diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index de1879bcba..6281fa157d 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -9,7 +9,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 10/31/2019 +ms.date: 11/20/2019 ms.reviewer: scottmca manager: dansimp ms.localizationpriority: medium @@ -21,8 +21,7 @@ ms.audience: itpro Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal. >[!NOTE] ->SEMM is only available on devices with Surface UEFI firmware. - +>SEMM is only available on devices with Surface UEFI firmware. This includes most Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3 commercial SKUs with an Intel processor. SEMM is not supported on the 15" Surface Laptop 3 SKU with AMD processor (only available as a retail SKU). When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM. @@ -229,8 +228,8 @@ create a reset package using PowerShell to reset SEMM. ## Version History -### Version 2.59.139 -* Support to Surface Pro 7 and Surface Laptop 3 +### Version 2.59. +* Support to Surface Pro 7, Surface Pro X, and Surface Laptop 3 13.5" and 15" models with Intel processor. Note: Surface Laptop 3 15" AMD processor is not supported. - Support to Wake on Power feature ### Version 2.54.139.0 diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md index 2f8061c0b4..3e867c8f49 100644 --- a/devices/surface/surface-pro-arm-app-management.md +++ b/devices/surface/surface-pro-arm-app-management.md @@ -8,7 +8,7 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 10/03/2019 +ms.date: 11/20/2019 ms.reviewer: jessko manager: dansimp ms.audience: itpro @@ -36,7 +36,7 @@ Organizations already using modern management, security, and productivity soluti ## Image-based deployment considerations -Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager (SCCM) operating system deployment currently do not support Surface Pro X. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud. +Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager (formerly System Center Configuration Manager) currently do not support Surface Pro X for operating system deployment. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud. ## Managing Surface Pro X devices @@ -48,7 +48,7 @@ For more information about setting up Intune, refer to the [Intune documentation ### Co-management -Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with SCCM, which will install the 32-bit x86 ConfigMgr client. +Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with Endpoint Configuration Manager, which will install the 32-bit x86 ConfigMgr client. ### Third party MDM solutions @@ -69,6 +69,12 @@ Outside of personal devices that rely on Windows Update, servicing devices in mo > [!NOTE] > Surface Pro X supports Windows 10, version 1903 and later. +### Windows Server Update Services +Windows Server Update Services (WSUS) does not support the ability to deliver drivers and firmware to Surface Pro X. + +For more information, refer to the [Microsoft Endpoint Configuration Manager documentation](https://docs.microsoft.com/configmgr/sum/get-started/configure-classifications-and-products). + + ## Running apps on Surface Pro X Most apps run on ARM-based Windows 10 PCs with limited exclusions. @@ -120,7 +126,7 @@ The following tables show the availability of selected key features on Surface P | Support for Network Boot (PXE) | Yes | Yes | | | Windows Configuration Designer | Yes | No | Not recommended for Surface Pro X. | | WinPE | Yes | Yes | Not recommended for Surface Pro X. Microsoft does not provide the necessary .ISO and drivers to support WinPE with Surface Pro X. | -| SCCM: Operating System Deployment (OSD) | Yes | No | Not supported on Surface Pro X. | +| Endpoint Configuration Manager: Operating System Deployment (OSD) | Yes | No | Not supported on Surface Pro X. | | MDT | Yes | No | Not supported on Surface Pro X. | @@ -129,7 +135,7 @@ The following tables show the availability of selected key features on Surface P | Intune | Yes | Yes | Manage LTE with eSIM profiles. | | Windows Autopilot | Yes | Yes | | | Azure AD (co-management) | Yes | Yes | Ability to join Surface Pro X to Azure AD or Active Directory (Hybrid Azure AD Join). | -| SCCM | Yes | Yes | | +| Endpoint Configuration Manager | Yes | Yes | | | Power on When AC Restore | Yes | Yes | | | Surface Diagnostic Toolkit (SDT) for Business | Yes | Yes | | | Surface Dock Firmware Update | Yes | Yes | | @@ -150,9 +156,9 @@ The following tables show the availability of selected key features on Surface P | Surface Data Eraser (SDE) | Yes | Yes | ## FAQ -### Can I deploy Surface Pro X with MDT or SCCM? +### Can I deploy Surface Pro X with MDT or Endpoint Configuration Manager? -The Microsoft Deployment Toolkit and System Center Configuration Manager operating system deployment currently do not support Surface Pro X. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud. +The Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager currently do not support Surface Pro X for operating system deployment.Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud. ### How can I deploy Surface Pro X? @@ -164,4 +170,4 @@ Yes. ### Is Intune required to manage Surface Pro X? -Intune is recommended but not required. Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with SCCM, which will install the 32-bit x86 ConfigMgr client. +Intune is recommended but not required. Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with Endpoint Configuration Manager, which will install the 32-bit x86 ConfigMgr client. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md index dc8f75b9f2..963402fe1d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md @@ -1,6 +1,6 @@ --- title: Troubleshoot problems with attack surface reduction rules -description: Check pre-requisites, use audit mode, add exclusions, or collect diagnostic data to help troubleshoot issues +description: Check prerequisites, use audit mode, add exclusions, or collect diagnostic data to help troubleshoot issues keywords: troubleshoot, error, fix, windows defender eg, asr, rules, hips, troubleshoot, audit, exclusion, false positive, broken, blocking search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -10,11 +10,12 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb ms.date: 03/27/2019 ms.reviewer: manager: dansimp +ms.custom: asr --- # Troubleshoot attack surface reduction rules @@ -23,48 +24,56 @@ manager: dansimp * [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When you use [attack surface reduction rules](attack-surface-reduction.md) you may encounter issues, such as: +When you use [attack surface reduction rules](attack-surface-reduction.md) you may run into issues, such as: -* A rule blocks a file, process, or performs some other action that it should not (false positive) -* A rule does not work as described, or does not block a file or process that it should (false negative) +- A rule blocks a file, process, or performs some other action that it should not (false positive) + +- A rule does not work as described, or does not block a file or process that it should (false negative) There are four steps to troubleshooting these problems: -1. Confirm prerequisites -2. Use audit mode to test the rule -3. Add exclusions for the specified rule (for false positives) -4. Submit support logs +1. [Confirm prerequisites](#confirm-prerequisites) + +2. [Use audit mode to test the rule](#use-audit-mode-to-test-the-rule) + +3. [Add exclusions for the specified rule](#add-exclusions-for-a-false-positive) (for false positives) + +4. [Submit support logs](#collect-diagnostic-data-for-file-submissions) ## Confirm prerequisites Attack surface reduction rules will only work on devices with the following conditions: -> [!div class="checklist"] -> * Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update). -> * Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). -> * [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled. -> * Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). +- Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update). -If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode. +- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). + +- [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled. + +- Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). + +If these prerequisites have all been met, proceed to the next step to test the rule in audit mode. ## Use audit mode to test the rule -You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only. +You can visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only. Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with. 1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run. -2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed). -3. [Review the attack surface reductio rule event logs](attack-surface-reduction.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**. -> ->If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled. -> ->Audit mode may have been enabled for testing another feature, or by an automated PowerShell script, and may not have been disabled after the tests were completed. +2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed). + +3. [Review the attack surface reduction rule event logs](attack-surface-reduction.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**. + +If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled. + +Audit mode may have been enabled for testing another feature, or by an automated PowerShell script, and may not have been disabled after the tests were completed. If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on pre-configured scenarios, but the rule is not working as expected, proceed to either of the following sections based on your situation: 1. If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive). + 2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions). ## Add exclusions for a false positive @@ -79,7 +88,7 @@ To add an exclusion, see [Customize Attack surface reduction](customize-attack-s ## Report a false positive or false negative -Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../microsoft-defender-atp/alerts-queue.md). +Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to report a false negative or false positive for network protection. With a Windows E5 subscription, you can also [provide a link to any associated alert](../microsoft-defender-atp/alerts-queue.md). ## Collect diagnostic data for file submissions @@ -97,10 +106,12 @@ When you report a problem with attack surface reduction rules, you are asked to mpcmdrun -getfiles ``` -3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. +3. By default, they are saved to `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. Attach the file to the submission form. -## Related topics +## Related articles -* [Attack surface reduction rules](attack-surface-reduction.md) -* [Enable attack surface reduction rules](enable-attack-surface-reduction.md) -* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) +- [Attack surface reduction rules](attack-surface-reduction.md) + +- [Enable attack surface reduction rules](enable-attack-surface-reduction.md) + +- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index af397987a0..8589345cbe 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -1,6 +1,6 @@ --- title: Troubleshoot problems with Network protection -description: Check pre-requisites, use audit mode, add exclusions, or collect diagnostic data to help troubleshoot issues +description: Check prerequisites, use audit mode, add exclusions, or collect diagnostic data to help troubleshoot issues keywords: troubleshoot, error, fix, windows defender eg, asr, rules, hips, troubleshoot, audit, exclusion, false positive, broken, blocking search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -61,12 +61,12 @@ You can enable network protection in audit mode and then visit a website that we 1. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block). 1. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**. - > - >If network protection is not blocking a connection that you are expecting it should block, enable the feature. + + If network protection is not blocking a connection that you are expecting it should block, enable the feature. -```PowerShell -Set-MpPreference -EnableNetworkProtection Enabled -``` + ```PowerShell + Set-MpPreference -EnableNetworkProtection Enabled + ``` ## Report a false positive or false negative diff --git a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md index 3cb7596969..c4c23a9ddd 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md +++ b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -24,35 +25,35 @@ manager: dansimp This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in. -Before attempting this process, ensure you have read [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md), met all require pre-requisites, and taken any other suggested troubleshooting steps. +Before attempting this process, ensure you have read [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps. -1. On at least two endpoints that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by following this process: +On at least two endpoints that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by following this process: - 1. Open an administrator-level version of the command prompt: +1. Open an administrator-level version of the command prompt as follows: - 1. Open the **Start** menu. + a. Open the **Start** menu. + + b. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. + + c. Enter administrator credentials or approve the prompt. - 2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. +2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example: + + ```Dos + cd c:\program files\windows\defender + ``` + +3. Enter the following command and press **Enter** - 3. Enter administrator credentials or approve the prompt. - - 2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example: - - ```Dos - cd c:\program files\windows\defender - ``` + ```Dos + mpcmdrun -getfiles + ``` - 3. Enter the following command and press **Enter** - - ```Dos - mpcmdrun -getfiles - ``` - - 4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. +4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. -2. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. +5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. -3. Send an email using the Update Compliance support email template, and fill out the template with the following information: +6. Send an email using the Update Compliance support email template, and fill out the template with the following information: ``` I am encountering the following issue when using Windows Defender Antivirus in Update Compliance: @@ -64,7 +65,7 @@ Before attempting this process, ensure you have read [Troubleshoot Windows Defen Please contact me at: ``` -## Related topics +## See also - [Troubleshoot Windows Defender Windows Defender Antivirus reporting](troubleshoot-reporting.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index 6832c65573..b5d9f68991 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Use the command line to manage Windows Defender Antivirus -description: Run Windows Defender Antivirus scans and configure next gen protection with a dedicated command-line utility. +description: Run Windows Defender Antivirus scans and configure next-generation protection with a dedicated command-line utility. keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.reviewer: manager: dansimp --- diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md index 4d41c1529f..7bee1e3696 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Manage Windows Defender in your business -description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the comman line to manage Windows Defender AV +description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Windows Defender AV keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md index bd6ba2bfb4..5d969e79a9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 10/25/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md index 0100d2bd05..47b2f1d42a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md @@ -9,10 +9,11 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Enable block at first sight @@ -21,16 +22,12 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Block at first sight is a feature of next gen protection that provides a way to detect and block new malware within seconds. +Block at first sight is a feature of next-generation protection that provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are also enabled. In most cases, these prerequisite settings are also enabled by default, so the feature is running without any intervention. -It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. - -You can [specify how long the file should be prevented from running](configure-cloud-block-timeout-period-windows-defender-antivirus.md) while the cloud-based protection service analyzes the file. - -You can also [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. +You can [specify how long the file should be prevented from running](configure-cloud-block-timeout-period-windows-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. >[!TIP] ->You can also visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. +>Visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. ## How it works @@ -55,8 +52,8 @@ Block at first sight requires a number of settings to be configured correctly or 1. In Intune, navigate to **Device configuration - Profiles > *Profile name* > Device restrictions > Windows Defender Antivirus**. -> [!NOTE] -> The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. + > [!NOTE] + > The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. 2. Verify these settings are configured as follows: @@ -67,8 +64,8 @@ Block at first sight requires a number of settings to be configured correctly or ![Intune config](images/defender/intune-block-at-first-sight.png) -> [!Warning] -> Setting the file blocking level to **High** will apply a strong level of detection. In the unlikely event that it causes a false positive detection of legitimate files, use the option to [restore the quarantined files](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus). + > [!WARNING] + > Setting the file blocking level to **High** will apply a strong level of detection. In the unlikely event that it causes a false positive detection of legitimate files, use the option to [restore the quarantined files](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus). For more information about configuring Windows Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). @@ -77,18 +74,24 @@ For a list of Windows Defender Antivirus device restrictions in Intune, see [Dev ### Enable block at first sight with SCCM 1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **AntiMalware Policies**. -1. Click **Home** > **Create Antimalware Policy**. -1. Enter a name and a description, and add these settings: + +2. Click **Home** > **Create Antimalware Policy**. + +3. Enter a name and a description, and add these settings: - **Real time protection** - **Advanced** - **Cloud Protection Service** -1. In the left column, click **Real time protection**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**. + +4. In the left column, click **Real time protection**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**. ![Enable real-time protection](images/defender/sccm-real-time-protection.png) -1. Click **Advanced**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**. + +5. Click **Advanced**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**. ![Enable Advanced settings](images/defender/sccm-advanced-settings.png) -1. Click **Cloud Protection Service**, set **Cloud Protection Service membership type** to **Advanced membership**, set **Level for blocking malicious files** to **High**, and set **Allow extended cloud check to block and scan suspicious files for up to (seconds)** to **50** seconds. + +6. Click **Cloud Protection Service**, set **Cloud Protection Service membership type** to **Advanced membership**, set **Level for blocking malicious files** to **High**, and set **Allow extended cloud check to block and scan suspicious files for up to (seconds)** to **50** seconds. ![Enable Cloud Protection Service](images/defender/sccm-cloud-protection-service.png) -1. Click **OK** to create the policy. + +7. Click **OK** to create the policy. ### Confirm block at first sight is enabled with Group Policy @@ -97,25 +100,20 @@ For a list of Windows Defender Antivirus device restrictions in Intune, see [Dev 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** and configure the following Group Policies: +3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **MAPS**, configure the following Group Policies, and then click **OK**: - 1. Double-click **Join Microsoft MAPS** and ensure the option is set to **Enabled**. Click **OK**. + - Double-click **Join Microsoft MAPS** and ensure the option is set to **Enabled**. Click **OK**. - 2. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following: + - Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either **Send safe samples (1)** or **Send all samples (3)**. - - Send safe samples (1) - - Send all samples (3) + > [!WARNING] + > Setting to **Always prompt (0)** will lower the protection state of the device. Setting to **Never send (2)** means block at first sight will not function. - > [!WARNING] - > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means block at first sight will not function. +4. In the **Group Policy Management Editor**, expand the tree to **Windows components** > **Windows Defender Antivirus** > **Real-time Protection**: - 3. Click **OK**. + 1. Double-click **Scan all downloaded files and attachments** and ensure the option is set to **Enabled**, and then click **OK**. -4. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender Antivirus > Real-time Protection**: - - 1. Double-click **Scan all downloaded files and attachments** and ensure the option is set to **Enabled**. Click **OK**. - - 2. Double-click **Turn off real-time protection** and ensure the option is set to **Disabled**. Click **OK**. + 2. Double-click **Turn off real-time protection** and ensure the option is set to **Disabled**, and then click **OK**. If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered. @@ -125,7 +123,7 @@ You can confirm that block at first sight is enabled in Windows Settings. Block at first sight is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on. -**Confirm Block at First Sight is enabled on individual clients** +### Confirm Block at First Sight is enabled on individual clients 1. Open the Windows Security app by clicking the shield icon in the task bar. @@ -136,7 +134,7 @@ Block at first sight is automatically enabled as long as **Cloud-based protectio 3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. > [!NOTE] -> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. +> If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. ### Validate block at first sight is working @@ -147,20 +145,20 @@ You can validate that the feature is working by following the steps outlined in > [!WARNING] > Disabling block at first sight will lower the protection state of the endpoint and your network. -You may choose to disable block at first sight if you want to retain the pre-requisite settings without using block at first sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. +You may choose to disable block at first sight if you want to retain the prerequisite settings without using block at first sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. -**Disable block at first sight with Group Policy** +### Disable block at first sight with Group Policy -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and then click **Edit**. 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree through **Windows components > Windows Defender Antivirus > MAPS**. +3. Expand the tree through **Windows components** > **Windows Defender Antivirus** > **MAPS**. 4. Double-click **Configure the 'Block at First Sight' feature** and set the option to **Disabled**. > [!NOTE] - > Disabling block at first sight will not disable or alter the pre-requisite group policies. + > Disabling block at first sight will not disable or alter the prerequisite group policies. ## Related topics diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md index 7b99538868..1b9c177447 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md @@ -9,11 +9,13 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Configure the cloud block timeout period @@ -47,6 +49,6 @@ You can use Group Policy to specify an extended timeout for cloud checks. ## Related topics - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Use next-gen antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +- [Use next-generation antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) - [Configure block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md index d4eface258..47161748b2 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md index 21812cde6a..f6da565014 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md index c83644c873..a1020bef6f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 12/10/2018 ms.reviewer: manager: dansimp @@ -25,26 +26,23 @@ manager: dansimp > [!IMPORTANT] > Windows Defender Antivirus exclusions don't apply to other Microsoft Defender ATP capabilities, including [endpoint detection and response (EDR)](../microsoft-defender-atp/overview-endpoint-detection-response.md), [attack surface reduction (ASR) rules](../microsoft-defender-atp/attack-surface-reduction.md), and [controlled folder access](../microsoft-defender-atp/controlled-folders.md). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. To exclude files broadly, add them to the Microsoft Defender ATP [custom indicators](../microsoft-defender-atp/manage-indicators.md). -You can exclude certain files from Windows Defender Antivirus scans by modifying exclusion lists. +## Exclusion lists -Generally, you shouldn't need to apply exclusions. Windows Defender Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. +You can exclude certain files from Windows Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Windows Defender Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. > [!NOTE] -> Automatic exclusions apply only to Windows Server 2016 and above. +> Automatic exclusions apply only to Windows Server 2016 and above. The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default. ->[!TIP] ->The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default. - -This topic describes how to configure exclusion lists for the following: +This topic describes how to configure exclusion lists for the files and folders. Exclusion | Examples | Exclusion list ---|---|--- -Any file with a specific extension | All files with the .test extension, anywhere on the machine | Extension exclusions -Any file under a specific folder | All files under the c:\test\sample folder | File and folder exclusions -A specific file in a specific folder | The file c:\sample\sample.test only | File and folder exclusions -A specific process | The executable file c:\test\process.exe | File and folder exclusions +Any file with a specific extension | All files with the `.test` extension, anywhere on the machine | Extension exclusions +Any file under a specific folder | All files under the `c:\test\sample` folder | File and folder exclusions +A specific file in a specific folder | The file `c:\sample\sample.test` only | File and folder exclusions +A specific process | The executable file `c:\test\process.exe` | File and folder exclusions -This means the exclusion lists have the following characteristics: +Exclusion lists have the following characteristics: - Folder exclusions will apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately. - File extensions will apply to any file name with the defined extension if a path or folder is not defined. @@ -65,21 +63,23 @@ The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defen > >Changes made in the Windows Security app **will not show** in the Group Policy lists. -By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in case of conflicts. +By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence when there are conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. ## Configure the list of exclusions based on folder name or file extension -**Use Intune to configure file name, folder, or file extension exclusions:** +### Use Intune to configure file name, folder, or file extension exclusions -See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. +See the following articles: +- [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) +- [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus) -**Use Configuration Manager to configure file name, folder, or file extension exclusions:** +### Use Configuration Manager to configure file name, folder, or file extension exclusions See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). -**Use Group Policy to configure folder or file extension exclusions:** +### Use Group Policy to configure folder or file extension exclusions >[!NOTE] >If you specify a fully qualified path to a file, then only that file is excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder are excluded. @@ -112,7 +112,7 @@ See [How to create and deploy antimalware policies: Exclusion settings](https:// -**Use PowerShell cmdlets to configure file name, folder, or file extension exclusions:** +### Use PowerShell cmdlets to configure file name, folder, or file extension exclusions Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/itpro/powershell/windows/defender/defender). @@ -140,15 +140,15 @@ All files under a folder (including files in subdirectories), or a specific file >[!IMPORTANT] >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the **.test** file extension: +For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the `.test` file extension: ```PowerShell Add-MpPreference -ExclusionExtension ".test" ``` -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. +For more information, see [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). -**Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions:** +### Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -159,20 +159,18 @@ ExclusionPath The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. -See the following for more information and allowed parameters: - -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) +For more information, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx). -**Use the Windows Security app to configure file name, folder, or file extension exclusions:** +### Use the Windows Security app to configure file name, folder, or file extension exclusions See [Add exclusions in the Windows Security app](windows-defender-security-center-antivirus.md#exclusions) for instructions. ## Use wildcards in the file name and folder path or extension exclusion lists -You can use the asterisk `*`, question mark `?`, or environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the file name or folder path exclusion list. The way in which these wildcards are interpreted differs from their usual usage in other apps and languages, so you should read this section to understand their specific limitations. +You can use the asterisk `*`, question mark `?`, or environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the file name or folder path exclusion list. The way in which these wildcards are interpreted differs from their usual usage in other apps and languages. Make sure to read this section to understand their specific limitations. >[!IMPORTANT] >There are key limitations and usage scenarios for these wildcards: @@ -193,7 +191,7 @@ The following table describes how the wildcards can be used and provides some ex * (asterisk) Replaces any number of characters.
Only applies to files in the last folder defined in the argument. - Replaces a single folder.
Use multiple * with folder slashes \ to indicate multiple, nested folders.
After matching the number of wilcarded and named folders, all subfolders will also be included. + Replaces a single folder.
Use multiple * with folder slashes \ to indicate multiple, nested folders.
After matching the number of wild carded and named folders, all subfolders will also be included.
  1. C:\MyData\*.txt
    2. @@ -227,7 +225,7 @@ The following table describes how the wildcards can be used and provides some ex Replaces a single character in a folder name.
    - After matching the number of wilcarded and named folders, all subfolders will also be included. + After matching the number of wild carded and named folders, all subfolders will also be included.
      @@ -264,15 +262,20 @@ The following table describes how the wildcards can be used and provides some ex >[!IMPORTANT] >If you mix a file exclusion argument with a folder exclusion argument, the rules will stop at the file argument match in the matched folder, and will not look for file matches in any subfolders. > ->For example, you can exclude all files that start with "date" in the folders *c:\data\final\marked* and *c:\data\review\marked* by using the rule argument c:\data\\\*\marked\date*.\*. +>For example, you can exclude all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked` by using the rule argument c:\data\\\*\marked\date*.\*. > ->This argument, however, will not match any files in **subfolders** under *c:\data\final\marked* or *c:\data\review\marked*. +>This argument, however, will not match any files in **subfolders** under `c:\data\final\marked` or `c:\data\review\marked`. ## Review the list of exclusions -You can retrieve the items in the exclusion list with [Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), [System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), MpCmdRun, PowerShell, or the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions). +You can retrieve the items in the exclusion list using one of the following methods: +- [Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) +- [System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) +- MpCmdRun +- PowerShell +- [Windows Security app](windows-defender-security-center-antivirus.md#exclusions) >[!IMPORTANT] >Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions). @@ -284,7 +287,7 @@ If you use PowerShell, you can retrieve the list in two ways: - Retrieve the status of all Windows Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. -**Validate the exclusion list by using MpCmdRun:** +### Validate the exclusion list by using MpCmdRun To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command: @@ -295,7 +298,7 @@ MpCmdRun.exe -CheckExclusion -path >[!NOTE] >Checking exclusions with MpCmdRun requires Windows Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. -**Review the list of exclusions alongside all other Windows Defender Antivirus preferences by using PowerShell:** +### Review the list of exclusions alongside all other Windows Defender Antivirus preferences by using PowerShell Use the following cmdlet: @@ -307,9 +310,9 @@ In the following example, the items contained in the `ExclusionExtension` list a ![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. +For more information, see [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). -**Retrieve a specific exclusions list by using PowerShell:** +### Retrieve a specific exclusions list by using PowerShell Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: @@ -323,7 +326,7 @@ In the following example, the list is split into new lines for each use of the ` ![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. +For more information, see [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). @@ -331,15 +334,15 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. -In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the cmdlet within that path. +In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you are testing a path, ensure you run the cmdlet within that path. ```PowerShell Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" ``` -If Windows Defender Antivirus reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). +If Windows Defender Antivirus reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR test file website](http://www.eicar.org/86-0-Intended-use.html). -You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: +You can also use the following PowerShell code, which calls the .NET WebClient class to download the test file - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: ```PowerShell $client = new-object System.Net.WebClient diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md index 499df8dfac..c51a7da9ea 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index d600158473..a562fd5f60 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 10/08/2018 ms.reviewer: manager: dansimp @@ -24,9 +25,9 @@ manager: dansimp To ensure Windows Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers. -This topic lists the connections that must be allowed, such as by using firewall rules, and provides instructions for validating your connection. This will help ensure you receive the best protection from our cloud-delivered protection services. +This article lists the connections that must be allowed, such as by using firewall rules, and provides instructions for validating your connection. Configuring your protection properly helps ensure that you receive the best value from your cloud-delivered protection services. -See the Enterprise Mobility and Security blog post [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) for some details about network connectivity. +See the blog post [Important changes to Microsoft Active Protection Services endpoint](https://techcommunity.microsoft.com/t5/Configuration-Manager-Archive/Important-changes-to-Microsoft-Active-Protection-Service-MAPS/ba-p/274006) for some details about network connectivity. >[!TIP] >You can also visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: @@ -37,7 +38,7 @@ See the Enterprise Mobility and Security blog post [Important changes to Microso ## Allow connections to the Windows Defender Antivirus cloud service -The Windows Defender Antivirus cloud service provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides very important protection against malware on your endpoints and across your network. +The Windows Defender Antivirus cloud service provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network. >[!NOTE] >The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. @@ -46,18 +47,18 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. -As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). Below mention URLs are using port 443 for communication. +Because your protection is a cloud service, computers must have access to the internet and reach the ATP machine learning services. Do not exclude the URL `*.blob.core.windows.net` from any kind of network inspection. The table below lists the services and their associated URLs. Make sure that there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL `*.blob.core.windows.net`). Below mention URLs are using port 443 for communication. | **Service**| **Description** |**URL** | | :--: | :-- | :-- | -| *Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)*|Used by Windows Defender Antivirus to provide cloud-delivered protection|\*.wdcp.microsoft.com \*.wdcpalt.microsoft.com \*.wd.microsoft.com| -| *Microsoft Update Service (MU)*| Security intelligence and product updates |\*.update.microsoft.com| -| *Security intelligence updates Alternate Download Location (ADL)*| Alternate location for Windows Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| \*.download.microsoft.com| -| *Malware submission storage*|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | ussus1eastprod.blob.core.windows.net ussus1westprod.blob.core.windows.net usseu1northprod.blob.core.windows.net usseu1westprod.blob.core.windows.net ussuk1southprod.blob.core.windows.net ussuk1westprod.blob.core.windows.net ussas1eastprod.blob.core.windows.net ussas1southeastprod.blob.core.windows.net ussau1eastprod.blob.core.windows.net ussau1southeastprod.blob.core.windows.net | -| *Certificate Revocation List (CRL)*|Used by Windows when creating the SSL connection to MAPS for updating the CRL | http://www.microsoft.com/pkiops/crl/ http://www.microsoft.com/pkiops/certs http://crl.microsoft.com/pki/crl/products http://www.microsoft.com/pki/certs | -| *Symbol Store*|Used by Windows Defender Antivirus to restore certain critical files during remediation flows | https://msdl.microsoft.com/download/symbols | -| *Universal Telemetry Client*| Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: vortex-win.data.microsoft.com settings-win.data.microsoft.com| +| Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)|Used by Windows Defender Antivirus to provide cloud-delivered protection|`*.wdcp.microsoft.com`
      `*.wdcpalt.microsoft.com`
      `*.wd.microsoft.com`| +| Microsoft Update Service (MU)| Security intelligence and product updates |`*.update.microsoft.com`| +|Security intelligence updates Alternate Download Location (ADL)| Alternate location for Windows Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| `*.download.microsoft.com`| +| Malware submission storage|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | `ussus1eastprod.blob.core.windows.net`
      `ussus1westprod.blob.core.windows.net`
      `usseu1northprod.blob.core.windows.net`
      `usseu1westprod.blob.core.windows.net`
      `ussuk1southprod.blob.core.windows.net`
      `ussuk1westprod.blob.core.windows.net`
      `ussas1eastprod.blob.core.windows.net`
      `ussas1southeastprod.blob.core.windows.net`
      `ussau1eastprod.blob.core.windows.net`
      `ussau1southeastprod.blob.core.windows.net` | +| Certificate Revocation List (CRL)|Used by Windows when creating the SSL connection to MAPS for updating the CRL | `https://www.microsoft.com/pkiops/crl/`
      `https://www.microsoft.com/pkiops/certs`
      `https://crl.microsoft.com/pki/crl/products`
      `https://www.microsoft.com/pki/certs` | +| Symbol Store|Used by Windows Defender Antivirus to restore certain critical files during remediation flows | `https://msdl.microsoft.com/download/symbols` | +| Universal Telemetry Client| Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: `vortex-win.data.microsoft.com`
      `settings-win.data.microsoft.com`| ## Validate connections between your network and the cloud @@ -66,7 +67,7 @@ After whitelisting the URLs listed above, you can test if you are connected to t **Use the cmdline tool to validate cloud-delivered protection:** -Use the following argument with the Windows Defender Antivirus command line utility (*mpcmdrun.exe*) to verify that your network can communicate with the Windows Defender Antivirus cloud service: +Use the following argument with the Windows Defender Antivirus command-line utility (`mpcmdrun.exe`) to verify that your network can communicate with the Windows Defender Antivirus cloud service: ```DOS "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection @@ -75,7 +76,7 @@ Use the following argument with the Windows Defender Antivirus command line util > [!NOTE] > You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703 or higher. -See [Manage Windows Defender Antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the *mpcmdrun.exe* utility. +For more information, see [Manage Windows Defender Antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-windows-defender-antivirus.md). **Attempt to download a fake malware file from Microsoft:** @@ -112,16 +113,19 @@ You will also see a detection under **Quarantined threats** in the **Scan histor ![Screenshot of quarantined items in the Windows Security app](images/defender/wdav-quarantined-history-wdsc.png) >[!NOTE] ->Versions of Windows 10 before version 1703 have a different user interface. See [Windows Defender Antivirus in the Windows Security app](windows-defender-security-center-antivirus.md) for more information about the differences between versions, and instructions on how to perform common tasks in the different interfaces. +>Versions of Windows 10 before version 1703 have a different user interface. See [Windows Defender Antivirus in the Windows Security app](windows-defender-security-center-antivirus.md). The Windows event log will also show [Windows Defender client event ID 2050](troubleshoot-windows-defender-antivirus.md). >[!IMPORTANT] >You will not be able to use a proxy auto-config (.pac) file to test network connections to these URLs. You will need to verify your proxy servers and any network filtering tools manually to ensure connectivity. -## Related topics +## Related articles - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) + - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) + - [Run an Windows Defender Antivirus scan from the command line](command-line-arguments-windows-defender-antivirus.md) and [Command line arguments](command-line-arguments-windows-defender-antivirus.md) -- [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) + +- [Important changes to Microsoft Active Protection Services endpoint](https://techcommunity.microsoft.com/t5/Configuration-Manager-Archive/Important-changes-to-Microsoft-Active-Protection-Service-MAPS/ba-p/274006) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md index 61c02f6a88..6bd6aeb7b2 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md index d2191e0488..36714d75c3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 12/10/2018 ms.reviewer: manager: dansimp @@ -52,15 +53,15 @@ You can [configure how locally and globally defined exclusions lists are merged] -**Use Microsoft Intune to exclude files that have been opened by specified processes from scans:** +### Use Microsoft Intune to exclude files that have been opened by specified processes from scans See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details. -**Use System Center Configuration Manager to exclude files that have been opened by specified processes from scans:** +### Use System Center Configuration Manager to exclude files that have been opened by specified processes from scans See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). -**Use Group Policy to exclude files that have been opened by specified processes from scans:** +### Use Group Policy to exclude files that have been opened by specified processes from scans 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -80,7 +81,7 @@ See [How to create and deploy antimalware policies: Exclusion settings](https:// -**Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans:** +### Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/itpro/powershell/windows/defender/defender). @@ -109,7 +110,7 @@ Add-MpPreference -ExclusionProcess "c:\internal\test.exe" See [Manage antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-Windows Defender Antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans:** +### Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -125,7 +126,7 @@ See the following for more information and allowed parameters: -**Use the Windows Security app to exclude files that have been opened by specified processes from scans:** +### Use the Windows Security app to exclude files that have been opened by specified processes from scans See [Add exclusions in the Windows Security app](windows-defender-security-center-antivirus.md#exclusions) for instructions. @@ -156,7 +157,7 @@ If you use PowerShell, you can retrieve the list in two ways: - Retrieve the status of all Windows Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. -**Validate the exclusion list by using MpCmdRun:** +### Validate the exclusion list by using MpCmdRun To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command: @@ -168,7 +169,7 @@ MpCmdRun.exe -CheckExclusion -path >Checking exclusions with MpCmdRun requires Windows Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. -**Review the list of exclusions alongside all other Windows Defender Antivirus preferences by using PowerShell:** +### Review the list of exclusions alongside all other Windows Defender Antivirus preferences by using PowerShell Use the following cmdlet: @@ -178,7 +179,7 @@ Get-MpPreference See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Retrieve a specific exclusions list by using PowerShell:** +### Retrieve a specific exclusions list by using PowerShell Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: @@ -189,7 +190,7 @@ $WDAVprefs.ExclusionProcess See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -## Related topics +## Related articles - [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md index c1495c80c6..8e6f966e08 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md index 90c2964d84..b62d657934 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md @@ -9,11 +9,12 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb ms.date: 11/13/2018 ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Enable and configure antivirus always-on protection and monitoring @@ -59,7 +60,7 @@ Root | Allow antimalware service to remain running always | If protection update The main real-time protection capability is enabled by default, but you can disable it with Group Policy: -**Use Group Policy to disable real-time protection:** +### Use Group Policy to disable real-time protection 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -69,7 +70,7 @@ The main real-time protection capability is enabled by default, but you can disa 4. Double-click the **Turn off real-time protection** setting and set the option to **Enabled**. Click **OK**. -## Related topics +## Related articles - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md index 2b5bb82466..9702fdb478 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md index caae6efc4e..85b7b015a3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md @@ -11,8 +11,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen --- # Configure Windows Defender Antivirus exclusions on Windows Server @@ -35,8 +36,6 @@ Custom exclusions take precedence over automatic exclusions. > [!TIP] > Custom and duplicate exclusions do not conflict with automatic exclusions. - - Windows Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer. ## Opt out of automatic exclusions @@ -54,7 +53,7 @@ In Windows Server 2016, the predefined exclusions delivered by Security intellig You can disable the automatic exclusion lists with Group Policy, PowerShell cmdlets, and WMI. -**Use Group Policy to disable the auto-exclusions list on Windows Server 2016:** +### Use Group Policy to disable the auto-exclusions list on Windows Server 2016 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -74,7 +73,7 @@ Set-MpPreference -DisableAutoExclusions $true See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016:** +### Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016 Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -294,6 +293,7 @@ This section lists the exclusions that are delivered automatically when you inst - %systemroot%\System32\lsass.exe ### DHCP Server exclusions + This section lists the exclusions that are delivered automatically when you install the DHCP Server role. The DHCP Server file locations are specified by the *DatabasePath*, *DhcpLogFilePath*, and *BackupDatabasePath* parameters in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters` - *%systemroot%*\System32\DHCP\\*\\\*.mdb @@ -307,6 +307,7 @@ This section lists the exclusions that are delivered automatically when you inst - *%systemroot%*\System32\DHCP\\*\\\*.edb ### DNS Server exclusions + This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role. - File and folder exclusions for the DNS Server role: @@ -324,6 +325,7 @@ This section lists the file and folder exclusions and the process exclusions tha - *%systemroot%*\System32\dns.exe ### File and Storage Services exclusions + This section lists the file and folder exclusions that are delivered automatically when you install the File and Storage Services role. The exclusions listed below do not include exclusions for the Clustering role. - *%SystemDrive%*\ClusterStorage @@ -333,6 +335,7 @@ This section lists the file and folder exclusions that are delivered automatical - *%SystemDrive%*\mscs ### Print Server exclusions + This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role. - File type exclusions: @@ -350,6 +353,7 @@ This section lists the file type exclusions, folder exclusions, and the process - spoolsv.exe ### Web Server exclusions + This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role. - Folder exclusions: @@ -373,6 +377,7 @@ This section lists the folder exclusions and the process exclusions that are del - *%SystemDrive%*\PHP5433\php-cgi.exe ### Windows Server Update Services exclusions + This section lists the folder exclusions that are delivered automatically when you install the Windows Server Update Services (WSUS) role. The WSUS folder is specified in the registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup` - *%systemroot%*\WSUS\WSUSContent @@ -383,7 +388,7 @@ This section lists the folder exclusions that are delivered automatically when y - *%systemroot%*\SoftwareDistribution\Download -## Related topics +## Related articles - [Configure and validate exclusions for Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md b/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md index da95773da3..d771955c80 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md index a700977d08..4e5666fd45 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md index b95dce5844..ad4a8eee3e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md index 4371855830..9f668be613 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md index 307d8fcd7d..3dfe9a2e82 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -202,6 +203,6 @@ On Windows Server 2016, Windows Defender Antivirus will automatically deliver th ## Additional resources -- [Video: Microsoft Senior Program Manager Bryan Keller on how System Center Configuration Manger 2012 manages VDI and integrates with App-V]( http://channel9.msdn.com/Shows/Edge/Edge-Show-5-Manage-VDI-using-SCCM-2012#time=03m02s) +- [Video: Microsoft Senior Program Manager Bryan Keller on how System Center Configuration Manger 2012 manages VDI and integrates with App-V]( https://channel9.msdn.com/Shows/Edge/Edge-Show-5-Manage-VDI-using-SCCM-2012#time=03m02s) - [TechNet forums on Remote Desktop Services and VDI](https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS) - [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index acad6edc05..c9ade7db82 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: detect ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen audience: ITPro ms.date: 10/02/2018 ms.reviewer: @@ -142,7 +143,7 @@ See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for det Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be allow-listed. See [How to Configure Endpoint Protection in Configuration Manager](https://docs.microsoft.com/previous-versions/system-center/system-center-2012-R2/hh508770(v=technet.10)#to-exclude-specific-files-or-folders) for information on allowing files which are currently blocked by PUA protection in Windows Defender Antivirus. -## Related topics +## Related articles -- [Next gen protection](windows-defender-antivirus-in-windows-10.md) +- [Next-generation protection](windows-defender-antivirus-in-windows-10.md) - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index c9aca52f0d..1bc4cdbd31 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -9,10 +9,11 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Enable cloud-delivered protection diff --git a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md index 33b7f2e9ab..6173192baf 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md index a5cbbeb7a7..8285dbdc5e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -26,9 +27,9 @@ manager: dansimp Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 device. -It can only be enabled in certain situations. See [Windows Defender Antivirus compatibility](windows-defender-antivirus-compatibility.md) for more information on when limited periodic scanning can be enabled, and how Windows Defender Antivirus works with other AV products. +It can only be enabled in certain situations. For more information about limited periodic scanning and how Microsoft Defender Antivirus works with other antivirus products, see [Windows Defender Antivirus compatibility](windows-defender-antivirus-compatibility.md). -**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a very limited subset of the Windows Defender Antivirus capabilities to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively. +**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a limited subset of the Windows Defender Antivirus capabilities to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively. ## How to enable limited periodic scanning @@ -42,15 +43,15 @@ If another antivirus product is installed and working correctly, Windows Defende ![Windows Security app showing ContosoAV as the installed and running antivirus provider. There is a single link to open ContosoAV settings.](images/vtp-3ps.png) -Underneath any 3rd party AV products, a new link will appear as **Windows Defender Antivirus options**. Clicking this link will expand to show the toggle that enables limited periodic scanning. +Underneath any third party AV products, a new link will appear as **Windows Defender Antivirus options**. Clicking this link will expand to show the toggle that enables limited periodic scanning. ![The limited periodic option is a toggle to enable or disable **periodic scanning**](images/vtp-3ps-lps.png) -Sliding the swtich to **On** will show the standard Windows Defender AV options underneath the 3rd party AV product. The limited periodic scanning option will appear at the bottom of the page. +Sliding the switch to **On** will show the standard Windows Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page. ![When enabled, periodic scanning shows the normal Windows Defender Antivirus options](images/vtp-3ps-lps-on.png) -## Related topics +## Related articles - [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md index 805f9c697f..c238f05823 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -28,7 +29,7 @@ Windows Defender Antivirus allows you to determine if updates should (or should You can use System Center Configuration Manager, Group Policy, PowerShell cmdlets, and WMI to force Windows Defender Antivirus to check and download protection updates before running a scheduled scan. -**Use Configuration Manager to check for protection updates before running a scan:** +### Use Configuration Manager to check for protection updates before running a scan 1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) @@ -36,23 +37,23 @@ You can use System Center Configuration Manager, Group Policy, PowerShell cmdlet 3. Click **OK**. -4.[Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). +4. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). -**Use Group Policy to check for protection updates before running a scan:** +### Use Group Policy to check for protection updates before running a scan -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**. +2. Using the **Group Policy Management Editor** go to **Computer configuration**. 3. Click **Policies** then **Administrative templates**. -4. Expand the tree to **Windows components > Windows Defender Antivirus > Scan**. +4. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Scan**. 5. Double-click **Check for the latest virus and spyware definitions before running a scheduled scan** and set the option to **Enabled**. 6. Click **OK**. -**Use PowerShell cmdlets to check for protection updates before running a scan:** +### Use PowerShell cmdlets to check for protection updates before running a scan Use the following cmdlets: @@ -60,9 +61,9 @@ Use the following cmdlets: Set-MpPreference -CheckForSignaturesBeforeRunningScan ``` -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. +For more information, see [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index). -**Use Windows Management Instruction (WMI) to check for protection updates before running a scan** +### Use Windows Management Instruction (WMI) to check for protection updates before running a scan Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -70,20 +71,19 @@ Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com CheckForSignaturesBeforeRunningScan ``` -See the following for more information: -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) +For more information, see [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). ## Check for protection updates on startup You can use Group Policy to force Windows Defender Antivirus to check and download protection updates when the machine is started. -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**. +2. Using the **Group Policy Management Editor** go to **Computer configuration**. 3. Click **Policies** then **Administrative templates**. -4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. +4. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Signature Updates**. 5. Double-click **Check for the latest virus and spyware definitions on startup** and set the option to **Enabled**. @@ -91,21 +91,21 @@ You can use Group Policy to force Windows Defender Antivirus to check and downlo You can also use Group Policy, PowerShell, or WMI to configure Windows Defender Antivirus to check for updates at startup even when it is not running. -**Use Group Policy to download updates when Windows Defender Antivirus is not present:** +### Use Group Policy to download updates when Windows Defender Antivirus is not present -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**. +2. Using the **Group Policy Management Editor**, go to **Computer configuration**. 3. Click **Policies** then **Administrative templates**. -4. Expand the tree to **Windows components > Windows Defender Antivirus > Security Intelligence Updates**. +4. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Security Intelligence Updates**. 5. Double-click **Initiate security intelligence update on startup** and set the option to **Enabled**. 6. Click **OK**. -**Use PowerShell cmdlets to download updates when Windows Defender Antivirus is not present:** +### Use PowerShell cmdlets to download updates when Windows Defender Antivirus is not present Use the following cmdlets: @@ -113,43 +113,44 @@ Use the following cmdlets: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine ``` -See [Use PowerShell cmdlets to manage Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. +For more information, see [Use PowerShell cmdlets to manage Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to download updates when Windows Defender Antivirus is not present:** +### Use Windows Management Instruction (WMI) to download updates when Windows Defender Antivirus is not present -Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: +Use the [**Set** method of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: ```WMI SignatureDisableUpdateOnStartupWithoutEngine ``` -See the following for more information: -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) +For more information, see [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). ## Allow ad hoc changes to protection based on cloud-delivered protection -Windows Defender AV can make changes to its protection based on cloud-delivered protection. This can occur outside of normal or scheduled protection updates. +Windows Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates. If you have enabled cloud-delivered protection, Windows Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Windows Defender AV to automatically receive that protection update. Other important protection updates can also be applied. -**Use Group Policy to automatically download recent updates based on cloud-delivered protection:** +### Use Group Policy to automatically download recent updates based on cloud-delivered protection -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**. +2. Using the **Group Policy Management Editor** go to **Computer configuration**. 3. Click **Policies** then **Administrative templates**. -4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following: - 1. Double-click **Allow real-time security intelligence updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**. - 2. Double-click **Allow notifications to disable definitions based reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**. +4. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Signature Updates**. + +5. Double-click **Allow real-time security intelligence updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Then click **OK**. + +6. **Allow notifications to disable definitions-based reports to Microsoft MAPS** and set the option to **Enabled**. Then click **OK**. > [!NOTE] > "Allow notifications to disable definitions based reports" enables Microsoft MAPS to disable those definitions known to cause false-positive reports. You must configure your computer to join Microsoft MAPS for this function to work. -## Related topics +## Related articles - [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md index ca75fa1e6f..fabe399119 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -32,7 +33,7 @@ When the user returns to work and logs on to their PC, Windows Defender Antiviru If Windows Defender Antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-windows-defender-antivirus.md). -**Use Configuration Manager to configure catch-up protection updates:** +### Use Configuration Manager to configure catch-up protection updates 1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) @@ -45,7 +46,7 @@ If Windows Defender Antivirus did not download protection updates for a specifie 4. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). -**Use Group Policy to enable and configure the catch-up update feature:** +### Use Group Policy to enable and configure the catch-up update feature 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -59,7 +60,7 @@ If Windows Defender Antivirus did not download protection updates for a specifie 6. Click **OK**. -**Use PowerShell cmdlets to configure catch-up protection updates:** +### Use PowerShell cmdlets to configure catch-up protection updates Use the following cmdlets: @@ -69,7 +70,7 @@ Set-MpPreference -SignatureUpdateCatchupInterval See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to configure catch-up protection updates:** +### Use Windows Management Instruction (WMI) to configure catch-up protection updates Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -81,13 +82,11 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) - - ## Set the number of days before protection is reported as out-of-date You can also specify the number of days after which Windows Defender Antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Windows Defender Antivirus to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source. -**Use Group Policy to specify the number of days before protection is considered out-of-date:** +### Use Group Policy to specify the number of days before protection is considered out-of-date 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -106,8 +105,6 @@ You can also specify the number of days after which Windows Defender Antivirus p 4. Click **OK**. - - ## Set up catch-up scans for endpoints that have not been scanned for a while You can set the number of consecutive scheduled scans that can be missed before Windows Defender Antivirus will force a scan. @@ -120,7 +117,7 @@ The process for enabling this feature is: This feature can be enabled for both full and quick scans. -**Use Group Policy to enable and configure the catch-up scan feature:** +### Use Group Policy to enable and configure the catch-up scan feature 1. Ensure you have set up at least one scheduled scan. @@ -140,7 +137,7 @@ This feature can be enabled for both full and quick scans. > [!NOTE] > The Group Policy setting title refers to the number of days. The setting, however, is applied to the number of scans (not days) before the catch-up scan will be run. -**Use PowerShell cmdlets to configure catch-up scans:** +### Use PowerShell cmdlets to configure catch-up scans Use the following cmdlets: @@ -152,7 +149,7 @@ Set-MpPreference -DisableCatchupQuickScan See [Use PowerShell cmdlets to manage Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to configure catch-up scans:** +### Use Windows Management Instruction (WMI) to configure catch-up scans Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -165,7 +162,7 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) -**Use Configuration Manager to configure catch-up scans:** +### Use Configuration Manager to configure catch-up scans 1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) @@ -175,8 +172,7 @@ See the following for more information and allowed parameters: 4. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). - -## Related topics +## Related articles - [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md index 146b92de6f..0185b12a58 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md @@ -10,8 +10,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -33,7 +34,7 @@ You can schedule updates for your endpoints by: You can also randomize the times when each endpoint checks and downloads protection updates. See the [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) topic for more information. -**Use Configuration Manager to schedule protection updates:** +## Use Configuration Manager to schedule protection updates 1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) @@ -47,7 +48,7 @@ You can also randomize the times when each endpoint checks and downloads protect 5. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). -**Use Group Policy to schedule protection updates:** +## Use Group Policy to schedule protection updates > [!IMPORTANT] > By default, Windows Defender Antivirus will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default. @@ -65,8 +66,7 @@ You can also randomize the times when each endpoint checks and downloads protect 3. Double-click the **Specify the time to check for security intelligence updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**. - -**Use PowerShell cmdlets to schedule protection updates:** +## Use PowerShell cmdlets to schedule protection updates Use the following cmdlets: @@ -78,7 +78,7 @@ Set-MpPreference -SignatureUpdateInterval See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to schedule protection updates:** +## Use Windows Management Instruction (WMI) to schedule protection updates Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -92,7 +92,7 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) -## Related topics +## Related articles - [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md index e5efd9c691..775068abed 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -24,6 +25,7 @@ manager: dansimp There are two types of updates related to keeping Windows Defender Antivirus up to date: 1. Protection updates + 2. Product updates You can also apply [Windows security baselines](https://technet.microsoft.com/itpro/windows/keep-secure/windows-security-baselines) to quickly bring your endpoints up to a uniform level of protection. @@ -34,7 +36,6 @@ Windows Defender Antivirus uses both [cloud-delivered protection](utilize-micros The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection. - ## Product updates Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases. diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md index 179c55aac4..94b9e04752 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -46,7 +47,7 @@ You can opt-in to Microsoft Update on the mobile device in one of the following 2. Use a VBScript to create a script, then run it on each computer in your network. 3. Manually opt-in every computer on your network through the **Settings** menu. -**Use Group Policy to opt-in to Microsoft Update:** +### Use Group Policy to opt-in to Microsoft Update 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -54,18 +55,17 @@ You can opt-in to Microsoft Update on the mobile device in one of the following 4. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**. +5. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Signature Updates**. 6. Double-click the **Allow security intelligence updates from Microsoft Update** setting and set the option to **Enabled**. Click **OK**. -**Use a VBScript to opt-in to Microsoft Update** +### Use a VBScript to opt-in to Microsoft Update 1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. 2. Run the VBScript you created on each computer in your network. - -**Manually opt-in to Microsoft Update** +### Manually opt-in to Microsoft Update 1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. 2. Click **Advanced** options. @@ -75,7 +75,7 @@ You can opt-in to Microsoft Update on the mobile device in one of the following You can configure Windows Defender Antivirus to only download protection updates when the PC is connected to a wired power source. -**Use Group Policy to prevent security intelligence updates on battery power:** +### Use Group Policy to prevent security intelligence updates on battery power 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -89,10 +89,7 @@ You can configure Windows Defender Antivirus to only download protection updates 2. Click **OK**. This will prevent protection updates from downloading when the PC is on battery power. - - - -## Related topics +## Related articles - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Update and manage Windows Defender Antivirus in Windows 10](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index acfa9717f3..5eb2cef516 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -14,6 +14,7 @@ ms.localizationpriority: medium audience: ITPro author: denisebmsft ms.author: deniseb +ms.custom: nextgen --- # Protect security settings with Tamper Protection diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md index 583e4365b4..8f6ebb3c64 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -34,52 +35,49 @@ With the setting set to **Enabled**: With the setting set to **Disabled** or not configured: -![Scheenshot of Windows Security showing the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-off-1703.png) +![Screenshot of Windows Security showing the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-off-1703.png) >[!NOTE] ->Hiding the interface will also prevent Windows Defender Antivirus notifications from appearing on the endpoint. Microsoft Defender Advanced Threat Protection notifications will still appear. You can also individually [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) +>Hiding the interface will also prevent Windows Defender Antivirus notifications from appearing on the endpoint. Microsoft Defender Advanced Threat Protection notifications will still appear. You can also individually [configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) +In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning that says, "Your system administrator has restricted access to this app." -In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning "Your system administrator has restricted access to this app.": +![Warning message when headless mode is enabled in Windows 10, versions earlier than 1703](images/defender/wdav-headless-mode-1607.png) -![Warning message when headless mode is enabled in Windows 10, versions earlier than 1703 that says Your system administrator has restricted access to this app](images/defender/wdav-headless-mode-1607.png) +## Use Group Policy to hide the Windows Defender AV interface from users -**Use Group Policy to hide the Windows Defender AV interface from users:** +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. Using the **Group Policy Management Editor** go to **Computer configuration**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Administrative templates**. -4. Click **Administrative templates**. +4. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**. +5. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**. -6. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**. - - -Also see the [Prevent users from locally modifying policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) topic for more options on preventing users form modifying protection on their PCs. +See [Prevent users from locally modifying policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) for more options on preventing users form modifying protection on their PCs. ## Prevent users from pausing a scan -You can prevent users from pausing scans. This can be helpful to ensure scheduled or on-demand scans are not interrupted by users. +You can prevent users from pausing scans, which can be helpful to ensure scheduled or on-demand scans are not interrupted by users. +### Use Group Policy to prevent users from pausing a scan -**Use Group Policy to prevent users from pausing a scan:** +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +2. Using the **Group Policy Management Editor** go to **Computer configuration**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +3. Click **Administrative templates**. -4. Click **Administrative templates**. +4. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Scan**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Scan**. - -6. Double-click the **Allow users to pause scan** setting and set the option to **Disabled**. Click **OK**. - - -## Related topics +5. Double-click the **Allow users to pause scan** setting and set the option to **Disabled**. Click **OK**. +## Related articles - [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) + - [Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md) + - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md index 41a8f3094f..16f606bbae 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Monitor and report on Windows Defender Antivirus protection -description: Use Configuration Manager or SIEM tools to consume reports, and monitor Windows Defender AV with PowerShell and WMI. +description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Windows Defender AV with PowerShell and WMI. keywords: siem, monitor, report, windows defender av search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -22,24 +23,22 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -There are a number of ways you can review protection status and alerts, depending on the management tool you are using for Windows Defender Antivirus. - -You can use System Center Configuration Manager to [monitor Windows Defender Antivirus](https://docs.microsoft.com/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-configure-alerts), or you can also monitor protection using [Microsoft Intune](https://docs.microsoft.com/intune/introduction-intune). +With Windows Defender Antivirus, you have several options for reviewing protection status and alerts. You can use System Center Configuration Manager to [monitor Windows Defender Antivirus](https://docs.microsoft.com/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](https://docs.microsoft.com/intune/introduction-intune). Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Windows Defender Antivirus issues, including protection updates and real-time protection settings. +If you have a third-party security information and event management (SIEM) server, you can also consume [Windows Defender client events](https://msdn.microsoft.com/library/windows/desktop/aa964766(v=vs.85).aspx). -If you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client events](https://msdn.microsoft.com/library/windows/desktop/aa964766(v=vs.85).aspx). +Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](https://technet.microsoft.com/library/mt431757.aspx), also see the [Security auditing](/windows/device-security/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-windows-defender-antivirus.md). -Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](https://technet.microsoft.com/library/mt431757.aspx), also see the [Security audting](/windows/device-security/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-windows-defender-antivirus.md). - -These events can be centrally aggregated using the [Windows event collector](https://msdn.microsoft.com/library/windows/desktop/bb427443(v=vs.85).aspx). It is common practice for SIEMs to have connectors for Windows events. This technique allows for correlation of all security events from the machine in the SIEM. +These events can be centrally aggregated using the [Windows event collector](https://msdn.microsoft.com/library/windows/desktop/bb427443(v=vs.85).aspx). Often, SIEM servers have connectors for Windows events, allowing you to correlate all security events in your SIEM server. You can also [monitor malware events using the Malware Assessment solution in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-malware). For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-windows-defender-antivirus.md#ref2). -## Related topics +## Related articles - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) + - [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md index 68c4accc82..f99aa7584f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 11/16/2018 ms.reviewer: manager: dansimp @@ -32,7 +33,7 @@ If Windows Defender Antivirus is configured to detect and remediate threats on y > [!NOTE] > You can also use the dedicated command-line tool [mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) to restore quarantined files in Windows Defender AV. -## Related topics +## Related articles - [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) - [Review scan results](review-scan-results-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md index 1c07b37c51..78fed4d5d4 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -25,18 +26,17 @@ manager: dansimp After an Windows Defender Antivirus scan completes, whether it is an [on-demand](run-scan-windows-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-windows-defender-antivirus.md), the results are recorded and you can view the results. -**Use Microsoft Intune to review scan results:** +## Use Microsoft Intune to review scan results 1. In Intune, go to **Devices > All Devices** and select the device you want to scan. 2. Click the scan results in **Device actions status**. -**Use Configuration Manager to review scan results:** +## Use Configuration Manager to review scan results See [How to monitor Endpoint Protection status](https://docs.microsoft.com/sccm/protect/deploy-use/monitor-endpoint-protection). - -**Use the Windows Security app to review scan results:** +## Use the Windows Security app to review scan results 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -45,10 +45,7 @@ See [How to monitor Endpoint Protection status](https://docs.microsoft.com/sccm/ - Click **See full history** for any of the sections to see previous detections and the action taken. You can also clear the list. - Information about the last scan is displayed at the bottom of the page. - - - -**Use PowerShell cmdlets to review scan results:** +## Use PowerShell cmdlets to review scan results The following cmdlet will return each detection on the endpoint. If there are multiple detections of the same threat, each detection will be listed separately, based on the time of each detection: @@ -70,15 +67,12 @@ Get-MpThreat See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to review scan results:** +## Use Windows Management Instruction (WMI) to review scan results Use the [**Get** method of the **MSFT_MpThreat** and **MSFT_MpThreatDetection**](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) classes. - - - -## Related topics +## Related articles - [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md index 4c62952e60..66db88455e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -38,49 +39,40 @@ A full scan can be useful on endpoints that have encountered a malware threat to >[!NOTE] >By default, quick scans run on mounted removable devices, such as USB drives. -**Use Configuration Manager to run a scan:** +## Use Configuration Manager to run a scan See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using System Center Configuration Manager (current branch) to run a scan. -**Use the mpcmdrun.exe command-line utility to run a scan:** +## Use the mpcmdrun.exe command-line utility to run a scan Use the following `-scan` parameter: ```DOS mpcmdrun.exe -scan -scantype 1 ``` - - - See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the tool and additional parameters, including starting a full scan or defining paths. - - -**Use Microsoft Intune to run a scan:** +## Use Microsoft Intune to run a scan 1. In Intune, go to **Devices > All Devices** and select the device you want to scan. 2. Select **...More** and then select **Quick Scan** or **Full Scan**. -**Use the Windows Security app to run a scan:** +## Use the Windows Security app to run a scan See [Run a scan in the Windows Security app](windows-defender-security-center-antivirus.md#scan) for instructions on running a scan on individual endpoints. - - -**Use PowerShell cmdlets to run a scan:** +## Use PowerShell cmdlets to run a scan Use the following cmdlet: ```PowerShell Start-MpScan ``` - - See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to run a scan:** +## Use Windows Management Instruction (WMI) to run a scan Use the [**Start** method of the **MSFT_MpScan**](https://msdn.microsoft.com/library/dn455324(v=vs.85).aspx#methods) class. @@ -88,8 +80,7 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) -## Related topics - +## Related articles - [Configure Windows Defender Antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md) - [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index bf6852066d..e49771c6ae 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 12/10/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md index f8a9335f5f..e6b6bf10d0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md @@ -9,11 +9,12 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb ms.date: 09/03/2018 ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Specify the cloud-delivered protection level @@ -27,9 +28,7 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi >[!NOTE] >The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. - - -**Use Intune to specify the level of cloud-delivered protection:** +## Use Intune to specify the level of cloud-delivered protection 1. Sign in to the [Azure portal](https://portal.azure.com). 2. Select **All services > Intune**. @@ -46,13 +45,15 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles) -**Use Configuration Manager to specify the level of cloud-delivered protection:** +## Use Configuration Manager to specify the level of cloud-delivered protection -1. See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch). +See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch). -**Use Group Policy to specify the level of cloud-delivered protection:** +## Use Group Policy to specify the level of cloud-delivered protection -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx). + +2. Right-click the Group Policy Object you want to configure, and then click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration**. @@ -60,20 +61,19 @@ For more information about Intune device profiles, including how to create and c 5. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**. -1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: - 1. **Default Windows Defender Antivirus blocking level** provides strong detection without increasing the risk of detecting legitimate files. - 2. **High blocking level** applies a strong level of detection while optimizing client performance (greater chance of false positives). - 3. **High + blocking level** applies additional protection measures (may impact client performance and increase risk of false positives). - 4. **Zero tolerance blocking level** blocks all unknown executables. +6. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: + - **Default Windows Defender Antivirus blocking level** provides strong detection without increasing the risk of detecting legitimate files. + - **High blocking level** applies a strong level of detection while optimizing client performance (greater chance of false positives). + - **High + blocking level** applies additional protection measures (may impact client performance and increase risk of false positives). + - **Zero tolerance blocking level** blocks all unknown executables. + + > [!WARNING] + > While unlikely, setting this switch to **High** or **High +** may cause some legitimate files to be detected (although you will have the option to unblock or dispute that detection). - > [!WARNING] - > While unlikely, setting this switch to **High** or **High +** may cause some legitimate files to be detected (although you will have the option to unblock or dispute that detection). -6. Click **OK**. +7. Click **OK**. - - -## Related topics +## Related articles - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md index 787e3d4728..d123f26a35 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.reviewer: manager: dansimp --- @@ -34,7 +35,7 @@ For common error codes and event IDs related to the Windows Defender Antivirus s There are three steps to troubleshooting these problems: -1. Confirm that you have met all pre-requisites +1. Confirm that you have met all prerequisites 2. Check your connectivity to the Windows Defender cloud-based service 3. Submit support logs @@ -42,9 +43,9 @@ There are three steps to troubleshooting these problems: >It typically takes 3 days for devices to start appearing in Update Compliance. -## Confirm pre-requisites +## Confirm prerequisites -In order for devices to properly show up in Update Compliance, you have to meet certain pre-requisites for both the Update Compliance service and for Windows Defender Antivirus: +In order for devices to properly show up in Update Compliance, you have to meet certain prerequisites for both the Update Compliance service and for Windows Defender Antivirus: >[!div class="checklist"] >- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](windows-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance. @@ -55,7 +56,7 @@ In order for devices to properly show up in Update Compliance, you have to meet “You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender ATP portal (https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options" -If the above pre-requisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. +If the above prerequisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. > [!div class="nextstepaction"] > [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data-update-compliance.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md index a371aaca96..8b02e56f61 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/11/2018 ms.reviewer: manager: dansimp @@ -46,7 +47,7 @@ You can directly view the event log, or if you have a third-party security infor The table in this section lists the main Windows Defender Antivirus event IDs and, where possible, provides suggested solutions to fix or resolve the error. -**To view a Windows Defender Antivirus event** +## To view a Windows Defender Antivirus event 1. Open **Event Viewer**. 2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender Antivirus**. @@ -54,9 +55,6 @@ The table in this section lists the main Windows Defender Antivirus event IDs an 4. In the details pane, view the list of individual events to find your event. 5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs. - - - @@ -361,7 +359,7 @@ Message: Description: @@ -760,7 +758,7 @@ Description: @@ -2452,7 +2450,7 @@ Message: Description: diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md index b7114cd1fd..84d8ca6968 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -26,22 +27,21 @@ You can use [Group Policy](https://msdn.microsoft.com/library/ee663280(v=vs.85). In general, you can use the following procedure to configure or change Windows Defender Antivirus group policy settings: -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. Using the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Administrative templates**. +3. Click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus**. +4. Expand the tree to **Windows components** > **Windows Defender Antivirus**. -6. Expand the section (referred to as **Location** in the table in this topic) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes. +5. Expand the section (referred to as **Location** in the table in this topic) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes. -7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). +6. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). The following table in this topic lists the Group Policy settings available in Windows 10, version 1703, and provides links to the appropriate topic in this documentation library (where applicable). - -Location | Setting | Documented in topic +Location | Setting | Article ---|---|--- Client interface | Enable headless UI mode | [Prevent users from seeing or interacting with the Windows Defender Antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md) Client interface | Display additional text to clients when they need to perform an action | [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) @@ -88,10 +88,10 @@ Reporting | Configure time out for detections requiring additional action | Not Reporting | Turn off enhanced notifications | [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) Root | Turn off Windows Defender Antivirus | Not used (This setting must be set to **Not configured** to ensure any installed third-party antivirus apps work correctly) Root | Define addresses to bypass proxy server | Not used -Root | Define proxy auto-config (.pac) for connecting to the network | Not used +Root | Define proxy autoconfig (.pac) for connecting to the network | Not used Root | Define proxy server for connecting to the network | Not used Root | Configure local administrator merge behavior for lists | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) -Root | Allow antimalware service to startup with normal priority | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md) +Root | Allow antimalware service to start up with normal priority | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md) Root | Allow antimalware service to remain running always | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md) Root | Turn off routine remediation | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md) Root | Randomize scheduled task times | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md) @@ -126,7 +126,7 @@ Scan | Specify the time of day to run a scheduled scan | [Configure scheduled sc Scan | Start the scheduled scan only when computer is on but not in use | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md) Security intelligence updates | Allow security intelligence updates from Microsoft Update | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) Security intelligence updates | Allow security intelligence updates when running on battery power | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -Security intelligence updates | Allow notifications to disable definitions based repots to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +Security intelligence updates | Allow notifications to disable definitions-based reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) Security intelligence updates | Allow real-time security intelligence updates based on reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) Security intelligence updates | Check for the latest virus and spyware definitions on startup | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) Security intelligence updates | Define file shares for downloading security intelligence updates | [Manage Windows Defender Antivirus protection and security intelligence updates](manage-protection-updates-windows-defender-antivirus.md) @@ -143,12 +143,8 @@ Threats | Specify threat alert levels at which default action should not be take Threats | Specify threats upon which default action should not be taken when detected | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md) - - - - - -## Related topics +## Related articles - [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) + diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md index 0a6c5dc31a..6ed604307a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -31,7 +32,7 @@ See the [Endpoint Protection](https://docs.microsoft.com/sccm/protect/deploy-use For Microsoft Intune, consult the [Microsoft Intune library](https://docs.microsoft.com/intune/introduction-intune) and [Configure device restriction settings in Intune](https://docs.microsoft.com/intune/device-restrictions-configure). -## Related topics +## Related articles - [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md index bd4a22592f..326511d75c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -38,7 +39,7 @@ You can [configure which settings can be overridden locally with local policy ov PowerShell is typically installed under the folder _%SystemRoot%\system32\WindowsPowerShell_. -**Use Windows Defender Antivirus PowerShell cmdlets:** +## Use Windows Defender Antivirus PowerShell cmdlets 1. Click **Start**, type **powershell**, and press **Enter**. 2. Click **Windows PowerShell** to open the interface. diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md index c0e86e1a2b..0e88dfd58b 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md index 5553e762b8..e1d2d9c8e9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md @@ -9,10 +9,11 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection @@ -21,7 +22,7 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Microsoft next-gen technologies in Windows Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. +Microsoft next-generation technologies in Windows Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. Windows Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). ![List of Windows Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 717e08d7d4..369ebfe876 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md index 6327898e26..d1ec034818 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md @@ -14,6 +14,7 @@ ms.author: deniseb ms.date: 10/14/2019 ms.reviewer: manager: dansimp +ms.custom: nextgen --- # Next-generation protection in Windows 10 and Windows Server 2016 @@ -33,8 +34,7 @@ Next-generation protection includes services that use machine learning together >- [Cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) >- Fast learning (including [block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md)) >- [Potentially unwanted application blocking](detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) - -> [!NOTE] +> > For more information regarding what's new in each Windows version, please refer to [What's new in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp). ## Minimum system requirements @@ -44,7 +44,7 @@ Windows Defender Antivirus is your main vehicle for next-generation protection, - [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) - [Hardware component guidelines](https://docs.microsoft.com/windows-hardware/design/component-guidelines/components) -## Configuring Next-generation services +## Configuring next-generation services You can use the following to configure and manage next-generation services in Windows 10 while running Windows Defender Antivirus: diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md index e106d82384..4187645c2e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -28,7 +29,7 @@ You can use Windows Defender Offline if you suspect a malware infection, or you In Windows 10, Windows Defender Offline can be run with one click directly from the [Windows Security app](windows-defender-security-center-antivirus.md). In previous versions of Windows, a user had to install Windows Defender Offline to bootable media, restart the endpoint, and load the bootable media. -## Pre-requisites and requirements +## prerequisites and requirements Windows Defender Offline in Windows 10 has the same hardware requirements as Windows 10. @@ -92,7 +93,7 @@ You can run a Windows Defender Offline scan with the following: -**Use PowerShell cmdlets to run an offline scan:** +### Use PowerShell cmdlets to run an offline scan Use the following cmdlets: @@ -102,7 +103,7 @@ Start-MpWDOScan See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to run an offline scan:** +### Use Windows Management Instruction (WMI) to run an offline scan Use the [**MSFT_MpWDOScan**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class to run an offline scan. @@ -116,7 +117,7 @@ See the following for more information: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) -**Use the Windows Defender Security app to run an offline scan:** +### Use the Windows Defender Security app to run an offline scan 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -135,7 +136,7 @@ See the following for more information: Windows Defender Offline scan results will be listed in the [Scan history section of the Windows Security app](windows-defender-security-center-antivirus.md#detection-history). -## Related topics +## Related articles - [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md index 6333dad0ae..5935c90319 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md @@ -9,8 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen ms.date: 09/03/2018 ms.reviewer: manager: dansimp @@ -40,7 +41,7 @@ See the [Windows Security topic](/windows/threat-protection/windows-defender-sec >[!NOTE] >The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal that is used to review and manage [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md). -**Review virus and threat protection settings in the Windows Security app:** +## Review virus and threat protection settings in the Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -66,7 +67,6 @@ Item | Windows 10, before version 1703 | Windows 10, version 1703 and later | De 4 | **Scan options** | **Advanced scan** | Run a full scan, custom scan, or a Windows Defender Offline scan 5 | Run a scan (based on the option chosen under **Scan options** | **Quick scan** | In Windows 10, version 1703 and later, you can run custom and full scans under the **Advanced scan** option - ## Common tasks This section describes how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Windows Defender Antivirus in the Windows Security app. @@ -75,7 +75,9 @@ This section describes how to perform some of the most common tasks when reviewi > If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md) topic describes how local policy override settings can be configured. -**Run a scan with the Windows Security app** + +### Run a scan with the Windows Security app + 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). @@ -85,7 +87,9 @@ This section describes how to perform some of the most common tasks when reviewi 4. Click **Run a new advanced scan** to specify different types of scans, such as a full scan. -**Review the security intelligence update version and download the latest updates in the Windows Security app** + +### Review the security intelligence update version and download the latest updates in the Windows Security app + 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). @@ -97,8 +101,7 @@ This section describes how to perform some of the most common tasks when reviewi 4. Click **Check for updates** to download new protection updates (if there are any). - -**Ensure Windows Defender Antivirus is enabled in the Windows Security app** +### Ensure Windows Defender Antivirus is enabled in the Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -114,7 +117,9 @@ This section describes how to perform some of the most common tasks when reviewi -**Add exclusions for Windows Defender Antivirus in the Windows Security app** + +### Add exclusions for Windows Defender Antivirus in the Windows Security app + 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). @@ -126,7 +131,8 @@ This section describes how to perform some of the most common tasks when reviewi 5. Click the plus icon to choose the type and set the options for each exclusion. -**Review threat detection history in the Windows Defender Security Center app** + +### Review threat detection history in the Windows Defender Security Center app 1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). @@ -136,7 +142,9 @@ This section describes how to perform some of the most common tasks when reviewi 4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**, **Allowed threats**). -**Set ransomware protection and recovery options** + +### Set ransomware protection and recovery options + 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). @@ -147,8 +155,7 @@ This section describes how to perform some of the most common tasks when reviewi 5. To set up ransomware recovery options, click **Set up** under **Ransomware data recovery** and follow the instructions for linking or setting up your OneDrive account so you can easily recover from a ransomware attack. - -## Related topics +## Related articles - [Windows Defender Antivirus](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md index 63342cb030..aa8c80886a 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md +++ b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md @@ -44,7 +44,7 @@ Application Guard has been created to target several types of systems: |Article |Description | |------|------------| -|[System requirements for Windows Defender Application Guard](reqs-wd-app-guard.md) |Specifies the pre-requisites necessary to install and use Application Guard.| +|[System requirements for Windows Defender Application Guard](reqs-wd-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.| |[Prepare and install Windows Defender Application Guard](install-wd-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| |[Configure the Group Policy settings for Windows Defender Application Guard](configure-wd-app-guard.md) |Provides info about the available Group Policy and MDM settings.| |[Testing scenarios using Windows Defender Application Guard in your business or organization](test-scenarios-wd-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.|
      Event ID: 1000 -For more information please see the following: +For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -434,7 +432,7 @@ Message: Description:
      		-Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following: +Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information, see the following:
      User: <Domain>\<User>
      Name: <Threat name>
      @@ -452,7 +450,7 @@ Windows Defender Antivirus has taken action to protect this machine from malware
    1. Quarantine: The resource was quarantined
    2. Remove: The resource was deleted
    3. Allow: The resource was allowed to execute/exist
      4. -
    4. User defined: User defined action which is normally one from this list of actions that the user has specified
      5. +
    5. User defined: User-defined action that is normally one from this list of actions that the user has specified
    6. No action: No action
    7. Block: The resource was blocked from executing
      8. @@ -486,7 +484,7 @@ Message: Description:
      		-Windows Defender Antivirus has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following: +Windows Defender Antivirus has encountered an error when taking action on malware or other potentially unwanted software. For more information, see the following:
      User: <Domain>\<User>
      Name: <Threat name>
      @@ -505,7 +503,7 @@ Windows Defender Antivirus has encountered an error when taking action on malwar
    8. Quarantine: The resource was quarantined
    9. Remove: The resource was deleted
    10. Allow: The resource was allowed to execute/exist
      11. -
    11. User defined: User defined action which is normally one from this list of actions that the user has specified
      12. +
    12. User defined: User-defined action that is normally one from this list of actions that the user has specified
    13. No action: No action
    14. Block: The resource was blocked from executing
      15. @@ -545,7 +543,7 @@ Message: Description:
      		-Windows Defender Antivirus has restored an item from quarantine. For more information please see the following: +Windows Defender Antivirus has restored an item from quarantine. For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -589,7 +587,7 @@ Message: Description:
      		-Windows Defender Antivirus has encountered an error trying to restore an item from quarantine. For more information please see the following: +Windows Defender Antivirus has encountered an error trying to restore an item from quarantine. For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -636,7 +634,7 @@ Message: Description:
      		-Windows Defender Antivirus has deleted an item from quarantine.
      For more information please see the following: +Windows Defender Antivirus has deleted an item from quarantine.
      For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -680,7 +678,7 @@ Description:
      		Windows Defender Antivirus has encountered an error trying to delete an item from quarantine. -For more information please see the following: +For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -729,7 +727,7 @@ Description:
      		Windows Defender Antivirus has removed history of malware and other potentially unwanted software.
      -
      Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
      +
      Time: The time when the event occurred, for example when the history is purged. This parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
      User: <Domain>\<User>
      		 Windows Defender Antivirus has encountered an error trying to remove history of malware and other potentially unwanted software.
      -
      Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
      +
      Time: The time when the event occurred, for example when the history is purged. This parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
      User: <Domain>\<User>
      Error Code: <Error code> Result code associated with threat status. Standard HRESULT values.
      @@ -793,7 +791,7 @@ Message: Description:
      		-Windows Defender Antivirus has detected a suspicious behavior.
      For more information please see the following: +Windows Defender Antivirus has detected a suspicious behavior.
      For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -870,7 +868,7 @@ Message: Description:
      		-Windows Defender Antivirus has detected malware or other potentially unwanted software.
      For more information please see the following: +Windows Defender Antivirus has detected malware or other potentially unwanted software.
      For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -951,7 +949,7 @@ Message: Description:
      		-Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
      For more information please see the following: +Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
      For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -999,7 +997,7 @@ UAC
    15. Quarantine: The resource was quarantined
    16. Remove: The resource was deleted
    17. Allow: The resource was allowed to execute/exist
      18. -
    18. User defined: User defined action which is normally one from this list of actions that the user has specified
      19. +
    19. User defined: User-defined action that is normally one from this list of actions that the user has specified
    20. No action: No action
    21. Block: The resource was blocked from executing
      22. @@ -1012,7 +1010,7 @@ Description of the error.
      Signature Version: <Definition version>
      Engine Version: <Antimalware Engine version>
      NOTE: -Whenever Windows Defender Antivirus, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:
        +Whenever Windows Defender Antivirus, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services that the malware might have changed:
        • Default Internet Explorer or Microsoft Edge setting
        • User Access Control settings
        • Chrome settings
          • @@ -1078,7 +1076,7 @@ Message: Description:
      		-Windows Defender Antivirus has encountered a non-critical error when taking action on malware or other potentially unwanted software.
      For more information please see the following: +Windows Defender Antivirus has encountered a non-critical error when taking action on malware or other potentially unwanted software.
      For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -1126,7 +1124,7 @@ UAC
    22. Quarantine: The resource was quarantined
    23. Remove: The resource was deleted
    24. Allow: The resource was allowed to execute/exist
      25. -
    25. User defined: User defined action which is normally one from this list of actions that the user has specified
      26. +
    26. User defined: User-defined action that is normally one from this list of actions that the user has specified
    27. No action: No action
    28. Block: The resource was blocked from executing
      29. @@ -1173,7 +1171,7 @@ Message: Description:
      		-Windows Defender Antivirus has encountered a critical error when taking action on malware or other potentially unwanted software.
      For more information please see the following: +Windows Defender Antivirus has encountered a critical error when taking action on malware or other potentially unwanted software.
      For more information, see the following:
      Name: <Threat name>
      ID: <Threat ID>
      @@ -1221,7 +1219,7 @@ UAC
    29. Quarantine: The resource was quarantined
    30. Remove: The resource was deleted
    31. Allow: The resource was allowed to execute/exist
      32. -
    32. User defined: User defined action which is normally one from this list of actions that the user has specified
      33. +
    33. User defined: User-defined action that is normally one from this list of actions that the user has specified
    34. No action: No action
    35. Block: The resource was blocked from executing
      36. @@ -1323,7 +1321,7 @@ Windows Defender Antivirus client is up and running in a healthy state.
      -
      Note This event will only be logged if the following policy is set: ThreatFileHashLogging unsigned.
      +
      Note: This event will only be logged if the following policy is set: ThreatFileHashLogging unsigned.
      -Windows Defender Antivirus configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. +Windows Defender Antivirus configuration has changed. If this is an unexpected event, you should review the settings as this may be the result of malware.
      Old value: <Old value number> Old antivirus configuration value.
      @@ -2893,7 +2891,7 @@ Run a full system scan.
      		This error indicates that an offline scan is required.
      Resolution -Run offline Windows Defender Antivirus. You can read about how to do this in the offline Windows Defender Antivirus article. +Run offline Windows Defender Antivirus. You can read about how to do this in the offline Windows Defender Antivirus article.