capabilities field in a netEvent was added to the traces in the Windows 10 May 2019 Update From 8b2e9e237b9759ffa14b7df3cd3ab8dd1c0c2e08 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 12 Aug 2020 20:58:58 -0700 Subject: [PATCH 10/36] update --- windows/security/threat-protection/windows-firewall/TOC.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 791aa26a20..69bd3c156c 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -71,17 +71,12 @@ - ## [Best practices]() ### [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md) ### [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) ### [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) - - - - ## [How-to]() ### [Procedures Used in This Guide](procedures-used-in-this-guide.md) #### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) From ae4db0dc4a240e2f2fc0a57dbea10d49b0fcf769 Mon Sep 17 00:00:00 2001 From: schmurky Date: Thu, 13 Aug 2020 12:47:29 +0800 Subject: [PATCH 11/36] Updated TOC --- .../threat-protection/windows-firewall/TOC.md | 120 +++++++++--------- 1 file changed, 57 insertions(+), 63 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 69bd3c156c..17d730be02 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -5,41 +5,36 @@ ### [Design Guide](windows-firewall-with-advanced-security-design-guide.md) ### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) -### [Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) + +### [Deployment Goals]() + +#### [Identify deployment goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) #### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) -### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) +### [Deployment designs]() + +#### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) #### [Basic Design](basic-firewall-policy-design.md) #### [Domain Isolation Design](domain-isolation-policy-design.md) #### [Server Isolation Design](server-isolation-policy-design.md) #### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) -### [Evaluating Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) -#### [Basic Design Example](firewall-policy-design-example.md) -#### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) -#### [Server Isolation Design Example](server-isolation-policy-design-example.md) -#### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) +### [Design plans]() -### [Designing a Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) - -#### [Gathering the Info You Need](gathering-the-information-you-need.md) -##### [Network](gathering-information-about-your-current-network-infrastructure.md) -##### [Active Directory](gathering-information-about-your-active-directory-deployment.md) -##### [Computers](gathering-information-about-your-devices.md) -##### [Other Relevant Information](gathering-other-relevant-information.md) -#### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-devices.md) - -### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) +#### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) #### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) -#### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) -##### [Exemption List](exemption-list.md) -##### [Isolated Domain](isolated-domain.md) -##### [Boundary Zone](boundary-zone.md) -##### [Encryption Zone](encryption-zone.md) +##### [Planning Domain Isolation Zones]() + +###### [Domain Isolation Zones](planning-domain-isolation-zones.md) +###### [Exemption List](exemption-list.md) +###### [Isolated Domain](isolated-domain.md) +###### [Boundary Zone](boundary-zone.md) +###### [Encryption Zone](encryption-zone.md) + #### [Planning Server Isolation Zones](planning-server-isolation-zones.md) #### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) @@ -65,7 +60,7 @@ ## [Deployment guide]() -### [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) + #### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) #### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) @@ -78,46 +73,45 @@ ## [How-to]() -### [Procedures Used in This Guide](procedures-used-in-this-guide.md) -#### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) -#### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) -#### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) -#### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md) -#### [Configure Authentication Methods](configure-authentication-methods.md) -#### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md) -#### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) -#### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md) -#### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md) -#### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md) -#### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md) -#### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) -#### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md) -#### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) -#### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) -#### [Create a Group Policy Object](create-a-group-policy-object.md) -#### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) -#### [Create an Authentication Request Rule](create-an-authentication-request-rule.md) -#### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) -#### [Create an Inbound Port Rule](create-an-inbound-port-rule.md) -#### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) -#### [Create an Outbound Port Rule](create-an-outbound-port-rule.md) -#### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md) -#### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) -#### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) -#### [Create Windows Firewall rules in Intune](create-windows-firewall-rules-in-intune.md) -#### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md) -#### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md) -#### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md) -#### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) -#### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) -#### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md) -#### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md) -#### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -#### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md) -#### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) -#### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) -#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) -#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) +### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) +### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) +### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) +### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md) +### [Configure Authentication Methods](configure-authentication-methods.md) +### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md) +### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) +### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md) +### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md) +### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md) +### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md) +### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) +### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md) +### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) +### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) +### [Create a Group Policy Object](create-a-group-policy-object.md) +### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) +### [Create an Authentication Request Rule](create-an-authentication-request-rule.md) +### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) +### [Create an Inbound Port Rule](create-an-inbound-port-rule.md) +### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) +### [Create an Outbound Port Rule](create-an-outbound-port-rule.md) +### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md) +### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) +### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) +### [Create Windows Firewall rules in Intune](create-windows-firewall-rules-in-intune.md) +### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md) +### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md) +### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md) +### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) +### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) +### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md) +### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md) +### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md) +### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) +### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) +### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) +### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) From e8ad1713f727f4c34790d78dd11b12b9f22a4f42 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 13 Aug 2020 10:03:26 +0500 Subject: [PATCH 12/36] Update dg-readiness-tool.md --- .../identity-protection/credential-guard/dg-readiness-tool.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index ae96f09ed1..e609c9469d 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -657,7 +657,7 @@ function PrintHardwareReq { LogAndConsole "###########################################################################" LogAndConsole "OS and Hardware requirements for enabling Device Guard and Credential Guard" - LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home" + LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education and Enterprise IoT" LogAndConsole " 2. Hardware: Recent hardware that supports virtualization extension with SLAT" LogAndConsole "To learn more please visit: https://aka.ms/dgwhcr" LogAndConsole "########################################################################### `n" @@ -735,7 +735,7 @@ function CheckOSSKU $osname = $((gwmi win32_operatingsystem).Name).ToLower() $_SKUSupported = 0 Log "OSNAME:$osname" - $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home") + $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server") $HLKAllowed = @("microsoft windows 10 pro") foreach ($SKUent in $SKUarray) { From 6c6bb06926cb69a77e32d97bd6bc5e3f41302084 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 13 Aug 2020 13:12:40 -0700 Subject: [PATCH 13/36] Update TOC.md --- .../security/threat-protection/windows-firewall/TOC.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 17d730be02..00296d4b2d 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -7,7 +7,6 @@ ### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) ### [Deployment Goals]() - #### [Identify deployment goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) @@ -15,7 +14,6 @@ #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) ### [Deployment designs]() - #### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) #### [Basic Design](basic-firewall-policy-design.md) #### [Domain Isolation Design](domain-isolation-policy-design.md) @@ -23,12 +21,9 @@ #### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) ### [Design plans]() - #### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) #### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) - ##### [Planning Domain Isolation Zones]() - ###### [Domain Isolation Zones](planning-domain-isolation-zones.md) ###### [Exemption List](exemption-list.md) ###### [Isolated Domain](isolated-domain.md) @@ -60,7 +55,6 @@ ## [Deployment guide]() - #### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) #### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) @@ -113,9 +107,6 @@ ### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) ### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) - - - ## [References]() ### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) ### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) From 58cadb1af5084f78fcf02dea9cd36c8d1b989fb8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 13 Aug 2020 13:16:19 -0700 Subject: [PATCH 14/36] fix lines --- windows/security/threat-protection/windows-firewall/TOC.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 00296d4b2d..7861f11250 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -55,8 +55,8 @@ ## [Deployment guide]() -#### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) -#### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) +### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) +### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) From cef561ea53b63153a87c18d7bb65c9810df0cc74 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 13 Aug 2020 16:23:35 -0700 Subject: [PATCH 15/36] more fixin --- .../troubleshooting-uwp-firewall.md | 210 +++++++++--------- 1 file changed, 100 insertions(+), 110 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index fc7c29c60d..bc17fd0a75 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -19,174 +19,164 @@ ms.topic: troubleshooting This document is intended to help network admins, support engineers, and developers to investigate UWP app network connectivity issues. -# Introduction +This document guides you through steps to debug Universal Windows Platform (UWP) app network connectivity issues by providing practical examples. -This document guides you through steps to debug different Universal Windows Platform (UWP) app network connectivity issues by providing practical case examples. +## Typical causes of connectivity issues -UWP app network connectivity issues typically stem from one of the following causes: +UWP app network connectivity issues are typically caused by: -1. The UWP app was not permitted to receive loopback traffic (this must be configured as, by default, a UWP app is not allowed to receive loopback traffic). +1. The UWP app was not permitted to receive loopback traffic. This must be configured. By default, UWP apps are not allowed to receive loopback traffic. 2. The UWP app is missing the proper capability tokens. -3. The private range is configured incorrectly (i.e. set incorrectly through GP/MDM policies, etc.) +3. The private range is configured incorrectly. For example, the private ranges is set incorrectly through GP/MDM policies, etc. -To understand these causes more thoroughly, there are several concepts that should be reviewed. +To understand these causes more thoroughly, there are several concepts to review. -The traffic of network packets (e.g. what's permitted and what’s not) on Windows is ultimately determined by the Windows Filtering Platform (WFP). When a UWP app +The traffic of network packets (what's permitted and what’s not) on Windows is determined by the Windows Filtering Platform (WFP). When a UWP app or the private range is configured incorrectly, it affects how the UWP app’s network traffic will be processed by WFP. -When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet does not match the filter conditions of any filters, leading the packet to be dropped by a default block filter. The presence of the default block -filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that does not have the correct capabilities for the resource it is trying to reach, ensuring the application’s granular access to each resource type and preventing the application from “escaping” its environment. +When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet does not match any of the filter conditions, leading the packet to be dropped by a default block filter. The presence of the default block +filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that does not have the correct capabilities for the resource it is trying to reach. This ensures the application’s granular access to each resource type and preventing the application from escaping its environment. For more information on the filter arbitration algorithm and network isolation, -please read [Filter +see [Filter Arbitration](https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) and [Isolation](https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation). -The next sections will cover debugging case examples for loopback and -non-loopback UWP app network connectivity issues. +The following sections cover debugging case examples for loopback and non-loopback UWP app network connectivity issues. > [!NOTE] -> As improvements to debugging and diagnostics around the Windows Filtering Platform are made, the trace examples in this document may not exactly match the -traces collected on an older Windows build. +> As improvements to debugging and diagnostics in the Windows Filtering Platform are made, the trace examples in this document may not exactly match the +traces collected on previous releases of Windows. # Debugging UWP App Loopback scenarios -If you have a scenario where you are establishing a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. +If you need to establis a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. -To enable loopback for client outbound connections, run the following in a command prompt: +To enable loopback for client outbound connections, run the following at a command prompt: -`CheckNetIsolation.exe LoopbackExempt -a -n=\` +```dos +CheckNetIsolation.exe LoopbackExempt -a -n=\ +``` -To enable loopback for server inbound connections, please run the following in a +To enable loopback for server inbound connections, run the following at a command prompt: +```dos +CheckNetIsolation.exe LoopbackExempt -is -n=\ +``` +You can ensure loopback is enabled by checking the appx manifests of both the sender and receiver. -`CheckNetIsolation.exe LoopbackExempt -is -n=\` - -You can ensure loopback is enabled by checking the appx manifests of both the -sender and receiver. - -For more information about loopback scenarios, please read [Communicating with +For more information about loopback scenarios, see [Communicating with localhost (loopback)](https://docs.microsoft.com/en-us/windows/iot-core/develop-your-app/loopback) # Debugging Live Drops -If the issue happened recently, but you find you are not able to reproduce the -issue, go to Debugging Past Drops for the appropriate trace commands. +If the issue happened recently, but you find you are not able to reproduce the issue, go to Debugging Past Drops for the appropriate trace commands. -If you can consistently reproduce the issue, then you can run the following in -an admin command prompt to gather a fresh trace: +If you can consistently reproduce the issue, then you can run the following in an admin command prompt to gather a fresh trace: -``` +```DOS Netsh wfp capture start keywords=19 \ Netsh wfp capture stop ``` -The above commands will generate a wfpdiag.cab. Inside the .cab exists a -wfpdiag.xml, which contains any allow or drop netEvents and filters that existed -during that repro. Without “keywords=19”, the trace will only collect drop -netEvents. +These commands generate a wfpdiag.cab. Inside the .cab exists a wfpdiag.xml, which contains any allow or drop netEvents and filters that existed during that repro. Without “keywords=19”, the trace will only collect drop netEvents. Inside the wfpdiag.xml, search for netEvents which have -FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant -drop events, search for the drop events with matching destination IP address, +FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant drop events, search for the drop events with matching destination IP address, package SID, or application ID name. The characters in the application ID name will be separated by periods: -``` + +```XML (ex) -\ - + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... \ ``` -The netEvent will have more information about the packet that was dropped -including information about its capabilities, the filter that dropped the -packet, and much more. + +The netEvent will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. ## Case 1: UWP app connects to Internet target address with all capabilities In this example, the UWP app successfully connects to bing.com [2620:1ec:c11::200]. -A packet from a UWP app needs the correct networking capability token for the -resource it is trying to reach. +A packet from a UWP app needs the correct networking capability token for the resource it is trying to reach. -In this scenario, the app could successfully send a packet to the Internet -target because it had an Internet capability token. +In this scenario, the app could successfully send a packet to the Internet target because it had an Internet capability token. -The following shows the allow netEvent of the app connecting to the target IP. -The netEvent contains information about the packet including its local address, +The following shows the allow netEvent of the app connecting to the target IP. The netEvent contains information about the packet including its local address, remote address, capabilities, etc. **Classify Allow netEvent, Wfpdiag-Case-1.xml** ```xml -\ -\ -> \2020-05-21T17:25:59.070Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V6\ -> \6\ -> \2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ -\52127\ -\443\ -\0\ -\ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-2993214446-1947230185-131795049-1000\ -\FWP_AF_INET6\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ -\ -> \125918\ -> \50\ -> \0\ -> \1\ -> \1\ -\ -\ -\ -\0000000000000000\ -\ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -\ -\0\ -\ -\ -> \ - \125918\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - \FWP_ACTION_PERMIT\ -> \ -> \ - \121167\ - \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - \FWP_ACTION_PERMIT\ - \ -\ -\ -\ + + + 2020-05-21T17:25:59.070Z\ + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ + FWPM_NET_EVENT_FLAG_APP_ID_SET\ + FWPM_NET_EVENT_FLAG_USER_ID_SET\ + FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ + + FWP_IP_VERSION_V6\ + 6\ + 2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ +52127\ +443\ +0\ + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ + +S-1-5-21-2993214446-1947230185-131795049-1000\ +FWP_AF_INET6\ +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ + +0\ + + +FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ + + 125918\ + 50\ + 0\ + 1\ + 1\ + + + +0000000000000000\ + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ + +0\ + + + + 125918\ + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ + FWP_ACTION_PERMIT\ + + + 121167\ + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ + FWP_ACTION_PERMIT\ + + + + ``` The following is the filter that permitted the packet to be sent to the target From 9aba80f3de8d2ec83e443b30afe63184a793c404 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 13 Aug 2020 18:09:28 -0700 Subject: [PATCH 16/36] so many --- .../troubleshooting-uwp-firewall.md | 2124 ++++++++--------- 1 file changed, 1060 insertions(+), 1064 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index bc17fd0a75..fd79a67511 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -56,13 +56,13 @@ If you need to establis a TCP/IP connection between two processes on the same ho To enable loopback for client outbound connections, run the following at a command prompt: ```dos -CheckNetIsolation.exe LoopbackExempt -a -n=\ +CheckNetIsolation.exe LoopbackExempt -a -n= ``` To enable loopback for server inbound connections, run the following at a command prompt: ```dos -CheckNetIsolation.exe LoopbackExempt -is -n=\ +CheckNetIsolation.exe LoopbackExempt -is -n= ``` You can ensure loopback is enabled by checking the appx manifests of both the sender and receiver. @@ -78,7 +78,7 @@ If you can consistently reproduce the issue, then you can run the following in a ```DOS Netsh wfp capture start keywords=19 -\ + Netsh wfp capture stop ``` @@ -92,10 +92,10 @@ will be separated by periods: ```XML (ex) - + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... -\ + ``` The netEvent will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. @@ -114,187 +114,186 @@ remote address, capabilities, etc. **Classify Allow netEvent, Wfpdiag-Case-1.xml** ```xml - - - 2020-05-21T17:25:59.070Z\ - - FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ - FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ - FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ - FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ - FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ - FWPM_NET_EVENT_FLAG_APP_ID_SET\ - FWPM_NET_EVENT_FLAG_USER_ID_SET\ - FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ - FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ - - FWP_IP_VERSION_V6\ - 6\ - 2001:4898:30:3:256c:e5ba:12f3:beb1\ \2620:1ec:c11::200\ -52127\ -443\ -0\ - - 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ - \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. - .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ - -S-1-5-21-2993214446-1947230185-131795049-1000\ -FWP_AF_INET6\ -S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ - -0\ - - -FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ - - 125918\ - 50\ - 0\ - 1\ - 1\ - - - -0000000000000000\ - - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ - FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ - -0\ - - - - 125918\ - FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ - FWP_ACTION_PERMIT\ - - - 121167\ - FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ - FWP_ACTION_PERMIT\ - - - - + +
+ 2020-05-21T17:25:59.070Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V6 + 6 + 2001:4898:30:3:256c:e5ba:12f3:beb1 + 2620:1ec:c11::200 +52127 +443 +0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-2993214446-1947230185-131795049-1000 +FWP_AF_INET6 +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW + + 125918 + 50 + 0 + 1 + 1 + + + +0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + +0 + + + + 125918 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_PERMIT + + + 121167 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` The following is the filter that permitted the packet to be sent to the target -address according to the terminatingFiltersInfo in the netEvent. This packet was -allowed by Filter \#125918 which is from the InternetClient Default Rule. +address according to the **terminatingFiltersInfo** in the **netEvent**. This packet was +allowed by Filter #125918, from the InternetClient Default Rule. -**InternetClient Default Rule Filter \#125918, Wfpdiag-Case-1.xml** +**InternetClient Default Rule Filter #125918, Wfpdiag-Case-1.xml** ```xml -\ -> \{3389708e-f7ae-4ebc-a61a-f659065ab24e}\ -> \ -> \InternetClient Default Rule\ -> \InternetClient Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \ad2b000000000000\ -> \.+......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_RANGE\ -> \ -> \FWP_RANGE_TYPE\ -> \ -> \ -> \FWP_BYTE_ARRAY16_TYPE\ -> \::\ -> \ -> \ -> \FWP_BYTE_ARRAY16_TYPE\ -> \ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\ -> \ -> \ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \125918\ -> \ -> \FWP_UINT64\ -> \103079219136\ -> \ -\ + + {3389708e-f7ae-4ebc-a61a-f659065ab24e} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + ad2b000000000000 + .+...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + FWPM_SUBLAYER_MPSSVC_WSH + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_BYTE_ARRAY16_TYPE + :: + + + FWP_BYTE_ARRAY16_TYPE + ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 125918 + + FWP_UINT64 + 103079219136 + + ``` -One condition is **Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** ```xml -\ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -\ + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + ``` -which is the condition for checking capabilities in this filter. +This is the condition for checking capabilities in this filter. -The important part of this condition is S-1-15-3-1, which is the capability SID -for INTERNET_CLIENT privileges. +The important part of this condition is **S-1-15-3-1**, which is the capability SID +for **INTERNET_CLIENT** privileges. -From the netEvent’s capabilities section, - -Capabilities from netEvent, Wfpdiag-Case-1.xml +From the **netEvent** capabilities section, +capabilities from netEvent, Wfpdiag-Case-1.xml. ```xml -\ -> **\FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\** \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -\ + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + ``` -it shows the packet came from an app with an Internet client token -(FWP_CAPABILITIES_FLAG_INTERNET_CLIENT) which matches the capability SID in the +This shows the packet came from an app with an Internet client token (**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**) which matches the capability SID in the filter. All the other conditions are also met for the filter, so the packet is allowed. @@ -307,175 +306,173 @@ the packet having all capabilities. In this example, the UWP app is unable to connect to bing.com [2620:1ec:c11::200]. -The following is a drop netEvent that was captured in the traces during this -repro. +The following is a drop netEvent that was captured in the trace. **Classify Drop netEvent, Wfpdiag-Case-2.xml** ```xml -\ -\ -\2020-03-30T23:53:09.720Z\ -\ -\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -\FWPM_NET_EVENT_FLAG_APP_ID_SET\ -\FWPM_NET_EVENT_FLAG_USER_ID_SET\ -\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -\ -\FWP_IP_VERSION_V6\ -\6\ -\2001:4898:1a:1045:8469:3351:e6e2:543\ -\2620:1ec:c11::200\ -\63187\ -\443\ -\0\ -\ -\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0034002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...4...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-2788718703-1626973220-3690764900-1000\ -\FWP_AF_INET6\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -\ -\68893\ -\50\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ -\ -\ -\0000000000000000\ -\ -\0\ -\ -\ -\ -\68893\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\68879\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ -\ + +
+2020-03-30T23:53:09.720Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + +FWP_IP_VERSION_V6 +6 +2001:4898:1a:1045:8469:3351:e6e2:543 +2620:1ec:c11::200 +63187 +443 +0 + +5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0034002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...4...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-2788718703-1626973220-3690764900-1000 +FWP_AF_INET6 +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + +68893 +50 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + + + +0000000000000000 + +0 + + + +68893 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +68879 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + + ``` -The first thing that should be checked in the netEvent is the capabilities -field\*. In this example, the capabilities field is empty, indicating that the +The first thing that you should check in the **netEvent** is the capabilities +field. In this example, the capabilities field is empty, indicating that the UWP app was not configured with any capability tokens to allow it to connect to a network. **Internal Fields from netEvent, Wfpdiag-Case-2.xml** ```xml -\ -\ -\0000000000000000\ -**\** -\0\ -\ -\ -\ -\68893\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\68879\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ + + +0000000000000000 + +0 + + + +68893 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +68879 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + ``` -The netEvent also gives us information about the filter that explicitly dropped -this packet, like the FilterId, listed under classify drop +The **netEvent** also shows information about the filter that explicitly dropped this packet, like the **FilterId**, listed under classify drop. **Classify Drop from netEvent, Wfpdiag-Case-2.xml** ```xml -\ -**\68893\** -\50\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ + +68893 +50 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + ``` -If we search for that filter, \#68893, in Wfpdiag-Case2.xml, we will see that +If you search for the filter #68893 in Wfpdiag-Case2.xml, you'll see that the packet was dropped by a Block Outbound Default Rule filter. -**Block Outbound Default Rule Filter \#68893, Wfpdiag-Case-2.xml** +**Block Outbound Default Rule Filter #68893, Wfpdiag-Case-2.xml** ```xml -\ -> \{6d51582f-bcf8-42c4-afc9-e2ce7155c11b}\ -> \ -> \**Block Outbound Default Rule**\ -> \Block Outbound Default Rule\ -> \ -> \ -> \{4b153735-1049-4480-aab4-d1b9bdc03710}\ -> \ -> \b001000000000000\ -> \........\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V6\ -> \{b3cdd441-af90-41ba-a745-7c6008ff2300}\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \0\ -> \ -> \68893\ -> \ -> \FWP_UINT64\ -> \68719476736\ -> \ -\ + + {6d51582f-bcf8-42c4-afc9-e2ce7155c11b} +/t + **Block Outbound Default Rule** + Block Outbound Default Rule + + + {4b153735-1049-4480-aab4-d1b9bdc03710} + + b001000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + {b3cdd441-af90-41ba-a745-7c6008ff2300} + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + 0 + + 68893 + + FWP_UINT64 + 68719476736 + + ``` -A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and thus not allowed by the other filters in +A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and not allowed by the other filters in the same sublayer. If the packet had the correct capability token, -FWP_CAPABILITIES_FLAG_INTERNET_CLIENT, it would have matched a condition for a +**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**, it would have matched a condition for a non-default block filter and would have been permitted to reach bing.com. Without the correct capability tokens, the packet will be explicitly dropped by a default block outbound filter. @@ -490,74 +487,74 @@ only has a private network token. Therefore, the packet will be dropped. **Classify Drop netEvent, Wfpdiag-Case-3.xml** ```xml -\ -\ -\2020-03-31T16:57:18.570Z\ -\ -\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -\FWPM_NET_EVENT_FLAG_APP_ID_SET\ -\FWPM_NET_EVENT_FLAG_USER_ID_SET\ -\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -\ -\FWP_IP_VERSION_V6\ -\6\ -\2001:4898:1a:1045:9c65:7805:dd4a:cc4b\ -\2620:1ec:c11::200\ -\64086\ -\443\ -\0\ -\ -\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0035002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...5...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-2788718703-1626973220-3690764900-1000\ -\FWP_AF_INET6\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -\ -\68893\ -\50\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ -\ -\ -\0000000000000000\ -**\** -**\FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\** -**\** -\0\ -\ -\ -\ -\68893\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\68879\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ -\ + +
+2020-03-31T16:57:18.570Z + +FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET +FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET +FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET +FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET +FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET +FWPM_NET_EVENT_FLAG_APP_ID_SET +FWPM_NET_EVENT_FLAG_USER_ID_SET +FWPM_NET_EVENT_FLAG_IP_VERSION_SET +FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + +FWP_IP_VERSION_V6 +6 +2001:4898:1a:1045:9c65:7805:dd4a:cc4b +2620:1ec:c11::200 +64086 +443 +0 + +5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e0035002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...5...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-2788718703-1626973220-3690764900-1000 +FWP_AF_INET6 +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + +68893 +50 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + + + +0000000000000000 +**** +**FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK** +**** +0 + + + +68893 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +68879 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + + ``` ## Case 4: UWP app cannot reach Intranet target address without Private Network capability @@ -567,75 +564,75 @@ In this example, the UWP app is unable to reach the Intranet target address, **Classify Drop netEvent, Wfpdiag-Case-4.xml** ```xml -\ -\ -> \2020-05-22T21:29:28.601Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V4\ -> \6\ -> \10.216.117.17\ -> \10.50.50.50\ -> \52998\ -> \53\ -> \0\ -> \ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -> \ -> \S-1-5-21-2993214446-1947230185-131795049-1000\ -> \FWP_AF_INET\ -> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -> \ -> \0\ -> \ -\ -> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -> \ -> \121180\ -> \48\ -> \0\ -> \1\ -> \1\ -> \MS_FWP_DIRECTION_OUT\ -> \false\ -> \ -> \0\ -> \0\ -\ -\ -> \ -> \0000000000000000\ -> \ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -> \ -> \0\ -> \ -> \ -> \ -> \121180\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \121165\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -\ -\ + +
+ 2020-05-22T21:29:28.601Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.216.117.17 + 10.50.50.50 + 52998 + 53 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-2993214446-1947230185-131795049-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + + 121180 + 48 + 0 + 1 + 1 + MS_FWP_DIRECTION_OUT + false + + 0 + 0 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + + 0 + + + + 121180 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_BLOCK + + + 121165 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` ## Case 5: UWP app cannot reach “Intranet” target address with Private Network capability @@ -644,360 +641,360 @@ In this example, the UWP app is unable to reach the Intranet target address, **Classify Drop netEvent, Wfpdiag-Case-5.xml** ```xml -\ -> \ -> \2020-05-22T20:54:53.499Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V4\ -> \6\ -> \10.216.117.17\ -> \10.1.1.1\ -> \52956\ -> \53\ -> \0\ -> \ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -> \ -> \S-1-5-21-2993214446-1947230185-131795049-1000\ -> \FWP_AF_INET\ -> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -> \ -> \0\ -> \ -\ -> \FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -> \ -> \121180\ -> \48\ -> \0\ -> \1\ -> \1\ -> \MS_FWP_DIRECTION_OUT\ -> \false\ -> \ -> \0\ -> \0\ -> \ -> \ -> \ -> \0000000000000000\ -> \ -> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -> \ -> \0\ -> \ -> \ -> \ -> \121180\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \121165\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \ -\ + +
+ 2020-05-22T20:54:53.499Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.216.117.17 + 10.1.1.1 + 52956 + 53 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-2993214446-1947230185-131795049-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + + 121180 + 48 + 0 + 1 + 1 + MS_FWP_DIRECTION_OUT + false + + 0 + 0 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + + 0 + + + + 121180 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_BLOCK + + + 121165 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` The following shows the filter that blocked the event: **Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** ```xml -\ -> \{e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6}\ -> \ -> \Block Outbound Default Rule\ -> \Block Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \c029000000000000\ -> \.)......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_BLOCK\ -> \ -> \ -> \0\ -> \ -> \121180\ -> \ -> \FWP_UINT64\ -> \274877906944\ -> \ -\ + + {e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6} + + Block Outbound Default Rule + Block Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + c029000000000000 + .)...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + 0 + + 121180 + + FWP_UINT64 + 274877906944 + + ``` If the target was in the private range, then it should have been allowed by a PrivateNetwork Outbound Default Rule filter. The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, -10.1.1.1, is not included in these filters it becomes clear that the address isnot in the private range. Check the policies which configure the private range -on the machine (MDM, GP, etc) and make sure it includes the private targetaddress you wanted to reach. +10.1.1.1, is not included in these filters it becomes clear that the address is not in the private range. Check the policies that configure the private range +on the device (MDM, Group Policy, etc) and make sure it includes the private targetaddress you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** ```xml -\ -> \{fd65507b-e356-4e2f-966f-0c9f9c1c6e78}\ -> \ -> \PrivateNetwork Outbound Default Rule\ -> \PrivateNetwork Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \f22d000000000000\ -> \.-......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1.1.1.1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \129656\ -> \ -> \FWP_UINT64\ -> \144115600392724416\ -> \ -> \ -> \ -> \{b11b4f8a-222e-49d6-8d69-02728681d8bc}\ -> \ -> \PrivateNetwork Outbound Default Rule\ -> \PrivateNetwork Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \f22d000000000000\ -> \.-......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_RANGE\ -> \ -> \FWP_RANGE_TYPE\ -> \ -> \ -> \FWP_UINT32\ -> \172.16.0.0\ -> \ -> \ -> \FWP_UINT32\ -> \172.31.255.255\ -> \ -> \ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \129657\ -> \ -> \FWP_UINT64\ -> \36029209335832512\ -> \ -\ -\ -> \{21cd82bc-6077-4069-94bf-750e5a43ca23}\ -> \ -> \PrivateNetwork Outbound Default Rule\ -> \PrivateNetwork Outbound Default Rule\ -> \ -> \ -> \FWPM_PROVIDER_MPSSVC_WSH\ -> \ -> \f22d000000000000\ -> \.-......\ -> \ -> \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -> \FWPM_SUBLAYER_MPSSVC_WSH\ -> \ -> \FWP_EMPTY\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_PACKAGE_ID\ -> \FWP_MATCH_NOT_EQUAL\ -> \ -> \FWP_SID\ -> \S-1-0-0\ -> \ -> \ -> \ -> \FWPM_CONDITION_IP_REMOTE_ADDRESS\ -> \FWP_MATCH_RANGE\ -> \ -> \FWP_RANGE_TYPE\ -> \ -> \ -> \FWP_UINT32\ -> \192.168.0.0\ -> \ -> \ -> \FWP_UINT32\ -> \192.168.255.255\ -> \ -> \ -> \ -> \ -> \ -> \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_CURRENT_PROFILE_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_UINT32\ -> \1\ -> \ -> \ -> \ -> \FWPM_CONDITION_ALE_USER_ID\ -> \FWP_MATCH_EQUAL\ -> \ -> \FWP_SECURITY_DESCRIPTOR_TYPE\ -> \O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)\ -> \ -> \ -> \ -> \ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \0\ -> \ -> \129658\ -> \ -> \FWP_UINT64\ -> \36029209335832512\ -> \ -\ + + {fd65507b-e356-4e2f-966f-0c9f9c1c6e78} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_EQUAL + + FWP_UINT32 + 1.1.1.1 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129656 + + FWP_UINT64 + 144115600392724416 + + + + {b11b4f8a-222e-49d6-8d69-02728681d8bc} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 172.16.0.0 + + + FWP_UINT32 + 172.31.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129657 + + FWP_UINT64 + 36029209335832512 + + + + {21cd82bc-6077-4069-94bf-750e5a43ca23} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 192.168.0.0 + + + FWP_UINT32 + 192.168.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129658 + + FWP_UINT64 + 36029209335832512 + + ``` # Debugging Past Drops @@ -1007,38 +1004,38 @@ wfpstate.xml. Once nettrace.etl is converted, nettrace.txt will have the netEvents of the reproduced event, and wfpstate.xml will contain the filters that were present on the machine at the time. -If you **do not** have a live repro or traces already collected, you can still +If you do not have a live repro or traces already collected, you can still collect traces after the UWP network connectivity issue has happened by running -these commands in an Admin command prompt +these commands in an admin command prompt ```xml -> \ -> Netsh wfp show netevents -> Netsh wfp show state + + Netsh wfp show netevents + Netsh wfp show state ``` -“Netsh wfp show netevents” will generate netevents.xml, which contains the past -net events. “Netsh wfp show state” will generate wfpstate.xml, which contains +**Netsh wfp show netevents** creates netevents.xml, which contains the past +net events. **Netsh wfp show state** creates wfpstate.xml, which contains the current filters present on the machine. Unfortunately, collecting traces after the UWP network connectivity issue is not always reliable. -NetEvents on the machine are stored in a buffer. Once that buffer has reached -max capacity, the buffer will overwrite older net events. Due to the buffer +NetEvents on the device are stored in a buffer. Once that buffer has reached +maximum capacity, the buffer will overwrite older net events. Due to the buffer overwrite, it is possible that the collected netevents.xml will not contain the -net event associated with the UWP network connectivity issue if it was -overwritten. Additionally, filters on the machine can get deleted and re-added -with different filterIds due to miscellaneous events on the machine. Because of -this, a filterId from “netsh wfp show netevents” may not necessarily match any -filter in “netsh wfp show state” because that filterId may be outdated. +net event associated with the UWP network connectivity issue. It could have been ov +overwritten. Additionally, filters on the device can get deleted and re-added +with different filterIds due to miscellaneous events on the device. Because of +this, a **filterId** from **netsh wfp show netevents** may not necessarily match any +filter in **netsh wfp show state** because that **filterId** may be outdated. -If you can reproduce the UWP network connectivity issue consistently, we would +If you can reproduce the UWP network connectivity issue consistently, we recommend using the commands from Debugging Live Drops instead. Additionally, you can still follow the examples from Debugging Live Drops section using the trace commands in this section, even if you do not have a live -repro. The netEvents and filters are stored in one file in Debugging Live Drops +repro. The **netEvents** and filters are stored in one file in Debugging Live Drops as opposed to two separate files in the following Debugging Past Drops examples. ## Case 7: Debugging Past Drop - UWP app cannot reach Internet target address and has no capabilities @@ -1048,72 +1045,72 @@ In this example, the UWP app is unable to connect to bing.com. Classify Drop Net Event, NetEvents-Case-7.xml ```xml -\ -\ -\2020-05-04T22:04:07.039Z\ -\ -\FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -\FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -\FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -\FWPM_NET_EVENT_FLAG_APP_ID_SET\ -\FWPM_NET_EVENT_FLAG_USER_ID_SET\ -\FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -\FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -\ -\FWP_IP_VERSION_V4\ -\6\ -\10.195.36.30\ -\204.79.197.200\ -\57062\ -\443\ -\0\ -\ -\5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -\\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -\ -\S-1-5-21-1578316205-4060061518-881547182-1000\ -\FWP_AF_INET\ -\S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -\ -\0\ -\ -\ -\FWPM_NET_EVENT_TYPE_CLASSIFY_DROP\ -\ -\206064\ -\48\ -\0\ -\1\ -\1\ -\MS_FWP_DIRECTION_OUT\ -\false\ -\ -\0\ -\0\ -\ -\ -\ -\0000000000000000\ -\ -\0\ -\ -\ -\ -\206064\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -\FWP_ACTION_BLOCK\ -\ -\ -\206049\ -\FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -\FWP_ACTION_PERMIT\ -\ -\ -\ -\ + +
+2020-05-04T22:04:07.039Z + +FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET +FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET +FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET +FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET +FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET +FWPM_NET_EVENT_FLAG_APP_ID_SET +FWPM_NET_EVENT_FLAG_USER_ID_SET +FWPM_NET_EVENT_FLAG_IP_VERSION_SET +FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + +FWP_IP_VERSION_V4 +6 +10.195.36.30 +204.79.197.200 +57062 +443 +0 + +5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310032002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 +\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. +.f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.2...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + +S-1-5-21-1578316205-4060061518-881547182-1000 +FWP_AF_INET +S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + +0 + +
+FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + +206064 +48 +0 +1 +1 +MS_FWP_DIRECTION_OUT +false + +0 +0 + + + +0000000000000000 + +0 + + + +206064 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH +FWP_ACTION_BLOCK + + +206049 +FWPP_SUBLAYER_INTERNAL_FIREWALL_WF +FWP_ACTION_PERMIT + + + + ``` The Internal fields lists no active capabilities, and the packet is dropped at @@ -1127,45 +1124,45 @@ Security Descriptor doesn’t match. **Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** ```xml -\ -\{f138d1ad-9293-478f-8519-c3368e796711}\ -\ -\Block Outbound Default Rule\ -\Block Outbound Default Rule\ -\ -\ -\FWPM_PROVIDER_MPSSVC_WSH\ -\ -\2e65000000000000\ -\.e......\ -\ -\FWPM_LAYER_ALE_AUTH_CONNECT_V4\ -\FWPM_SUBLAYER_MPSSVC_WSH\ -\ -\FWP_EMPTY\ -\ -\ -\ -\FWPM_CONDITION_ALE_PACKAGE_ID\ -\FWP_MATCH_NOT_EQUAL\ -\ -\FWP_SID\ -\S-1-0-0\ -\ -\ -\ -\ -\FWP_ACTION_BLOCK\ -\ -\ -\0\ -\ -\206064\ -\ -\FWP_UINT64\ -\274877906944\ -\ -\ + +{f138d1ad-9293-478f-8519-c3368e796711} + +Block Outbound Default Rule +Block Outbound Default Rule + + +FWPM_PROVIDER_MPSSVC_WSH + +2e65000000000000 +.e...... + +FWPM_LAYER_ALE_AUTH_CONNECT_V4 +FWPM_SUBLAYER_MPSSVC_WSH + +FWP_EMPTY + + + +FWPM_CONDITION_ALE_PACKAGE_ID +FWP_MATCH_NOT_EQUAL + +FWP_SID +S-1-0-0 + + + + +FWP_ACTION_BLOCK + + +0 + +206064 + +FWP_UINT64 +274877906944 + + ``` ## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities @@ -1174,159 +1171,158 @@ In this example, the UWP app successfully connects to bing.com [204.79.197.200]. **Classify Allow Net Event, NetEvents-Case-8.xml** ```xml -\ -> \ -> \2020-05-04T18:49:55.101Z\ -> \ -> \FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET\ -> \FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET\ -> \FWPM_NET_EVENT_FLAG_APP_ID_SET\ -> \FWPM_NET_EVENT_FLAG_USER_ID_SET\ -> \FWPM_NET_EVENT_FLAG_IP_VERSION_SET\ -> \FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET\ -> \ -> \FWP_IP_VERSION_V4\ -> \6\ -> \10.195.36.30\ -> \204.79.197.200\ -> \61673\ -> \443\ -> \0\ -> \ -> \5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000\ -> \\\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. -> .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e...\ -> \ -> \S-1-5-21-1578316205-4060061518-881547182-1000\ -> \FWP_AF_INET\ -> \S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936\ -> \ -> \0\ -> \ -> \ -> \FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW\ -> \ -> \208757\ -> \48\ -> \0\ -> \1\ -> \1\ -> \ -> \ -> \ -> \0000000000000000\ -> \ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT\ -> \FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER\ -> \FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK\ -> \ -> \0\ -> \ -> \ -> \ -> \208757\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \206049\ -> \FWPP_SUBLAYER_INTERNAL_FIREWALL_WF\ -> \FWP_ACTION_PERMIT\ -> \ -> \ -> \ -\ + +
+ 2020-05-04T18:49:55.101Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.195.36.30 + 204.79.197.200 + 61673 + 443 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-1578316205-4060061518-881547182-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW + + 208757 + 48 + 0 + 1 + 1 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + + 0 + + + + 208757 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_PERMIT + + + 206049 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + + ``` -Important things to note: all capabilities are enabled and the resulting filter -determining the flow of the packet is 208757. +All capabilities are enabled and the resulting filter determining the flow of the packet is 208757. The filter stated above with action permit: **InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** ```xml -\ - \{e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5}\ - \ - \InternetClient Default Rule\ - \InternetClient Default Rule\ - \ - \ - \FWPM_PROVIDER_MPSSVC_WSH\ - \ - \e167000000000000\ - \.g......\ - \ - \FWPM_LAYER_ALE_AUTH_CONNECT_V4\ - \FWPM_SUBLAYER_MPSSVC_WSH\ - \ - \FWP_EMPTY\ - \ - \ - \ - \FWPM_CONDITION_ALE_PACKAGE_ID\ - \FWP_MATCH_NOT_EQUAL\ - \ - \FWP_SID\ - \S-1-0-0\ - \ - \ - \ - \FWPM_CONDITION_IP_REMOTE_ADDRESS\ - \FWP_MATCH_RANGE\ - \ - \FWP_RANGE_TYPE\ - \ - \ - \FWP_UINT32\ - \0.0.0.0\ - \ - \ - \FWP_UINT32\ - \255.255.255.255\ - \ - \ - \ - \ - \ - \FWPM_CONDITION_ORIGINAL_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_CURRENT_PROFILE_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_UINT32\ - \1\ - \ - \ - \ - \FWPM_CONDITION_ALE_USER_ID\ - \FWP_MATCH_EQUAL\ - \ - \FWP_SECURITY_DESCRIPTOR_TYPE\ - \O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)\ - \ - \ - \ - \ - \FWP_ACTION_PERMIT\ - \ - \ - \0\ - \ - \208757\ - \ - \FWP_UINT64\ - \412316868544\ - \ - \ + + {e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + e167000000000000 + .g...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 0.0.0.0 + + + FWP_UINT32 + 255.255.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 208757 + + FWP_UINT64 + 412316868544 + + ``` The capabilities field in a netEvent was added to the traces in the Windows 10 -May 2019 Update +May 2019 Update. From 4fc5bf0a7578056c563da078292ac7791fe903f8 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 13 Aug 2020 18:19:38 -0700 Subject: [PATCH 17/36] fixing H1s --- .../windows-firewall/troubleshooting-uwp-firewall.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index fd79a67511..1ea6cce448 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -39,9 +39,9 @@ filters ensures network isolation for UWP applications. Specifically, it guarant For more information on the filter arbitration algorithm and network isolation, see [Filter -Arbitration](https://docs.microsoft.com/en-us/windows/win32/fwp/filter-arbitration) +Arbitration](https://docs.microsoft.com/windows/win32/fwp/filter-arbitration) and -[Isolation](https://docs.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation). +[Isolation](https://docs.microsoft.com/windows/win32/secauthz/appcontainer-isolation). The following sections cover debugging case examples for loopback and non-loopback UWP app network connectivity issues. @@ -49,7 +49,7 @@ The following sections cover debugging case examples for loopback and non-loopba > As improvements to debugging and diagnostics in the Windows Filtering Platform are made, the trace examples in this document may not exactly match the traces collected on previous releases of Windows. -# Debugging UWP App Loopback scenarios +## Debugging UWP App Loopback scenarios If you need to establis a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. @@ -68,9 +68,9 @@ You can ensure loopback is enabled by checking the appx manifests of both the se For more information about loopback scenarios, see [Communicating with localhost -(loopback)](https://docs.microsoft.com/en-us/windows/iot-core/develop-your-app/loopback) +(loopback)](https://docs.microsoft.com/windows/iot-core/develop-your-app/loopback) -# Debugging Live Drops +## Debugging Live Drops If the issue happened recently, but you find you are not able to reproduce the issue, go to Debugging Past Drops for the appropriate trace commands. @@ -996,7 +996,7 @@ on the device (MDM, Group Policy, etc) and make sure it includes the private tar ``` -# Debugging Past Drops +## Debugging Past Drops If you are debugging a network drop from the past or from a remote machine, you may have traces already collected from Feedback Hub, such as nettrace.etl and From ee0509798aa1fd5162d5f1967ff8503fe3515d6f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 12:32:45 -0700 Subject: [PATCH 18/36] update toc add back topics --- .../threat-protection/windows-firewall/TOC.md | 104 ++++++++++++------ .../firewall-policy-design-example.md | 4 +- ...wall-with-advanced-security-design-plan.md | 2 +- ...with-advanced-security-deployment-guide.md | 12 +- ...windows-firewall-with-advanced-security.md | 19 ++-- 5 files changed, 84 insertions(+), 57 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 7861f11250..038232e7da 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -1,38 +1,51 @@ # [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) -## [Plan/Design]() +## [Plan deployment]() -### [Design Guide](windows-firewall-with-advanced-security-design-guide.md) +### [Design guide](windows-firewall-with-advanced-security-design-guide.md) -### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) +### [Design process](understanding-the-windows-firewall-with-advanced-security-design-process.md) -### [Deployment Goals]() -#### [Identify deployment goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) +### [Implementation goals]() +#### [Identify implementation goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) #### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) #### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) #### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) #### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) -### [Deployment designs]() -#### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -#### [Basic Design](basic-firewall-policy-design.md) -#### [Domain Isolation Design](domain-isolation-policy-design.md) -#### [Server Isolation Design](server-isolation-policy-design.md) -#### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md) +### [Implementation designs]() +#### [Mapping goals to a design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -### [Design plans]() -#### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md) -#### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) -##### [Planning Domain Isolation Zones]() -###### [Domain Isolation Zones](planning-domain-isolation-zones.md) -###### [Exemption List](exemption-list.md) -###### [Isolated Domain](isolated-domain.md) -###### [Boundary Zone](boundary-zone.md) -###### [Encryption Zone](encryption-zone.md) +#### [Basic design](basic-firewall-policy-design.md) +##### [Basic Design Example](firewall-policy-design-example.md) -#### [Planning Server Isolation Zones](planning-server-isolation-zones.md) -#### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) +#### [Domain isolation design](domain-isolation-policy-design.md) +##### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) + + +#### [Server isolation design](server-isolation-policy-design.md) +##### [Server Isolation Design Example](server-isolation-policy-design-example.md) + + +#### [Certificate-based isolation design](certificate-based-isolation-policy-design.md) +##### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) + +### [Design planning]() +#### [Planning your design](planning-your-windows-firewall-with-advanced-security-design.md) + +#### [Planning settings for a basic firewall policy](planning-settings-for-a-basic-firewall-policy.md) + +#### [Planning domain isolation zones]() +##### [Domain isolation zones](planning-domain-isolation-zones.md) +##### [Exemption list](exemption-list.md) +##### [Isolated domain](isolated-domain.md) +##### [Boundary zone](boundary-zone.md) +##### [Encryption zone](encryption-zone.md) + +#### [Planning server isolation zones](planning-server-isolation-zones.md) + +#### [Planning certificate-based authentication](planning-certificate-based-authentication.md) ##### [Documenting the Zones](documenting-the-zones.md) ##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) @@ -54,9 +67,31 @@ ###### [Planning GPO Deployment](planning-gpo-deployment.md) +### [Planning to deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) + + ## [Deployment guide]() -### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) -### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) +### [Deployment overview](windows-firewall-with-advanced-security-deployment-guide.md) + +### [Implementing your plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) + +### [Basic firewall deployment]() +#### [Checklist: Implementing a basic firewall policy design](checklist-implementing-a-basic-firewall-policy-design.md) + + + +### [Domain isolation deployment]() +#### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) + + + +### [Server isolation deployment]() +#### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) + + + +### [Certificate-based authentication]() +#### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) @@ -109,20 +144,19 @@ ## [References]() ### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) -### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) -### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) ### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) ### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) -### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) -#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) -#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) -#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) -#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) -### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) -#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) +### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) + + +### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) +### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) +### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) +### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) + +### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) +### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) ### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) diff --git a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md index 5127569bc4..ef30c1a5cd 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md @@ -1,5 +1,5 @@ --- -title: Firewall Policy Design Example (Windows 10) +title: Basic Firewall Policy Design Example (Windows 10) description: Firewall Policy Design Example ms.assetid: 0dc3bcfe-7a4d-4a15-93a9-64b13bd775a7 ms.reviewer: @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Firewall Policy Design Example +# Basic Firewall Policy Design Example **Applies to** - Windows 10 diff --git a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md index c56fd15494..841c88ae5d 100644 --- a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -48,7 +48,7 @@ Use the following parent checklists in this section of the guide to become famil - [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) -- [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) +- [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) - [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md index d91723c3d2..dbfd48ddf6 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md @@ -1,6 +1,6 @@ --- -title: Deploy Windows Defender Firewall with Advanced Security (Windows 10) -description: Windows Defender Firewall with Advanced Security Deployment Guide +title: Windows Defender Firewall with Advanced Security deployment overview (Windows 10) +description: Windows Defender Firewall with Advanced Security deployment overview ms.assetid: 56b51b97-1c38-481e-bbda-540f1216ad56 ms.reviewer: ms.author: dansimp @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Windows Defender Firewall with Advanced Security Deployment Guide +# Windows Defender Firewall with Advanced Security deployment overview **Applies to** - Windows 10 @@ -61,10 +61,4 @@ This guide does not provide: - Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. -## Overview of Windows Defender Firewall with Advanced Security - -Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot be authenticated as a trusted device cannot communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. - -The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. - For more information about Windows Defender Firewall with Advanced Security, see [Windows Defender Firewall with Advanced Security Overview](windows-firewall-with-advanced-security.md). diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md index 3261e0545f..37d4d64de1 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md @@ -25,10 +25,17 @@ ms.custom: asr This is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. +## Overview of Windows Defender Firewall with Advanced Security + +Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot be authenticated as a trusted device cannot communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. + +The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. + + + ## Feature description -Windows Defender Firewall with Advanced Security -is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy. +Windows Defender Firewall with Advanced Security is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy. ## Practical applications @@ -41,12 +48,4 @@ To help address your organizational network security challenges, Windows Defende - **Extends the value of existing investments.**  Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). -## In this section -| Topic | Description -| - | - | -| [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) | You can customize your Windows Defender Firewall configuration to isolate the network access of Microsoft Store apps that run on devices. | -| [Securing End-to-End IPsec Connections by Using IKEv2](securing-end-to-end-ipsec-connections-by-using-ikev2.md) | You can use IKEv2 to help secure your end-to-end IPSec connections. | -| [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) | Learn more about using Windows PowerShell to manage the Windows Defender Firewall. | -| [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md) | Learn how to create a design for deploying Windows Defender Firewall with Advanced Security. | -| [Windows Defender Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) | Learn how to deploy Windows Defender Firewall with Advanced Security. | From 110213ea267937f0ee3c91008021d880f7a9123e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 12:59:10 -0700 Subject: [PATCH 19/36] add troubleshooting topic --- windows/security/threat-protection/windows-firewall/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 038232e7da..874e91f06d 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -163,7 +163,7 @@ ## [Troubleshooting]() - +### [Troubleshooting UWP App Connectivity Issues in Windows Firewall](troubleshooting-uwp-firewall.md) From 774963624d0ed22ce68bc332e8615c39ec7705c3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 13:28:18 -0700 Subject: [PATCH 20/36] cleannnnnnn up --- .../threat-protection/windows-firewall/TOC.md | 98 +++++++++---------- ...with-advanced-security-deployment-goals.md | 17 ++-- ...t-devices-from-unwanted-network-traffic.md | 4 +- ...restrict-access-to-only-trusted-devices.md | 6 +- ...all-with-advanced-security-design-guide.md | 7 +- 5 files changed, 65 insertions(+), 67 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index 874e91f06d..e8109bbb5d 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -48,23 +48,23 @@ #### [Planning certificate-based authentication](planning-certificate-based-authentication.md) ##### [Documenting the Zones](documenting-the-zones.md) -##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) -###### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) -###### [Planning Network Access Groups](planning-network-access-groups.md) +##### [Planning group policy deployment for your isolation zones](planning-group-policy-deployment-for-your-isolation-zones.md) +###### [Planning isolation groups for the zones](planning-isolation-groups-for-the-zones.md) +###### [Planning network access groups](planning-network-access-groups.md) ###### [Planning the GPOs](planning-the-gpos.md) ####### [Firewall GPOs](firewall-gpos.md) ######## [GPO_DOMISO_Firewall](gpo-domiso-firewall.md) -####### [Isolated Domain GPOs](isolated-domain-gpos.md) +####### [Isolated domain GPOs](isolated-domain-gpos.md) ######## [GPO_DOMISO_IsolatedDomain_Clients](gpo-domiso-isolateddomain-clients.md) ######## [GPO_DOMISO_IsolatedDomain_Servers](gpo-domiso-isolateddomain-servers.md) -####### [Boundary Zone GPOs](boundary-zone-gpos.md) +####### [Boundary zone GPOs](boundary-zone-gpos.md) ######## [GPO_DOMISO_Boundary](gpo-domiso-boundary.md) -####### [Encryption Zone GPOs](encryption-zone-gpos.md) +####### [Encryption zone GPOs](encryption-zone-gpos.md) ######## [GPO_DOMISO_Encryption](gpo-domiso-encryption.md) -####### [Server Isolation GPOs](server-isolation-gpos.md) +####### [Server isolation GPOs](server-isolation-gpos.md) -###### [Planning GPO Deployment](planning-gpo-deployment.md) +###### [Planning GPO deployment](planning-gpo-deployment.md) ### [Planning to deploy](planning-to-deploy-windows-firewall-with-advanced-security.md) @@ -102,68 +102,68 @@ ## [How-to]() -### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) -### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) -### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) -### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md) -### [Configure Authentication Methods](configure-authentication-methods.md) -### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md) -### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) -### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md) -### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md) -### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md) -### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md) -### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) -### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md) -### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) +### [Add Production devices to the membership group for a zone](add-production-devices-to-the-membership-group-for-a-zone.md) +### [Add test devices to the membership group for a zone](add-test-devices-to-the-membership-group-for-a-zone.md) +### [Assign security group filters to the GPO](assign-security-group-filters-to-the-gpo.md) +### [Change rules from request to require mode](Change-Rules-From-Request-To-Require-Mode.Md) +### [Configure authentication methods](Configure-authentication-methods.md) +### [Configure data protection (Quick Mode) settings](configure-data-protection-quick-mode-settings.md) +### [Configure Group Policy to autoenroll and deploy certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md) +### [Configure key exchange (main mode) settings](configure-key-exchange-main-mode-settings.md) +### [Configure the rules to require encryption](configure-the-rules-to-require-encryption.md) +### [Configure the Windows Firewall log](configure-the-windows-firewall-log.md) +### [Configure the workstation authentication certificate template](configure-the-workstation-authentication-certificate-template.md) +### [Configure Windows Firewall to suppress notifications when a program is blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) +### [Confirm that certificates are deployed correctly](confirm-that-certificates-are-deployed-correctly.md) +### [Copy a GPO to create a new GPO](copy-a-gpo-to-create-a-new-gpo.md) ### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) ### [Create a Group Policy Object](create-a-group-policy-object.md) -### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) -### [Create an Authentication Request Rule](create-an-authentication-request-rule.md) -### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) -### [Create an Inbound Port Rule](create-an-inbound-port-rule.md) -### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) -### [Create an Outbound Port Rule](create-an-outbound-port-rule.md) -### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md) -### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) -### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) +### [Create an authentication exemption list rule](create-an-authentication-exemption-list-rule.md) +### [Create an authentication request rule](create-an-authentication-request-rule.md) +### [Create an inbound ICMP rule](create-an-inbound-icmp-rule.md) +### [Create an inbound port rule](create-an-inbound-port-rule.md) +### [Create an inbound program or service rule](create-an-inbound-program-or-service-rule.md) +### [Create an outbound port rule](create-an-outbound-port-rule.md) +### [Create an outbound program or service rule](create-an-outbound-program-or-service-rule.md) +### [Create inbound rules to support RPC](create-inbound-rules-to-support-rpc.md) +### [Create WMI filters for the GPO](create-wmi-filters-for-the-gpo.md) ### [Create Windows Firewall rules in Intune](create-windows-firewall-rules-in-intune.md) -### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md) -### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md) -### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md) -### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) -### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) -### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md) +### [Enable predefined inbound rules](enable-predefined-inbound-rules.md) +### [Enable predefined outbound rules](enable-predefined-outbound-rules.md) +### [Exempt ICMP from authentication](exempt-icmp-from-authentication.md) +### [Link the GPO to the domain](link-the-gpo-to-the-domain.md) +### [Modify GPO filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) +### [Open IP security policies](open-the-group-policy-management-console-to-ip-security-policies.md) ### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md) ### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) ### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md) -### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md) +### [Restrict server access](restrict-server-access-to-members-of-a-group-only.md) ### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md) ### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) -### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md) + ## [References]() -### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md) -### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md) +### [Checklist: Creating Group Policy objects](checklist-creating-group-policy-objects.md) +### [Checklist: Creating inbound firewall rules](checklist-creating-inbound-firewall-rules.md) ### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) ### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) -### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md) -### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md) -### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md) -### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md) +### [Checklist: Configuring rules for the isolated domain](checklist-configuring-rules-for-the-isolated-domain.md) +### [Checklist: Configuring rules for the boundary zone](checklist-configuring-rules-for-the-boundary-zone.md) +### [Checklist: Configuring rules for the encryption zone](checklist-configuring-rules-for-the-encryption-zone.md) +### [Checklist: Configuring rules for an isolated server zone](checklist-configuring-rules-for-an-isolated-server-zone.md) -### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) -### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) +### [Checklist: Configuring rules for servers in a standalone isolated server zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md) +### [Checklist: Creating rules for clients of a standalone isolated server zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md) -### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) +### [Appendix A: Sample GPO template files for settings used in this guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) ## [Troubleshooting]() -### [Troubleshooting UWP App Connectivity Issues in Windows Firewall](troubleshooting-uwp-firewall.md) +### [Troubleshooting UWP app connectivity issues in Windows Firewall](troubleshooting-uwp-firewall.md) diff --git a/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md index 5e3a16c452..96725d8ff3 100644 --- a/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md @@ -1,6 +1,6 @@ --- -title: Identify Goals for your WFAS Deployment (Windows 10) -description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) Deployment Goals +title: Identify implementation goals for Windows Defender Firewall with Advanced Security Deployment (Windows 10) +description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) implementation goals ms.assetid: 598cf45e-2e1c-4947-970f-361dfa264bba ms.reviewer: ms.author: dansimp @@ -17,22 +17,21 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals - +# Identifying Windows Defender Firewall with Advanced Security implementation goals **Applies to** - Windows 10 - Windows Server 2016 -Correctly identifying your Windows Defender Firewall with Advanced Security deployment goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your deployment goals. Prioritize and, if possible, combine your deployment goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall deployment goals presented in this guide that are relevant to your scenarios. +Correctly identifying your Windows Defender Firewall with Advanced Security implementation goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your implementation goals. Prioritize and, if possible, combine your implementation goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall implementation goals presented in this guide that are relevant to your scenarios. -The following table lists the three main tasks for articulating, refining, and subsequently documenting your Windows Defender Firewall deployment goals: +The following table lists the three main tasks for articulating, refining, and subsequently documenting your Windows Defender Firewall implementation goals: | Deployment goal tasks | Reference links | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Evaluate predefined Windows Defender Firewall with Advanced Security deployment goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives. | Predefined deployment goals:

  • [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)

  • [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)

  • [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)

  • [Restrict Access to Sensitive Resources to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)
| -| Map one goal or a combination of the predefined deployment goals to an existing Windows Defender Firewall with Advanced Security design. |
  • [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
| -| Based on the status of your current infrastructure, document your deployment goals for your Windows Defender Firewall with Advanced Security design into a deployment plan. |
  • [Designing A Windows Defender Firewall Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)

  • [Planning Your Windows Defender Firewall Design with Advanced Security](planning-your-windows-firewall-with-advanced-security-design.md)
| +| Evaluate predefined Windows Defender Firewall with Advanced Security implementation goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives. | Predefined implementation goals:

  • [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)

  • [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)

  • [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)

  • [Restrict Access to Sensitive Resources to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)
| +| Map one goal or a combination of the predefined implementation goals to an existing Windows Defender Firewall with Advanced Security design. |
  • [Mapping Your implementation goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
| +| Based on the status of your current infrastructure, document your implementation goals for your Windows Defender Firewall with Advanced Security design into a deployment plan. |
  • [Designing A Windows Defender Firewall Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)

  • [Planning Your Windows Defender Firewall Design with Advanced Security](planning-your-windows-firewall-with-advanced-security-design.md)
|
diff --git a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md index a3ca3c4b6e..76364690ae 100644 --- a/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md +++ b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md @@ -1,5 +1,5 @@ --- -title: Protect Devices from Unwanted Network Traffic (Windows 10) +title: Protect devices from unwanted network traffic (Windows 10) description: Protect Devices from Unwanted Network Traffic ms.assetid: 307d2b38-e8c4-4358-ae16-f2143af965dc ms.reviewer: @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 04/19/2017 --- -# Protect Devices from Unwanted Network Traffic +# Protect devices from unwanted network traffic **Applies to** - Windows 10 diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index cbdd8e51d9..56b9898e53 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -1,6 +1,6 @@ --- -title: Restrict Access to Only Trusted Devices (Windows 10) -description: Restrict Access to Only Trusted Devices +title: Restrict access to only trusted devices (Windows 10) +description: estrict access to only trusted devices ms.assetid: bc1f49a4-7d54-4857-8af9-b7c79f47273b ms.reviewer: ms.author: dansimp @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Restrict Access to Only Trusted Devices +# Restrict access to only trusted devices **Applies to** - Windows 10 diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md index 70c8912478..0cda980c2c 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Firewall with Advanced Security Design Guide (Windows 10) -description: Windows Defender Firewall with Advanced Security Design Guide +title: Windows Defender Firewall with Advanced Security design guide (Windows 10) +description: Windows Defender Firewall with Advanced Security design guide ms.assetid: 5c631389-f232-4b95-9e48-ec02b8677d51 ms.reviewer: ms.author: dansimp @@ -17,8 +17,7 @@ ms.topic: conceptual ms.date: 10/05/2017 --- -# Windows Defender Firewall with Advanced Security -Design Guide +# Windows Defender Firewall with Advanced Security design guide **Applies to** - Windows 10 From d3f75c7897da0ed2e7e2892dc073c42e5fb71e2c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 14 Aug 2020 13:46:54 -0700 Subject: [PATCH 21/36] more clean up --- .../threat-protection/windows-firewall/TOC.md | 22 +++++++++---------- ...rtificate-based-isolation-policy-design.md | 6 ++--- ...rtificate-based-isolation-policy-design.md | 2 +- ...enting-a-domain-isolation-policy-design.md | 2 +- ...andalone-server-isolation-policy-design.md | 2 +- .../domain-isolation-policy-design.md | 2 +- ...-firewall-with-advanced-security-design.md | 10 ++++----- .../server-isolation-policy-design.md | 2 +- ...l-with-advanced-security-design-process.md | 7 +++--- ...all-with-advanced-security-design-guide.md | 7 +++--- 10 files changed, 30 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md index e8109bbb5d..e5edff503e 100644 --- a/windows/security/threat-protection/windows-firewall/TOC.md +++ b/windows/security/threat-protection/windows-firewall/TOC.md @@ -8,28 +8,28 @@ ### [Implementation goals]() #### [Identify implementation goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) -#### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) -#### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) -#### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md) -#### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md) +#### [Protect devices from unwanted network traffic](protect-devices-from-unwanted-network-traffic.md) +#### [Restrict access to only trusted devices](restrict-access-to-only-trusted-devices.md) +#### [Require encryption](require-encryption-when-accessing-sensitive-network-resources.md) +#### [Restrict access](restrict-access-to-only-specified-users-or-devices.md) ### [Implementation designs]() #### [Mapping goals to a design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -#### [Basic design](basic-firewall-policy-design.md) -##### [Basic Design Example](firewall-policy-design-example.md) +#### [Basic firewall design](basic-firewall-policy-design.md) +##### [Basic firewall design example](firewall-policy-design-example.md) #### [Domain isolation design](domain-isolation-policy-design.md) -##### [Domain Isolation Design Example](domain-isolation-policy-design-example.md) +##### [Domain isolation design example](domain-isolation-policy-design-example.md) #### [Server isolation design](server-isolation-policy-design.md) -##### [Server Isolation Design Example](server-isolation-policy-design-example.md) +##### [Server Isolation design example](server-isolation-policy-design-example.md) #### [Certificate-based isolation design](certificate-based-isolation-policy-design.md) -##### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md) +##### [Certificate-based Isolation design example](certificate-based-isolation-policy-design-example.md) ### [Design planning]() #### [Planning your design](planning-your-windows-firewall-with-advanced-security-design.md) @@ -145,8 +145,8 @@ ## [References]() ### [Checklist: Creating Group Policy objects](checklist-creating-group-policy-objects.md) ### [Checklist: Creating inbound firewall rules](checklist-creating-inbound-firewall-rules.md) -### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md) -### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md) +### [Checklist: Creating outbound firewall rules](checklist-creating-outbound-firewall-rules.md) +### [Checklist: Configuring basic firewall settings](checklist-configuring-basic-firewall-settings.md) ### [Checklist: Configuring rules for the isolated domain](checklist-configuring-rules-for-the-isolated-domain.md) diff --git a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md index 71775ab476..38ec0654bb 100644 --- a/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md @@ -17,7 +17,7 @@ ms.topic: conceptual ms.date: 08/17/2017 --- -# Certificate-based Isolation Policy Design +# Certificate-based isolation policy design **Applies to** - Windows 10 @@ -35,7 +35,7 @@ For Windows devices that are part of an Active Directory domain, you can use Gro For more info about this design: -- This design coincides with the deployment goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - To learn more about this design, see [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md). @@ -45,4 +45,4 @@ For more info about this design: - For a list of tasks that you can use to deploy your certificate-based policy design, see [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md). -**Next:** [Evaluating Windows Defender Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) + diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md index 4d6b02ef58..573b76aa96 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md @@ -31,7 +31,7 @@ This parent checklist includes cross-reference links to important concepts about | Task | Reference | | - | - | -| Review important concepts and examples for certificate-based authentication to determine if this design meets your deployment goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
[Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
[Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | +| Review important concepts and examples for certificate-based authentication to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
[Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
[Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | | Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you have not already deployed a CA on your network.| | | Configure the certificate template for workstation authentication certificates.| [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)| | Configure Group Policy to automatically deploy certificates based on your template to workstation devices. | [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)| diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md index 139618cb53..d946ecab9e 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md @@ -33,7 +33,7 @@ The procedures in this section use the Group Policy MMC snap-ins to configure th | Task | Reference | | - | - | -| Review important concepts and examples for the domain isolation policy design, determine your Windows Defender Firewall with Advanced Security deployment goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Domain Isolation Policy Design](domain-isolation-policy-design.md)
[Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
[Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | +| Review important concepts and examples for the domain isolation policy design, determine your Windows Defender Firewall with Advanced Security implementation goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Domain Isolation Policy Design](domain-isolation-policy-design.md)
[Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
[Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | | Create the GPOs and connection security rules for the isolated domain.| [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)| | Create the GPOs and connection security rules for the boundary zone.| [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)| | Create the GPOs and connection security rules for the encryption zone.| [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)| diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md index 05aad0007e..2ed1fd1e5e 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -33,7 +33,7 @@ This parent checklist includes cross-reference links to important concepts about | Task | Reference | | - | - | -| Review important concepts and examples for the server isolation policy design to determine if this design meets your deployment goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Server Isolation Policy Design](server-isolation-policy-design.md)
[Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
[Planning Server Isolation Zones](planning-server-isolation-zones.md) | +| Review important concepts and examples for the server isolation policy design to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Server Isolation Policy Design](server-isolation-policy-design.md)
[Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
[Planning Server Isolation Zones](planning-server-isolation-zones.md) | | Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| | Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| | Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index 948932fb53..b618fe6d2d 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -59,7 +59,7 @@ In order to expand the isolated domain to include Devices that cannot be part of For more info about this design: -- This design coincides with the deployment goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - To learn more about this design, see the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md). diff --git a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md index 9c73c224b9..6f6cd2d1a1 100644 --- a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md @@ -1,6 +1,6 @@ --- -title: Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design (Windows 10) -description: Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design +title: Mapping your implementation goals to a Windows Firewall with Advanced Security design (Windows 10) +description: Mapping your implementation goals to a Windows Firewall with Advanced Security design ms.assetid: 7e68c59e-ba40-49c4-8e47-5de5d6b5eb22 ms.reviewer: ms.author: dansimp @@ -17,17 +17,17 @@ ms.topic: conceptual ms.date: 04/19/2017 --- -# Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design +# Mapping your implementation goals to a Windows Firewall with Advanced Security design **Applies to** - Windows 10 - Windows Server 2016 -After you finish reviewing the existing Windows Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. +After you finish reviewing the existing Windows Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. >**Important:**  The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design. -Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security deployment goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security deployment goals to meet the needs of your organization. +Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security implementation goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security implementation goals to meet the needs of your organization. | Deployment Goals | Basic Firewall Policy Design | Domain Isolation Policy Design | Server Isolation Policy Design | Certificate-based Isolation Policy Design | | - |- | - | - | - | diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index 1eeea3dc76..23a6808219 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -49,7 +49,7 @@ This design can be applied to devices that are part of an Active Directory fores For more info about this design: -- This design coincides with the deployment goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - To learn more about this design, see [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). diff --git a/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md index 26796b6814..0449d6b01f 100644 --- a/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md +++ b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md @@ -20,13 +20,12 @@ ms.author: dansimp Designing any deployment starts by performing several important tasks: -- [Identifying Your Windows Defender Firewall with Advanced Security Design Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) +- [Identifying your windows defender firewall with advanced security design goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) -- [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) +- [Mapping your implementation goals to a Windows Defender Firewall with Advanced Security design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) -- [Evaluating Windows Defender Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) -After you identify your deployment goals and map them to a Windows Defender Firewall with Advanced Security design, you can begin documenting the design based on the processes that are described in the following topics: +After you identify your implementation goals and map them to a Windows Defender Firewall with Advanced Security design, you can begin documenting the design based on the processes that are described in the following topics: - [Designing A Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md index 0cda980c2c..58bc8e79a9 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md @@ -39,7 +39,7 @@ Windows Defender Firewall should be part of a comprehensive security solution th To successfully use this guide, you need a good understanding of both the capabilities provided by Windows Defender Firewall, and how to deliver configuration settings to your managed devices by using Group Policy in Active Directory. -You can use the deployment goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those presented here: +You can use the implementation goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those presented here: - **Basic firewall policy design**. Restricts network traffic in and out of your devices to only that which is needed and authorized. @@ -67,9 +67,8 @@ Deployment Guide at these locations: | Topic | Description | - | - | | [Understanding the Windows Defender Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) | Learn how to get started with the Windows Defender Firewall with Advanced Security design process. | -| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) | Learn how to identify your Windows Defender Firewall with Advanced Security deployment goals. | -| [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) | After you finish reviewing the existing Windows Defender Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design. | -| [Evaluating Windows Defender Firewall with Advanced Security Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md) | Learn how to use Windows Defender Firewall to improve the security of the computers connected to the network. | +| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) | Learn how to identify your Windows Defender Firewall with Advanced Security implementation goals. | +| [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) | After you finish reviewing the existing Windows Defender Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design. | | [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) | To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. | | [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) | After you have gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. | | [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) | You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). | From 44bbb3d9e0004ee0a026b98f25e333b55191fe96 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 17 Aug 2020 10:29:10 -0700 Subject: [PATCH 22/36] Update provisioning-create-package.md --- .../provisioning-create-package.md | 50 ++++++++++--------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 3c75f63d1f..f9816492d7 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,6 +1,6 @@ --- title: Create a provisioning package (Windows 10) -description: Learn how to create a provisioning package for Windows 10. Provisioning packages let you quickly configure a device without having to install a new image. +description: Learn how to create a provisioning package for Windows 10, which lets you quickly configure a device without having to install a new image. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -26,39 +26,41 @@ You can use Windows Configuration Designer to create a provisioning package (.pp >[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) > [!TIP] -> We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. +> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. ## Start a new project 1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, + - From either the Start screen or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. or - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. + - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then select **ICD.exe**. 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: ![Configuration Designer wizards](../images/icd-create-options-1703.png) - - The wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices. Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizardS](provisioning-packages.md#configuration-designer-wizards). + - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) + + Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards). - - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. *The rest of this procedure uses advanced provisioning.* + - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.) >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > > ![Switch to advanced editor](../images/icd-switch.png) -3. Enter a name for your project, and then click **Next**. +3. Enter a name for your project, and then select **Next**. -4. Select the settings you want to configure, based on the type of device, and then click **Next**. The following table describes the options. +4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options. | Windows edition | Settings available for customization | Provisioning package can apply to | @@ -71,12 +73,12 @@ You can use Windows Configuration Designer to create a provisioning package (.pp | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) | -5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then click **Finish**. +5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**. >[!TIP] ->**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly. +>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages that you create so you don't have to reconfigure those common settings repeatedly. -After you click **Finish**, Windows Configuration Designer will open the **Available customizations** pane and you can then configure settings for the package. +6. In the **Available customizations** pane, you can now configure settings for the package. @@ -94,7 +96,7 @@ The process for configuring settings is similar for all settings. The following - +
step one
Expand a category.		Expand Certificates category
step two
Select a setting.		Select ClientCertificates
step three
Enter a value for the setting. Click Add if the button is displayed.		Enter a name for the certificate
step three
Enter a value for the setting. Select Add if the button is displayed.		Enter a name for the certificate
step four
Some settings, such as this example, require additional information. In Available customizations, select the value you just created, and additional settings are displayed.		Additional settings for client certificate
step five
When the setting is configured, it is displayed in the Selected customizations pane.		Selected customizations pane
@@ -106,39 +108,39 @@ For details on each specific setting, see [Windows Provisioning settings referen ## Build package -1. After you're done configuring your customizations, click **Export** and select **Provisioning Package**. +1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. ![Export on top bar](../images/icd-export-menu.png) -2. In the **Describe the provisioning package** window, enter the following information, and then click **Next**: +2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - - **Version (in Major.Minor format** - - Optional. You can change the default package version by specifying a new value in the **Version** field. + - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. -3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate. Both selections are optional. Click **Next** after you make your selections. +3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: - **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + >You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. > >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. -4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows Configuration Designer uses the project folder as the output location. +4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. -5. In the **Build the provisioning package** window, click **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - If you need to cancel the build, click Cancel. This cancels the current build process, closes the wizard, and takes you back to the Customizations Page. + If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. -6. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, click **Finish** to close the wizard and go back to the Customizations page. +7. When you are done, select **Finish** to close the wizard and go back to the Customizations page. **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) From a207eb23d463d023f39e1325c8042a565c7ee559 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 17 Aug 2020 10:36:39 -0700 Subject: [PATCH 23/36] Update provisioning-create-package.md --- .../provisioning-packages/provisioning-create-package.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index f9816492d7..5b464073a9 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -140,7 +140,7 @@ For details on each specific setting, see [Windows Provisioning settings referen If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, select **Finish** to close the wizard and go back to the Customizations page. +7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) From 0820f6e01fb3960b91a48de18f8775cdf11e933c Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Thu, 20 Aug 2020 17:03:05 +0300 Subject: [PATCH 24/36] Update configure-endpoints-vdi.md Minor modification to ensure customers don't miss the step. I've seen cases where customers did not copy the CMD file and only pasted in the PS1 file and this caused onboarding to fial. --- .../microsoft-defender-atp/configure-endpoints-vdi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 32e7e448f6..771c2b866b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -63,7 +63,7 @@ The following steps will guide you through onboarding VDI devices and will highl 1. Click **Download package** and save the .zip file. -2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`. +2. Copy all the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`. >[!NOTE] >If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose the **Show hidden files and folders** option from file explorer. From a5cbd9f97a20c25200ea1ea4f4a1077e5313fb3a Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 20 Aug 2020 10:37:15 -0700 Subject: [PATCH 25/36] network section added --- windows/whats-new/whats-new-windows-10-version-2004.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index 8518f5c4af..c9092135cd 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -124,6 +124,12 @@ The following [Delivery Optimization](https://docs.microsoft.com/windows/deploym - Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. - Update less: Last year, we [changed update installation policies](https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency/#l2jH7KMkOkfcWdBs.97) for Windows 10 to only target devices running a feature update version that is nearing end of service. As a result, many devices are only updating once a year. To enable all devices to make the most of this policy change, and to prevent confusion, we have removed deferrals from the Windows Update settings **Advanced Options** page starting on Windows 10, version 2004. If you wish to continue leveraging deferrals, you can use local Group Policy (**Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview builds and Feature Updates are received** or **Select when Quality Updates are received**). For more information about this change, see [Simplified Windows Update settings for end users](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplified-windows-update-settings-for-end-users/ba-p/1497215). +## Networking + +Windows now supports the latest Wi-Fi standards with [Wi-Fi 6 and WPA3](https://support.microsoft.com/help/4562575/windows-10-faster-more-secure-wifi). Wi-Fi 6 gives you better wireless coverage and performance with added security. WPA3 provides improved Wi-Fi security and secures open networks. + +In this release, Tunnel Extensible Authentication Protocol (TEAP) has been added as an authentication method to allow chaining together multiple credentials into a single EAP transaction. TEAP networks can be configured by [enterprise policy](https://docs.microsoft.com/openspecs/windows_protocols/ms-gpwl/94cf6896-c28e-4865-b12a-d83ee38cd3ea). + ## Virtualization ### Windows Sandbox From 1ca3ea1af7d85603d83849beb924db7ce12701fc Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 20 Aug 2020 11:28:24 -0700 Subject: [PATCH 26/36] split section --- windows/whats-new/whats-new-windows-10-version-2004.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index c9092135cd..8c86914b6b 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -126,8 +126,12 @@ The following [Delivery Optimization](https://docs.microsoft.com/windows/deploym ## Networking +### Wi-Fi 6 and WPA3 + Windows now supports the latest Wi-Fi standards with [Wi-Fi 6 and WPA3](https://support.microsoft.com/help/4562575/windows-10-faster-more-secure-wifi). Wi-Fi 6 gives you better wireless coverage and performance with added security. WPA3 provides improved Wi-Fi security and secures open networks. +### TEAP + In this release, Tunnel Extensible Authentication Protocol (TEAP) has been added as an authentication method to allow chaining together multiple credentials into a single EAP transaction. TEAP networks can be configured by [enterprise policy](https://docs.microsoft.com/openspecs/windows_protocols/ms-gpwl/94cf6896-c28e-4865-b12a-d83ee38cd3ea). ## Virtualization From fc73a7071c352009a923751d0b10859de9434dec Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Thu, 20 Aug 2020 12:17:28 -0700 Subject: [PATCH 27/36] Relese notes for 101.05.17 --- .../microsoft-defender-atp/mac-whatsnew.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 4b48c8771f..a76ef78405 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -38,6 +38,16 @@ ms.topic: conceptual > 2. Refer to this documentation for detailed configuration information and instructions: [New configuration profiles for macOS Catalina and newer versions of macOS](mac-sysext-policies.md). > 3. Monitor this page for an announcement of the actual release of MDATP for Mac agent update. +## 101.05.17 + +> [!IMPORTANT] +> We are working on a new and enhanced syntax for the `mdatp` command-line tool. The new syntax is currently the default in the Insider Fast and Insider Slow update channels. We encourage you to famliliarize yourself with this new syntax. +> +> We will continue supporting the old syntax in parallel with the new syntax and will provide more communication around the deprecation plan for the old syntax in the upcoming months. + +- Addressed a kernel panic that occurred sometimes when accessing SMB file shares +- Performance improvements & bug fixes + ## 101.05.16 - Improvements to quick scan logic to significantly reduce the number of scanned files From a31f68d0b47e11fec69b5d6d8c949d8000405867 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:07:00 -0700 Subject: [PATCH 28/36] Applied note style and Acrolinx spelling: "estrict" --- .../restrict-access-to-only-trusted-devices.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index 56b9898e53..3a0dc80f39 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -1,6 +1,6 @@ --- title: Restrict access to only trusted devices (Windows 10) -description: estrict access to only trusted devices +description: Restrict access to only trusted devices ms.assetid: bc1f49a4-7d54-4857-8af9-b7c79f47273b ms.reviewer: ms.author: dansimp @@ -27,7 +27,8 @@ Your organizational network likely has a connection to the Internet. You also li To mitigate this risk, you must be able to isolate the devices you trust, and restrict their ability to receive unsolicited network traffic from untrusted devices. By using connection security and firewall rules available in Windows Defender Firewall with Advanced Security, you can logically isolate the devices that you trust by requiring that all unsolicited inbound network traffic be authenticated. Authentication ensures that each device or user can positively identify itself by using credentials that are trusted by the other device. Connection security rules can be configured to use IPsec with the Kerberos V5 protocol available in Active Directory, or certificates issued by a trusted certification authority as the authentication method. ->**Note:**  Because the primary authentication method recommended for devices that are running Windows is to use the Kerberos V5 protocol with membership in an Active Directory domain, this guide refers to this logical separation of computers as *domain isolation*, even when certificates are used to extend the protection to devices that are not part of an Active Directory domain. +> [!NOTE] +> Because the primary authentication method recommended for devices that are running Windows is to use the Kerberos V5 protocol with membership in an Active Directory domain, this guide refers to this logical separation of computers as *domain isolation*, even when certificates are used to extend the protection to devices that are not part of an Active Directory domain. The protection provided by domain isolation can help you comply with regulatory and legislative requirements, such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. From cb4df1b00e3a7d0e15de0031a326644ff8d6e18b Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:20:36 -0700 Subject: [PATCH 29/36] Acrolinx spelling, punctuation, some grammar fixes --- .../troubleshooting-uwp-firewall.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md index 1ea6cce448..6071427eda 100644 --- a/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall.md @@ -27,7 +27,7 @@ UWP app network connectivity issues are typically caused by: 1. The UWP app was not permitted to receive loopback traffic. This must be configured. By default, UWP apps are not allowed to receive loopback traffic. 2. The UWP app is missing the proper capability tokens. -3. The private range is configured incorrectly. For example, the private ranges is set incorrectly through GP/MDM policies, etc. +3. The private range is configured incorrectly. For example, the private range is set incorrectly through GP/MDM policies, etc. To understand these causes more thoroughly, there are several concepts to review. @@ -51,24 +51,24 @@ traces collected on previous releases of Windows. ## Debugging UWP App Loopback scenarios -If you need to establis a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. +If you need to establish a TCP/IP connection between two processes on the same host where one of them is a UWP app, you must enable loopback. To enable loopback for client outbound connections, run the following at a command prompt: -```dos +```console CheckNetIsolation.exe LoopbackExempt -a -n= ``` To enable loopback for server inbound connections, run the following at a command prompt: -```dos +```console CheckNetIsolation.exe LoopbackExempt -is -n= ``` You can ensure loopback is enabled by checking the appx manifests of both the sender and receiver. For more information about loopback scenarios, see [Communicating with localhost -(loopback)](https://docs.microsoft.com/windows/iot-core/develop-your-app/loopback) +(loopback)](https://docs.microsoft.com/windows/iot-core/develop-your-app/loopback). ## Debugging Live Drops @@ -76,7 +76,7 @@ If the issue happened recently, but you find you are not able to reproduce the i If you can consistently reproduce the issue, then you can run the following in an admin command prompt to gather a fresh trace: -```DOS +```console Netsh wfp capture start keywords=19 Netsh wfp capture stop @@ -760,7 +760,7 @@ PrivateNetwork Outbound Default Rule filter. The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, 10.1.1.1, is not included in these filters it becomes clear that the address is not in the private range. Check the policies that configure the private range -on the device (MDM, Group Policy, etc) and make sure it includes the private targetaddress you wanted to reach. +on the device (MDM, Group Policy, etc.) and make sure it includes the private target address you wanted to reach. **PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** ```xml From 6288eb39f606acbabfe89303dfd0d8f04aa08105 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:24:16 -0700 Subject: [PATCH 30/36] Applied note style --- ...implementing-a-certificate-based-isolation-policy-design.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md index 573b76aa96..ec38163418 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md @@ -25,7 +25,8 @@ ms.date: 08/17/2017 This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design. ->**Note:**  Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist +> [!NOTE] +> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist **Checklist: Implementing certificate-based authentication** From 8032365eb3e8c71afe42efeee8ba64ee24e5ca79 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:25:29 -0700 Subject: [PATCH 31/36] Applied note style --- .../checklist-implementing-a-domain-isolation-policy-design.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md index d946ecab9e..be895718b3 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md @@ -25,7 +25,8 @@ ms.date: 08/17/2017 This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. ->**Note:**  Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. +> [!NOTE] +> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. The procedures in this section use the Group Policy MMC snap-ins to configure the GPOs, but you can also use Windows PowerShell to configure GPOs. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). From b30d1223362cfbc94b3205252985ff69239a782e Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:26:38 -0700 Subject: [PATCH 32/36] Applied note style --- ...implementing-a-standalone-server-isolation-policy-design.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md index 2ed1fd1e5e..0435b698be 100644 --- a/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -27,7 +27,8 @@ This checklist contains procedures for creating a server isolation policy design This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. ->**Note:**  Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. +> [!NOTE] +> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. **Checklist: Implementing a standalone server isolation policy design** From a17a245dad3c529ef3197fb16ec62052cf8cbbb6 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:27:33 -0700 Subject: [PATCH 33/36] Applied "Important" note style --- .../windows-firewall/domain-isolation-policy-design.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index b618fe6d2d..df754926bf 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -50,8 +50,8 @@ Characteristics of this design, as shown in the diagram, include the following: - Untrusted non-domain members (area D) - Devices that are not managed by your organization and have an unknown security configuration must have access only to those devices required for your organization to correctly conduct its business. Domain isolation exists to put a logical barrier between these untrusted Devices and your organization's devices. After implementing this design, your administrative team will have centralized management of the firewall and connection security rules applied to the devices in your organization. - ->**Important:**  This design builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md), and in turn serves as the foundation for the [Server Isolation Policy Design](server-isolation-policy-design.md). If you plan to deploy all three, we recommend that you do the design work for all three together, and then deploy in the sequence presented. +> [!IMPORTANT] +> This design builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md), and in turn serves as the foundation for the [Server Isolation Policy Design](server-isolation-policy-design.md). If you plan to deploy all three, we recommend that you do the design work for all three together, and then deploy in the sequence presented. This design can be applied to Devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules. From 3f22784ad8528578b7357af0da648fa55f76497b Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:28:55 -0700 Subject: [PATCH 34/36] Applied "Important" note style --- ...als-to-a-windows-firewall-with-advanced-security-design.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md index 6f6cd2d1a1..314389955f 100644 --- a/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md @@ -24,8 +24,8 @@ ms.date: 04/19/2017 - Windows Server 2016 After you finish reviewing the existing Windows Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. - ->**Important:**  The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design. +> [!IMPORTANT] +> The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design. Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security implementation goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security implementation goals to meet the needs of your organization. From 29d2a49f6fe398ec2bf587cabfe3b2a59a90722f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:30:11 -0700 Subject: [PATCH 35/36] Applied "Important" note style --- .../windows-firewall/server-isolation-policy-design.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index 23a6808219..7d2631e576 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -43,7 +43,8 @@ Characteristics of this design include the following: To add support for server isolation, you must ensure that the authentication methods are compatible with the requirements of the isolated server. For example, if you want to authorize user accounts that are members of a NAG in addition to authorizing computer accounts, you must enable both user and computer authentication in your connection security rules. ->**Important:**  This design builds on the [Domain Isolation Policy Design](domain-isolation-policy-design.md), which in turn builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md). If you plan to deploy all three designs, do the design work for all three together, and then deploy in the sequence presented. +> [!IMPORTANT] +> This design builds on the [Domain Isolation Policy Design](domain-isolation-policy-design.md), which in turn builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md). If you plan to deploy all three designs, do the design work for all three together, and then deploy in the sequence presented. This design can be applied to devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules. From c33a891b0ad07fba35fd473ac75ea19a7619f795 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 20 Aug 2020 14:31:34 -0700 Subject: [PATCH 36/36] Applied "Caution" note style --- ...indows-firewall-with-advanced-security-deployment-guide.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md index dbfd48ddf6..a600f54944 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md @@ -46,8 +46,8 @@ After you select your design and gather the required information about the zones - [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) Use the checklists in [Implementing Your Windows Defender Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) to determine how best to use the instructions in this guide to deploy your particular design. - ->**Caution:**  We recommend that you use the techniques documented in this guide only for GPOs that must be deployed to the majority of the devices in your organization, and only when the OU hierarchy in your Active Directory domain does not match the deployment needs of these GPOs. These characteristics are typical of GPOs for server and domain isolation scenarios, but are not typical of most other GPOs. When the OU hierarchy supports it, deploy a GPO by linking it to the lowest level OU that contains all of the accounts to which the GPO applies. +> [!CAUTION] +> We recommend that you use the techniques documented in this guide only for GPOs that must be deployed to the majority of the devices in your organization, and only when the OU hierarchy in your Active Directory domain does not match the deployment needs of these GPOs. These characteristics are typical of GPOs for server and domain isolation scenarios, but are not typical of most other GPOs. When the OU hierarchy supports it, deploy a GPO by linking it to the lowest level OU that contains all of the accounts to which the GPO applies. In a large enterprise environment with hundreds or thousands of GPOs, using this technique with too many GPOs can result in user or device accounts that are members of an excessive number of groups; this can result in network connectivity problems if network protocol limits are exceeded.