mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 04:13:41 +00:00
Merge branch 'master' into Michiko
This commit is contained in:
Brian Lich
@ -31,6 +31,7 @@
|
||||
##### [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
|
||||
#### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md)
|
||||
#### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md)
|
||||
#### [Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md)
|
||||
### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md)
|
||||
### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md)
|
||||
### [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md)
|
||||
|
||||
@ -23,9 +23,9 @@ The sections that follow provide more detailed information about the different t
|
||||
|
||||
### Protection before startup
|
||||
|
||||
Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM andSecure Boot. Fortunately, many modern computers feature TPM.
|
||||
Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM and Secure Boot. Fortunately, many modern computers feature TPM.
|
||||
|
||||
**Trusted Platform Module**
|
||||
#### Trusted Platform Module
|
||||
|
||||
Software alone isn’t sufficient to protect a system. After an attacker has compromised software, the software might be unable to detect the compromise. Therefore, a single successful software compromise results in an untrusted system that might never be detected. Hardware, however, is much more difficult to modify.
|
||||
|
||||
@ -33,7 +33,7 @@ A TPM is a microchip designed to provide basic security-related functions, prima
|
||||
By binding the BitLocker encryption key with the TPM and properly configuring the device, it’s nearly impossible for an attacker to gain access to the BitLocker-encrypted data without obtaining an authorized user’s credentials. Therefore, computers with a TPM can provide a high level of protection against attacks that attempt to directly retrieve the BitLocker encryption key.
|
||||
For more info about TPM, see [Trusted Platform Module](trusted-platform-module-overview.md).
|
||||
|
||||
**UEFI and Secure Boot**
|
||||
#### UEFI and Secure Boot
|
||||
|
||||
No operating system can protect a device when the operating system is offline. For that reason, Microsoft worked closely with hardware vendors to require firmware-level protection against boot and rootkits that might compromise an encryption solution’s encryption keys.
|
||||
|
||||
@ -53,7 +53,7 @@ Using the digital signature, UEFI verifies that the bootloader was signed using
|
||||
|
||||
If the bootloader passes these two tests, UEFI knows that the bootloader isn’t a bootkit and starts it. At this point, Trusted Boot takes over, and the Windows bootloader, using the same cryptographic technologies that UEFI used to verify the bootloader, then verifies that the Windows system files haven’t been changed.
|
||||
|
||||
All Windows 8–certified devices must meet several requirements related to UEFI-based Secure Boot:
|
||||
Starting with Windows 8, certified devices must meet several requirements related to UEFI-based Secure Boot:
|
||||
|
||||
- They must have Secure Boot enabled by default.
|
||||
- They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
|
||||
|
||||
@ -231,7 +231,7 @@ The following steps detail how to create a certificate template for use with Bit
|
||||
|
||||
1. Open the Certificates Template snap-in (certtmpl.msc).
|
||||
2. Locate the User template. Right-click the template name and select **Duplicate Template**.
|
||||
3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8respectively. Ensure the **Show resulting changes** dialog box is selected.
|
||||
3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8 respectively. Ensure the **Show resulting changes** dialog box is selected.
|
||||
4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option.
|
||||
5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected.
|
||||
6. Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility we recommend using the **Microsoft Software Key Storage Provider**.)
|
||||
|
||||
@ -42,7 +42,7 @@ BitLocker control panel, and they are appropriate to use for automated deploymen
|
||||
|
||||
## <a href="" id="bkmk-new"></a>New and changed functionality
|
||||
|
||||
To find out what's new in BitLocker for Windows 10, see [What's new in BitLocker?](../whats-new/bitlocker.md)
|
||||
To find out what's new in BitLocker for Windows 10, see the [BitLocker](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10, versions 1507 and 1511."
|
||||
|
||||
## System requirements
|
||||
|
||||
@ -74,6 +74,7 @@ When installing the BitLocker optional component on a server you will also need
|
||||
| [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) | This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. |
|
||||
| [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md)| This topic for the IT professional describes how to use tools to manage BitLocker.|
|
||||
| [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) | This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. |
|
||||
| [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) | This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker. |
|
||||
| [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This topic for IT professionals describes the BCD settings that are used by BitLocker.|
|
||||
| [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This topic for IT professionals describes how to recover BitLocker keys from AD DS. |
|
||||
| [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. |
|
||||
|
||||
@ -15,6 +15,8 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
|
||||
## January 2017
|
||||
|New or changed topic |Description |
|
||||
|---------------------|------------|
|
||||
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |New |
|
||||
|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Updated to include info about USB drives and Azure RMS (Windows Insider Program only) and to add more info about Work Folders and Offline files. |
|
||||
|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New |
|
||||
|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New |
|
||||
|
||||
|
||||
@ -17,20 +17,105 @@ author: brianlic-msft
|
||||
This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks.
|
||||
You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication.
|
||||
|
||||
Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default
|
||||
settings.
|
||||
Tables 1 and 2 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings.
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="25%" />
|
||||
<col width="55%" />
|
||||
</colgroup>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 8.1<br>without TPM</strong></font></p></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 8.1 Certified<br>(with TPM)</strong></font></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Bootkits and<br>Rootkits</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Without TPM, boot integrity checking is not available</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Brute Force<br>Sign-in</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout Group Policy</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout and device lockout Group Policy settings</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">DMA<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#99E4FB"><p>If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Hyberfil.sys<br>Attacks</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Memory<br>Remanence<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Password protect the firmware and ensure Secure Boot is enabled. If an attack is viable, consider pre-boot authentication</p></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
**Figure 2.** How to choose the best countermeasures for Windows 7
|
||||
**Table 1.** How to choose the best countermeasures for Windows 8.1<br><br>
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="25%" />
|
||||
<col width="55%" />
|
||||
</colgroup>
|
||||
<tr>
|
||||
<td></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 10<br>without TPM</strong></font></p></td>
|
||||
<td BGCOLOR="#01BCF3">
|
||||
<p><font color="#FFFFFF"><strong>Windows 10 Certified<br>(with TPM)</strong></font></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Bootkits and<br>Rootkits</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Without TPM, boot integrity checking is not available</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Brute Force<br>Sign-in</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout Group Policy</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default, and can be improved with account lockout and device lockout Group Policy settings</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">DMA<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#99E4FB"><p>If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; certified devices do not expose vulnerable DMA busses.<br>Can be additionally secured by deploying policy to restrict DMA devices:</p>
|
||||
<ul>
|
||||
<li><p><a href="https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#DataProtection_AllowDirectMemoryAccess">DataProtection/AllowDirectMemoryAccess</a></p></li>
|
||||
<li><p><a href="https://support.microsoft.com/en-us/kb/2516445">Block 1394 and Thunderbolt</a></p></li></ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td BGCOLOR="FF8C01">
|
||||
<p><font color="#FFFFFF">Hyberfil.sys<br>Attacks</font></p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Secure by default; hyberfil.sys secured on encrypted volume</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td BGCOLOR="#FF8C01">
|
||||
<p><font color="#FFFFFF">Memory<br>Remanence<br>Attacks</p></font></td>
|
||||
<td BGCOLOR="#FED198"><p>Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication</p></td>
|
||||
<td BGCOLOR="#99E4FB"><p>Password protect the firmware and ensure Secure Boot is enabled.<br>The most effective mitigation, which we advise for high-security devices, is to configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user.</p></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
**Figure 3.** How to choose the best countermeasures for Windows 8
|
||||
|
||||
|
||||
|
||||
**Figure 4.** How to choose the best countermeasures for Windows 8.1
|
||||
**Table 2.** How to choose the best countermeasures for Windows 10
|
||||
|
||||
The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of
|
||||
DMA ports is infrequent in the non-developer space.
|
||||
|
||||
@ -24,7 +24,7 @@ localizationpriority: high
|
||||
|
||||
You need to add an application in your Azure Active Directory (AAD) tenant then authorize the Windows Defender ATP Alerts Export application to communicate with it so that your security information and events management (SIEM) tool can consume alerts from Windows Defender ATP portal.
|
||||
|
||||
1. Login to the [Azure management portal](https://manage.windowsazure.com).
|
||||
1. Login to the [Azure management portal](https://ms.portal.azure.com).
|
||||
|
||||
2. Select **Active Directory**.
|
||||
|
||||
@ -53,14 +53,12 @@ You need to add an application in your Azure Active Directory (AAD) tenant then
|
||||
|
||||
13. Click **Save** and copy the key in a safe place. You'll need this key to authenticate the client application on Azure Active Directory.
|
||||
|
||||
14. Open a web browser and connect to the following URL: <br>
|
||||
```text
|
||||
https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234
|
||||
```
|
||||
An Azure login page appears.
|
||||
> [!NOTE]
|
||||
> - Replace *tenant ID* with your actual tenant ID.
|
||||
> - Keep the client secret as is. This is a dummy value, but the parameter must appear.
|
||||
14. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234`<br>
|
||||
|
||||
An Azure login page appears.
|
||||
> [!NOTE]
|
||||
> - Replace *tenant ID* with your actual tenant ID.
|
||||
> - Keep the *clientSecret* as is. This is a dummy value, but the parameter must appear.
|
||||
|
||||
15. Sign in with the credentials of a user from your tenant.
|
||||
|
||||
@ -80,7 +78,37 @@ An Azure login page appears.
|
||||
|
||||
23. Save the application changes.
|
||||
|
||||
After configuring the application in AAD, you can continue to configure the SIEM tool that you want to use.
|
||||
After configuring the application in AAD, you'll need to obtain a refresh token. You'll need to use the token when you configure the connector for your SIEM tool in the next steps. The token lets the connector access Windows Defender ATP events to be consumed by your SIEM.
|
||||
|
||||
## Obtain a refresh token using an events URL
|
||||
Obtain a refresh token used to retrieve the Windows Defender Advanced Threat Protection events to your SIEM. This section provides information on how you can use an events URL to obtain the required refresh token.
|
||||
>[!NOTE]
|
||||
>For HP ArcSight, you can obtain a refresh token using the restutil tool. For more information, see [Configure HP ArcSight to consume alerts](configure-arcsight-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Before you begin
|
||||
Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
|
||||
|
||||
- OAuth 2 Client ID
|
||||
- OAuth 2 Client secret
|
||||
|
||||
You'll use these values to obtain a refresh token.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Before using the OAuth 2 Client secret described in the next steps, you **must** encode it. Use a URL encoder to transform the OAuth 2 client secret.
|
||||
|
||||
### Obtain a refresh token
|
||||
1. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=<client ID>&tenantId=<tenant ID>&clientSecret=<client secret>`
|
||||
|
||||
>[!NOTE]
|
||||
>- Replace the *client ID* value with the one you got from your AAD application.
|
||||
>- Replace *tenant ID* with your actual tenant ID.
|
||||
>- Replace *client secret* with your encoded client secret. The client secret **must** be pasted encoded.
|
||||
|
||||
2. Click **Accept**. When you authenticate, a web page opens with your refresh token.
|
||||
|
||||
3. Save the refresh token which you'll find it the `<RefreshToken></RefreshToken>`value. You'll need this value when configuring your SIEM tool.
|
||||
|
||||
After configuring your AAD application and generating a refresh token, you can proceed to configure your SIEM tool.
|
||||
|
||||
## Related topics
|
||||
- [Configure security information and events management (SIEM) tools to consume alerts](configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -25,26 +25,36 @@ You'll need to configure HP ArcSight so that it can consume Windows Defender ATP
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting **View Endpoint** on the application configuration page:
|
||||
- OAuth 2 Token refresh URL
|
||||
- OAuth 2 Client ID
|
||||
- OAuth 2 Client secret
|
||||
- Create your OAUth 2 Client properties file or get it from your Windows Defender ATP contact. For more information, see the ArcSight FlexConnector Developer's guide.
|
||||
- Download the [WDATP-connector.properties](http://download.microsoft.com/download/3/9/C/39C703C2-487C-4C3E-AFD8-14C2253C2F12/WDATP-connector.properties) file and update the following values:
|
||||
|
||||
> [!NOTE]
|
||||
> **For the authorization URL**: Append the following to the value you got from the AAD app: ```?resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com``` <br>
|
||||
> **For the redirect_uri value use**: ```https://localhost:44300/wdatpconnector```
|
||||
>
|
||||
- Get the *wdatp-connector.properties* file from your Windows Defender ATP contact. This file is used to parse the information from Windows Defender ATP to HP ArcSight consumable format.
|
||||
- Install the HP ArcSight REST FlexConnector package on a server that has access to the Internet.
|
||||
- Contact the Windows Defender ATP team to get your refresh token or follow the steps in the section "Run restutil to Obtain a Refresh Token for Connector Appliance/ArcSight Management Center" in the ArcSight FlexConnector Developer's guide.
|
||||
- **client_ID**: OAuth 2 Client ID
|
||||
- **client_secret**: OAuth 2 Client secret
|
||||
- **auth_url**: ```https://login.microsoftonline.com/<tenantID>?resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com ```
|
||||
|
||||
>[!NOTE]
|
||||
>Replace *tenantID* with your tenant ID.
|
||||
|
||||
- **token_url**: `https://login.microsoftonline.com/<tenantID>/oauth2/token`
|
||||
|
||||
>[!NOTE]
|
||||
>Replace the *tenantID* value with your tenant ID.
|
||||
|
||||
- **redirect_uri**: ```https://localhost:44300/wdatpconnector```
|
||||
- **scope**: Leave the value blank
|
||||
|
||||
- Download the [WDATP-connector.jsonparser.properties](http://download.microsoft.com/download/0/8/A/08A4957D-0923-4353-B25F-395EAE363E8C/WDATP-connector.jsonparser.properties) file. This file is used to parse the information from Windows Defender ATP to HP ArcSight consumable format.
|
||||
- Install the HP ArcSight REST FlexConnector package. You can find this in the HPE Software center. Install the package on a server that has access to the Internet.
|
||||
|
||||
## Configure HP ArcSight
|
||||
The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin).
|
||||
The following steps assume that you have completed all the required steps in [Before you begin](#before-you-begin). For more information, see the ArcSight FlexConnector Developer's guide.
|
||||
|
||||
1. Copy the *wdatp-connector.jsonparser.properties* file into the `<root>\current\user\agent\flexagent` folder of the connector installation folder.
|
||||
1. Save the [WDATP-connector.jsonparser.properties file](http://download.microsoft.com/download/0/8/A/08A4957D-0923-4353-B25F-395EAE363E8C/WDATP-connector.jsonparser.properties) file into the connector installation folder. The
|
||||
|
||||
2. Save the *wdatp-connector.properties* file into a folder of your choosing.
|
||||
2. Save the [WDATP-connector.properties](http://download.microsoft.com/download/3/9/C/39C703C2-487C-4C3E-AFD8-14C2253C2F12/WDATP-connector.properties) file into the `<root>\current\user\agent\flexagent` folder of the connector installation folder.
|
||||
|
||||
3. Open an elevated command-line:
|
||||
|
||||
@ -69,7 +79,8 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
<td>Type in the name of the client property file. It must match the client property file.</td>
|
||||
</tr>
|
||||
<td>Events URL</td>
|
||||
<td>`https://DataAccess-PRD.trafficmanager.net:444/api/alerts`</td>
|
||||
<td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**: https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME
|
||||
</br>**For US:** https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME</td>
|
||||
<tr>
|
||||
<td>Authentication Type</td>
|
||||
<td>OAuth 2</td>
|
||||
@ -78,7 +89,8 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
<td>Select *wdatp-connector.properties*.</td>
|
||||
<tr>
|
||||
<td>Refresh Token</td>
|
||||
<td>Paste the refresh token that your Windows Defender ATP contact provided, or run the `restutil` tool to get it.</td>
|
||||
<td>You can use the Windows Defender ATP events URL or the restutil tool to get obtain a refresh token. <br> For more information on getting your refresh token using the events URL, see [Obtain a refresh token](configure-aad-windows-defender-advanced-threat-protection.md#obtain-a-refresh-token). </br> </br>**To get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to `C:\ArcSightSmartConnectors\<descriptive_name>\current\bin`. </br></br> b. Type: `arcsight restutil token -config C:\ArcSightSmartConnectors_Prod\WDATP\WDATP-connector.properties`. A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d. A refresh token is shown in the command prompt. </br></br> e. Paste the value in the form.
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -37,14 +37,14 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
|
||||
|
||||
b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*.
|
||||
|
||||
3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune).
|
||||
|
||||
a. Select **Policy** > **Configuration Policies** > **Add**.
|
||||
|
||||
|
||||
|
||||
b. Under **Windows**, select **Custom Configuration (Windows 10 Desktop and Mobile and later)** > **Create and Deploy a Custom Policy** > **Create Policy**.
|
||||
|
||||
@ -56,7 +56,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
|
||||
|
||||
|
||||
e. Type the following values then select **OK**:
|
||||
|
||||
|
||||
|
||||
|
||||
- **Setting name**: Type a name for the setting.
|
||||
|
||||
@ -25,9 +25,9 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk
|
||||
- Contact the Windows Defender ATP team to get your refresh token
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting the **View Endpoint** on the application configuration page:
|
||||
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk.
|
||||
- Obtain your refresh token. For more information, see [Obtain a refresh token](configure-aad-windows-defender-advanced-threat-protection.md#obtain-a-refresh-token).
|
||||
- Get the following information from your Azure Active Directory (AAD) application by selecting **View Endpoint** on the application configuration page:
|
||||
- OAuth 2 Token refresh URL
|
||||
- OAuth 2 Client ID
|
||||
- OAuth 2 Client secret
|
||||
@ -56,7 +56,8 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Endpoint URL</td>
|
||||
<td> https://<i></i>DataAccess-PRD.trafficmanager.net:444/api/alerts</td>
|
||||
<td>Depending on the location of your datacenter, select either the EU or the US URL: </br></br> **For EU**: https://<i></i>wdatp-alertexporter-eu.securitycenter.windows.com/api/alerts </br>**For US:** https://<i></i>wdatp-alertexporter-us.securitycenter.windows.com/api/alerts
|
||||
|
||||
</tr>
|
||||
<tr>
|
||||
<td>HTTP Method</td>
|
||||
|
||||
@ -69,7 +69,7 @@ The following tables provide more information about the hardware, firmware, and
|
||||
|
||||
> [!NOTE]
|
||||
> For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow.<br>
|
||||
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx).<br>
|
||||
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).<br>
|
||||
> Starting in Widows 10, 1607, TPM 2.0 is required.
|
||||
|
||||
### Baseline protection recommendations
|
||||
@ -81,7 +81,7 @@ The following tables provide more information about the hardware, firmware, and
|
||||
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br><br>**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)<br><br>**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).<br><br>**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.</p></blockquote><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide.
|
||||
@ -933,6 +933,7 @@ write-host $tmp -Foreground Red
|
||||
- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel)
|
||||
- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert)
|
||||
- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode)
|
||||
- [Protecting network passwords with Windows 10 Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard)
|
||||
- [Enabling Strict KDC Validation in Windows Kerberos](http://www.microsoft.com/download/details.aspx?id=6382)
|
||||
- [What's New in Kerberos Authentication for Windows Server 2012](http://technet.microsoft.com/library/hh831747.aspx)
|
||||
- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx)
|
||||
|
||||
@ -26,13 +26,14 @@ The credentials are put in Credential Manager as a "`*Session`" credential.
|
||||
A "`*Session`" credential implies that it is valid for the current user session.
|
||||
The credentials are also cleaned up when the WiFi or VPN connection is disconnected.
|
||||
|
||||
When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so WinInit.exe can release the credentials that it gets from the Credential Manager to the SSP that is requesting it.
|
||||
When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it.
|
||||
For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations).
|
||||
|
||||
WinInit.exe will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability.
|
||||
The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability.
|
||||
If the app is not UWP, it does not matter.
|
||||
But if it is a UWP app, it will look at the device capability for Enterprise Authentication.
|
||||
If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
This behavior helps prevent credentials from being misused by untrusted third parties.
|
||||
|
||||
## Intranet zone
|
||||
|
||||
@ -68,9 +69,26 @@ The username should also include a domain that can be reached over the connectio
|
||||
|
||||
If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication.
|
||||
|
||||
| TEmplate element | Configuration |
|
||||
| Template element | Configuration |
|
||||
|------------------|---------------|
|
||||
| SubjectName | The user’s distinguished name (DN) where the domain components of the distinguished name reflects the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller. </br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located. |
|
||||
| SubjectAlternativeName | The user’s fully qualified UPN where a domain name component of the user’s UPN matches the organizations internal domain’s DNS namespace.</br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. This certificate must be issued using the PassportForWork CSP. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for PassportForWork)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for Windows Hello for Business)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |
|
||||
|
||||
## NDES server configuration
|
||||
|
||||
The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used.
|
||||
For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/en-us/intune/deploy-use/Configure-certificate-infrastructure-for-scep).
|
||||
|
||||
## Active Directory requirements
|
||||
|
||||
You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well.
|
||||
|
||||
The domain controllers will need to have appropriate KDC certificates for the client to trust them as domain controllers, and since phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store.
|
||||
|
||||
The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication.
|
||||
This is because Windows 10 Mobile requires strict KDC validation to be enabled.
|
||||
This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server.
|
||||
For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382).
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 49 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 116 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 16 KiB |
@ -17,19 +17,19 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure.
|
||||
| Topic | Description |
|
||||
| - | - |
|
||||
| [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. |
|
||||
| [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. |
|
||||
| [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. |
|
||||
| [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. |
|
||||
| [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. |
|
||||
| [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. |
|
||||
| [Device Guard deployment guide](device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. |
|
||||
| [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard helps prevent these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. |
|
||||
| [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) | Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that's requesting the connection. |
|
||||
| [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. |
|
||||
| [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps to protect against this potential data leakage without otherwise interfering with the employee experience. |
|
||||
| [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. |
|
||||
|[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. |
|
||||
| [VPN technical guide](vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. |
|
||||
| [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. |
|
||||
| [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. |
|
||||
| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. |
|
||||
| [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. For example, learn about AppLocker, BitLocker, and Security auditing. |
|
||||
| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Review technology overviews that help you understand Windows 10 security technologies in the context of the enterprise. |
|
||||
| [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). |
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -75,5 +75,5 @@ Another Windows 10 feature that employs VBS is [Credential Guard](credential-gua
|
||||
|
||||
Credential Guard is targeted at resisting pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats.
|
||||
|
||||
In addition to the client-side enabling of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. For more information, see the [Additional mitigations](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard#additional-mitigations) section in “Protect derived domain credentials with Credential Guard.”
|
||||
|
||||
|
||||
|
||||
@ -25,8 +25,8 @@ This table provides info about the most common problems you might encounter whil
|
||||
<th>Workaround</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise data on USB drives is tied to the device it was protected on.</td>
|
||||
<td>Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.</td>
|
||||
<td>Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration.</td>
|
||||
<td><strong>If you’re using Azure RMS:</strong> Authenticated users can open enterprise data on USB drives, on computers running the latest build from the Windows Insider Program.<p><strong>If you’re not using Azure RMS:</strong> Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.</td>
|
||||
<td>Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.<p>We strongly recommend educating employees about how to limit or eliminate the need for this decryption.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -67,7 +67,7 @@ This table provides info about the most common problems you might encounter whil
|
||||
<tr>
|
||||
<td>Redirected folders with Client Side Caching are not compatible with WIP.</td>
|
||||
<td>Apps might encounter access errors while attempting to read a cached, offline file.</td>
|
||||
<td>Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.</td>
|
||||
<td>Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.<p><strong>Note</strong><br>For more info about Work Folders and Offline Files, see the blog, [Work Folders and Offline Files support for Windows Information Protection](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and WIP, see the support article, [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/kb/3187045).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.</td>
|
||||
|
||||
@ -93,7 +93,7 @@ When identity providers such as Active Directory or Azure AD enroll a certificat
|
||||
|
||||
[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy
|
||||
|
||||
[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533)
|
||||
[What's new in Active Directory Domain Services for Windows Server 2016](https://go.microsoft.com/fwlink/p/?LinkId=708533)
|
||||
|
||||
[Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024)
|
||||
|
||||
|
||||
@ -24,6 +24,7 @@ Microsoft Intune and System Center Configuration Manager helps you create and de
|
||||
|[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Intune helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|
||||
|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|
||||
|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. |
|
||||
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -33,8 +33,7 @@ Windows PowerShell or the manage-bde command line interface is the preferred met
|
||||
|
||||
>**Note:** Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption.
|
||||
|
||||
For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde –WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This occurs because Full
|
||||
Encryption requires an end marker for the volume and dynamically expanding VHDs do not have a static end of volume marker.
|
||||
For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space.
|
||||
|
||||
### Active Directory-based protector
|
||||
|
||||
@ -57,28 +56,22 @@ BitLocker encryption is available for disks before or after addition to a cluste
|
||||
|
||||
1. Install the BitLocker Drive Encryption feature if it is not already installed.
|
||||
2. Ensure the disk is formatted NTFS and has a drive letter assigned to it.
|
||||
3. Enable BitLocker on the volume using your choice of protector. A password protector is used in the Windows PowerShell script example below.
|
||||
|
||||
``` syntax
|
||||
Enable-BitLocker E: -PasswordProtector -Password $pw
|
||||
```
|
||||
|
||||
4. Identify the name of the cluster with Windows PowerShell.
|
||||
3. Identify the name of the cluster with Windows PowerShell.
|
||||
|
||||
``` syntax
|
||||
Get-Cluster
|
||||
|
||||
```
|
||||
5. Add an **ADAccountOrGroup**protector to the volume using the cluster name using a command such as:
|
||||
4. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as:
|
||||
|
||||
``` syntax
|
||||
Add-BitLockerProtector E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$
|
||||
Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$
|
||||
```
|
||||
|
||||
>**Warning:** You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster.
|
||||
>**Warning:** You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster.
|
||||
|
||||
6. Repeat steps 1-6 for each disk in the cluster.
|
||||
7. Add the volume(s) to the cluster.
|
||||
5. Repeat the preceding steps for each disk in the cluster.
|
||||
6. Add the volume(s) to the cluster.
|
||||
|
||||
### Turning on BitLocker for a clustered disk using Windows PowerShell
|
||||
|
||||
@ -97,28 +90,26 @@ When the cluster service owns a disk resource already, it needs to be set into m
|
||||
Get-ClusterResource "Cluster Disk 1" | Suspend-ClusterResource
|
||||
```
|
||||
|
||||
4. Enable BitLocker on the volume using your choice of protector. A password protector is used in the example below.
|
||||
|
||||
``` syntax
|
||||
Enable-BitLocker E: -PasswordProtector -Password $pw
|
||||
```
|
||||
|
||||
5. Identify the name of the cluster with Windows PowerShell
|
||||
4. Identify the name of the cluster with Windows PowerShell.
|
||||
|
||||
``` syntax
|
||||
Get-Cluster
|
||||
```
|
||||
|
||||
6. Add an **ADAccountOrGroup** protector with the Cluster Name Object (CNO) to the volume using a command such as:
|
||||
5. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as:
|
||||
|
||||
``` syntax
|
||||
Add-BitLockerProtector E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$
|
||||
|
||||
Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$
|
||||
```
|
||||
>**Warning:** You must add an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to failover properly in a traditional failover cluster.
|
||||
>**Warning:** You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster.
|
||||
|
||||
7. Repeat steps 1-6 for each disk in the cluster.
|
||||
8. Add the volume(s) to the cluster
|
||||
6. Use **Resume-ClusterResource** to take the physical disk resource back out of maintenance mode:
|
||||
|
||||
``` syntax
|
||||
Get-ClusterResource "Cluster Disk 1" | Resume-ClusterResource
|
||||
```
|
||||
|
||||
7. Repeat the preceding steps for each disk in the cluster.
|
||||
|
||||
### Adding BitLocker encrypted volumes to a cluster using manage-bde
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc
|
||||
|
||||
|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting<br>(Replace "contoso" with your domain name(s) |
|
||||
|-----------------------------|---------------------------------------------------------------------|
|
||||
|Office 365 for Business |<ul><li>contoso.sharepoint.com</li><li>contoso-my.sharepoint.com</li><li>contoso-files.sharepoint.com</li><li>tasks.office.com</li><li>lists.office.com</li><li>collabdb.com</li><li>www.collabdb.com</li><li>protection.office.com</li><li>meet.lync.com</li><li>teams.microsoft.com</li></ul> |
|
||||
|Office 365 for Business |<ul><li>contoso.sharepoint.com</li><li>contoso-my.sharepoint.com</li><li>contoso-files.sharepoint.com</li><li>tasks.office.com</li><li>protection.office.com</li><li>meet.lync.com</li><li>teams.microsoft.com</li></ul> |
|
||||
|Yammer |<ul><li>www.yammer.com</li><li>yammer.com</li><li>persona.yammer.com</li></ul> |
|
||||
|Microsoft Dynamics |contoso.crm.dynamics.com |
|
||||
|Visual Studio Online |contoso.visualstudio.com |
|
||||
|
||||
@ -26,7 +26,7 @@ This article describes the following:
|
||||
|
||||
The information in this article is intended for IT professionals, and provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
|
||||
|
||||
>**Note** If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx).
|
||||
>**Note** If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
|
||||
|
||||
## Hardware, firmware, and software requirements for Device Guard
|
||||
|
||||
@ -54,7 +54,7 @@ The following tables provide more information about the hardware, firmware, and
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)<br><br>**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).<br><br>**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: **HVCI compatible drivers** | **Requirements**: See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://msdn.microsoft.com/library/windows/hardware/mt589732(v=vs.85).aspx).<br><br>**Security benefits**: [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.</p></blockquote><br>**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. |
|
||||
|
||||
> **Important** The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Device Guard can provide.
|
||||
|
||||
|
||||
@ -11,21 +11,23 @@ author: brianlic-msft
|
||||
|
||||
# Security technologies
|
||||
|
||||
Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile.
|
||||
As an IT professional, you can use these topics to learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile.
|
||||
|
||||
| Topic | Description |
|
||||
| Section | Description |
|
||||
|-|-|
|
||||
| [Access control](access-control.md) | Describes access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. Key concepts that make up access control are permissions, ownership of objects, inheritance of permissions, user rights, and object auditing. |
|
||||
| [AppLocker](applocker-overview.md)| This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.|
|
||||
| [BitLocker](bitlocker-overview.md)| This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features.|
|
||||
| [Encrypted Hard Drive](encrypted-hard-drive.md) | Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.|
|
||||
| [Security auditing](security-auditing-overview.md)| Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network.|
|
||||
| [Security policy settings](security-policy-settings.md)| This reference topic describes the common scenarios, architecture, and processes for security settings.|
|
||||
| [Trusted Platform Module](trusted-platform-module-overview.md)| This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. The topic provides links to other resources about the TPM.|
|
||||
| [User Account Control](user-account-control-overview.md)| User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.|
|
||||
| [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)| Windows Defender Advanced Threat Protection (Windows Defender ATP) is an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.|
|
||||
| [Windows Defender in Windows 10](windows-defender-in-windows-10.md)| This topic provides an overview of Windows Defender, including a list of system requirements and new features.|
|
||||
| [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) | Windows Firewall with Advanced Security is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Firewall with Advanced Security blocks unauthorized network traffic flowing into or out of the local device. |
|
||||
| [AppLocker](applocker-overview.md)| Describes AppLocker, and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.|
|
||||
| [BitLocker](bitlocker-overview.md)| Provides information about BitLocker, which is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. |
|
||||
| [Encrypted Hard Drive](encrypted-hard-drive.md) | Provides information about Encrypted Hard Drive, which uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.|
|
||||
| [Security auditing](security-auditing-overview.md)| Describes how the IT professional can use the security auditing features in Windows, and how organizations can benefit from using these technologies, to enhance the security and manageability of networks.|
|
||||
| [Security policy settings](security-policy-settings.md)| Provides a collection of reference topics that describe the common scenarios, architecture, and processes for security settings.|
|
||||
| [Smart Cards](smart-card-windows-smart-card-technical-reference.md) | Provides a collection of references topics about smart cards, which are tamper-resistant portable storage devices that can enhance the security of tasks such as authenticating clients, signing code, securing e-mail, and signing in with a Windows domain account. |
|
||||
| [Trusted Platform Module](trusted-platform-module-top-node.md)| Provides links to information about the Trusted Platform Module (TPM), which is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. |
|
||||
| [User Account Control](user-account-control-overview.md)| Provides information about User Account Control (UAC), which helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. UAC can help block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.|
|
||||
| [Virtual Smart Cards](virtual-smart-card-overview.md) | Provides information about deploying and managing virtual smart cards, which are functionally similar to physical smart cards and appear in Windows as smart cards that are always-inserted. Virtual smart cards use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. |
|
||||
| [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)| Provides information about Windows Defender Advanced Threat Protection (Windows Defender ATP), an out-of-the-box Windows enterprise security service that enables enterprise cybersecurity teams to detect and respond to advanced threats on their networks.|
|
||||
| [Windows Defender in Windows 10](windows-defender-in-windows-10.md)| Provides information about Windows Defender, a built-in antimalware solution that helps provide security and antimalware management for desktops, portable computers, and servers. Includes a list of system requirements and new features.|
|
||||
| [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md) | Provides information about Windows Firewall with Advanced Security, which is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Firewall with Advanced Security blocks unauthorized network traffic flowing into or out of the local device. |
|
||||
|
||||
|
||||
|
||||
|
||||
@ -2222,7 +2222,7 @@ Description of the error. </dt>
|
||||
<td colspan="2">
|
||||
<p>The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tr><tr><th rowspan="3">Event ID: 2050</th><td><p>Symbolic name:</p></td><td colspan="2"><p><b>MALWAREPROTECTION_SAMPLESUBMISSION_UPLOADED</b></p></td></tr><tr><td><p>Message:</p></td><td colspan="2"><p><b>The antimalware engine has uploaded a file for further analysis.<br />Filename <uploaded filename><br />Sha256: <file SHA></b></p></td></tr><tr><td><p>Description:</p></td><td colspan="2"><p>A file was uploaded to the Windows Defender Antimalware cloud for further analysis or processing.</p></td></tr>
|
||||
<tr>
|
||||
<th rowspan="4">Event ID: 3002</th>
|
||||
<td>
|
||||
|
||||
@ -93,3 +93,6 @@ Topic | Description
|
||||
[Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP.
|
||||
[Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)| Review events and errors associated with event IDs to determine if further troubleshooting steps are required.
|
||||
[Windows Defender compatibility](defender-compatibility-windows-defender-advanced-threat-protection.md) | Learn about how Windows Defender works in conjunction with Windows Defender ATP.
|
||||
|
||||
## Related topic
|
||||
[Windows Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats)
|
||||
|
||||
@ -18,7 +18,7 @@ author: jasesso
|
||||
Windows Defender in Windows 10 is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers.
|
||||
This topic provides an overview of Windows Defender, including a list of system requirements and new features.
|
||||
|
||||
For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server Technical Preview](https://technet.microsoft.com/library/dn765478.aspx).
|
||||
For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server](https://technet.microsoft.com/windows-server-docs/security/windows-defender/windows-defender-overview-windows-server).
|
||||
|
||||
Take advantage of Windows Defender by configuring settings and definitions using the following tools:
|
||||
- Microsoft Active Directory *Group Policy* for settings
|
||||
|
||||
55
windows/keep-secure/wip-app-enterprise-context.md
Normal file
55
windows/keep-secure/wip-app-enterprise-context.md
Normal file
@ -0,0 +1,55 @@
|
||||
---
|
||||
title: Determine the Enterprise Context of an app running in Windows Information Protection (WIP) (Windows 10)
|
||||
description: Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP).
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Task Manager, app context, enterprise context
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Determine the Enterprise Context of an app running in Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607
|
||||
- Windows 10 Mobile
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare).
|
||||
|
||||
Use Task Manager to check the context of your apps while running in Windows Information Protection (WIP) to make sure that your organization's policies are applied and running correctly.
|
||||
|
||||
## Viewing the Enterprise Context column in Task Manager
|
||||
You need to add the Enterprise Context column to the **Details** tab of the Task Manager.
|
||||
|
||||
1. Make sure that you have an active WIP policy deployed and turned on in your organization.
|
||||
|
||||
2. Open the Task Manager (taskmgr.exe), click the **Details** tab, right-click in the column heading area, and click **Select columns**.
|
||||
|
||||
The **Select columns** box appears.
|
||||
|
||||
|
||||
|
||||
3. Scroll down and check the **Enterprise Context** option, and then click **OK** to close the box.
|
||||
|
||||
The **Enterprise Context** column should now be available in Task Manager.
|
||||
|
||||
|
||||
|
||||
## Review the Enterprise Context
|
||||
The **Enterprise Context** column shows you what each app can do with your enterprise data:
|
||||
|
||||
- **Domain.** Shows the employee's work domain (such as, corp.contoso.com). This app is considered work-related and can freely touch and open work data and resources.
|
||||
|
||||
- **Personal.** Shows the text, *Personal*. This app is considered non-work-related and can't touch any work data or resources.
|
||||
|
||||
- **Exempt.** Shows the text, *Exempt*. WIP policies don't apply to these apps (such as, system components).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Enlightened apps can change between Work and Personal, depending on the data being touched. For example, Microsoft Word 2016 shows as **Personal** when an employee opens a personal letter, but changes to **Work** when that same employee opens the company financials.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user