mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 05:47:23 +00:00
Merge branch 'master' of https://github.com/MicrosoftDocs/windows-docs-pr into dep-1909
This commit is contained in:
Greg Lindsay
commit
6ce2d7fb18
@ -241,6 +241,21 @@
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees",
|
||||
"redirect_document_id": true
|
||||
@ -256,6 +271,11 @@
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/applocker/administer-applocker-using-mdm.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm",
|
||||
"redirect_document_id": true
|
||||
@ -15337,11 +15357,6 @@
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac",
|
||||
"redirect_document_id": true
|
||||
|
||||
@ -7,7 +7,7 @@ see the [LICENSE](LICENSE) file, and grant you a license to any code in the repo
|
||||
Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation
|
||||
may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries.
|
||||
The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks.
|
||||
Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653.
|
||||
Microsoft's general trademark guidelines can be found at https://go.microsoft.com/fwlink/?LinkID=254653.
|
||||
|
||||
Privacy information can be found at https://privacy.microsoft.com/en-us/
|
||||
|
||||
|
||||
@ -243,7 +243,7 @@ In the following table, we show you the features available in both Microsoft Edg
|
||||
|-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:|
|
||||
| Print support |  |  |
|
||||
| Multi-tab support |  |  |
|
||||
| Allow/Block URL support |  <p>*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall<em>. Microsoft kiosk browser has custom policy support.</em> |  |
|
||||
| Allow/Block URL support |   |
|
||||
| Configure Home Button |  |  |
|
||||
| Set Start page(s) URL |  |  <p>*Same as Home button URL* |
|
||||
| Set New Tab page URL |  |  |
|
||||
@ -255,7 +255,7 @@ In the following table, we show you the features available in both Microsoft Edg
|
||||
| SKU availability | Windows 10 October 2018 Update<br>Professional, Enterprise, and Education | Windows 10 April 2018 Update<br>Professional, Enterprise, and Education |
|
||||
|
||||
**\*Windows Defender Firewall**<p>
|
||||
To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both. For more details, see [Windows Defender Firewall with Advanced Security Deployment](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide).
|
||||
To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both, using IP addresses. For more details, see [Windows Defender Firewall with Advanced Security Deployment Guide](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide).
|
||||
|
||||
---
|
||||
|
||||
|
||||
@ -5,12 +5,15 @@
|
||||
## [HoloLens 2 hardware](hololens2-hardware.md)
|
||||
## [Get your HoloLens 2 ready to use](hololens2-setup.md)
|
||||
## [Set up your HoloLens 2](hololens2-start.md)
|
||||
## [HoloLens 2 fit and comfort FAQ](hololens2-fit-comfort-faq.md)
|
||||
## [Supported languages for HoloLens 2](hololens2-language-support.md)
|
||||
## [Getting around HoloLens 2](hololens2-basic-usage.md)
|
||||
|
||||
# Get started with HoloLens (1st gen)
|
||||
## [HoloLens (1st gen) hardware](hololens1-hardware.md)
|
||||
## [Get your HoloLens (1st gen) ready to use](hololens1-setup.md)
|
||||
## [Set up your HoloLens (1st gen)](hololens1-start.md)
|
||||
## [HoloLens (1st gen) fit and comfort FAQ](hololens1-fit-comfort-faq.md)
|
||||
## [Install localized version of HoloLens (1st gen)](hololens1-install-localized.md)
|
||||
## [Getting around HoloLens (1st gen)](hololens1-basic-usage.md)
|
||||
|
||||
@ -52,6 +55,7 @@
|
||||
|
||||
# Update and recovery
|
||||
## [Join the Windows Insider program](hololens-insider.md)
|
||||
## [Managing HoloLens updates](hololens-updates.md)
|
||||
## [Restart, reset, or recover](hololens-recovery.md)
|
||||
## [Known issues](hololens-known-issues.md)
|
||||
## [Frequently asked questions](hololens-faq.md)
|
||||
|
||||
@ -6,10 +6,10 @@ ms.sitesec: library
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
ms.date: 10/30/2019
|
||||
ms.reviewer:
|
||||
ms.reviewer: scooley
|
||||
audience: ITPro
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
|
||||
@ -3,7 +3,7 @@ title: Find, install, and uninstall applications
|
||||
description: The Microsoft Store is your source for apps and games that work with HoloLens. Learn more about finding, installing, and uninstalling holographic apps.
|
||||
ms.assetid: cbe9aa3a-884f-4a92-bf54-8d4917bc3435
|
||||
ms.reviewer: v-miegge
|
||||
ms.date: 8/30/2019
|
||||
ms.date: 08/30/2019
|
||||
manager: jarrettr
|
||||
keywords: hololens, store, uwp, app, install
|
||||
ms.prod: hololens
|
||||
@ -11,7 +11,7 @@ ms.sitesec: library
|
||||
author: mattzmsft
|
||||
ms.author: mazeller
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
- HoloLens 2
|
||||
@ -33,7 +33,7 @@ Open the Microsoft Store from the **Start** menu. Then browse for apps and games
|
||||
|
||||
## Install apps
|
||||
|
||||
To download apps, you'll need to be signed in with a Microsoft account. To buy them, you'll need a payment method associated with the Microsoft account you use on your HoloLens. To set up a payment method, go to [account.microsoft.com](http://account.microsoft.com/) and select **Payment & billing** > **Payment options** > **Add a payment option**.
|
||||
To download apps, you'll need to be signed in with a Microsoft account. To buy them, you'll need a payment method associated with the Microsoft account you use on your HoloLens. To set up a payment method, go to [account.microsoft.com](https://account.microsoft.com/) and select **Payment & billing** > **Payment options** > **Add a payment option**.
|
||||
|
||||
1. To open the [**Start** menu](holographic-home.md), perform a [bloom](hololens1-basic-usage.md) gesture or tap your wrist.
|
||||
2. Select the Store app and then tap to place this tile into your world.
|
||||
|
||||
@ -7,8 +7,8 @@ ms.sitesec: library
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 9/13/2019
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/13/2019
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
@ -34,7 +34,7 @@ Classes of Bluetooth devices supported by HoloLens (1st gen):
|
||||
- HoloLens (1st gen) clicker
|
||||
|
||||
> [!NOTE]
|
||||
> Other types of Bluetooth devices, such as speakers, headsets, smartphones, and game pads, may appear as available in HoloLens settings, but aren't supported on HoloLens (1st gen). [Learn more](http://go.microsoft.com/fwlink/p/?LinkId=746660).
|
||||
> Other types of Bluetooth devices, such as speakers, headsets, smartphones, and game pads, may appear as available in HoloLens settings, but aren't supported on HoloLens (1st gen). [Learn more](https://go.microsoft.com/fwlink/p/?LinkId=746660).
|
||||
|
||||
### Pair a Bluetooth keyboard or mouse
|
||||
|
||||
|
||||
@ -9,9 +9,9 @@ ms.date: 8/29/2019
|
||||
ms.prod: hololens
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
appliesto:
|
||||
- HoloLens 1
|
||||
- HoloLens (1st gen)
|
||||
- HoloLens 2
|
||||
---
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ manager: v-miegge
|
||||
ms.topic: article
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
- HoloLens 2
|
||||
|
||||
@ -9,7 +9,7 @@ author: mattzmsft
|
||||
ms.author: mazeller
|
||||
ms.date: 08/30/2019
|
||||
ms.topic: article
|
||||
ms.localizationpriority:
|
||||
ms.localizationpriority: high
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
|
||||
@ -9,7 +9,7 @@ keywords: hololens, Windows Mixed Reality, design, spatial mapping, HoloLens, su
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
appliesto:
|
||||
- HoloLens 1 (1st gen)
|
||||
- HoloLens 2
|
||||
|
||||
@ -8,7 +8,7 @@ manager: jarrettr
|
||||
audience: Admin
|
||||
ms.topic: article
|
||||
ms.prod: hololens
|
||||
ms.localizationpriority: Medium
|
||||
ms.localizationpriority: high
|
||||
ms.sitesec: library
|
||||
---
|
||||
|
||||
|
||||
@ -1,23 +1,76 @@
|
||||
---
|
||||
title: Manage updates to HoloLens (HoloLens)
|
||||
title: Managing updates to HoloLens
|
||||
description: Administrators can use mobile device management to manage updates to HoloLens devices.
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 04/30/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.localizationpriority: high
|
||||
ms.date: 11/7/2019
|
||||
ms.reviewer: jarrettr
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
- HoloLens 2
|
||||
---
|
||||
|
||||
# Manage updates to HoloLens
|
||||
# Managing HoloLens updates
|
||||
|
||||
HoloLens uses Windows Update, just like other Windows 10 devices. When an update is available, it will be automatically downloaded and installed the next time your device is plugged in and connected to the Internet.
|
||||
|
||||
This article will walk through all of the way to manage updates on HoloLens.
|
||||
|
||||
## Manually check for updates
|
||||
|
||||
While HoloLens periodically checks for system updates so you don't have to, there may be circumstances in which you want to manually check.
|
||||
|
||||
To manually check for updates, go to **Settings** > **Update & Security** > **Check for updates**. If the Settings app says your device is up to date, you have all the updates that are currently available.
|
||||
|
||||
## Go back to a previous version (HoloLens 2)
|
||||
|
||||
In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Advanced Recovery Companion to reset your HoloLens to the earlier version.
|
||||
|
||||
> [!NOTE]
|
||||
>HoloLens devices must be [upgraded to Windows Holographic for Business](hololens1-upgrade-enterprise.md) to manage updates.
|
||||
> Going back to an earlier version deletes your personal files and settings.
|
||||
|
||||
For a complete list of Update policies, see [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business).
|
||||
To go back to a previous version of HoloLens 2, follow these steps:
|
||||
|
||||
1. Make sure that you don't have any phones or Windows devices plugged in to your PC.
|
||||
1. On your PC, download the [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from the Microsoft Store.
|
||||
1. Download the [most recent HoloLens 2 release](https://aka.ms/hololens2download).
|
||||
1. When you have finished these downloads, open **File explorer** > **Downloads**. Right-click the zipped folder that you just downloaded, and select **Extract all** > **Extract** to unzip it.
|
||||
1. Connect your HoloLens to your PC using a USB-A to USB-C cable . (Even if you've been using other cables to connect your HoloLens, this one works best.)
|
||||
1. The Advanced Recovery Companion automatically detects your HoloLens. Select the **Microsoft HoloLens** tile.
|
||||
1. On the next screen, select **Manual package selection** and then select the installation file contained in the folder that you unzipped in step 4. (Look for a file with the .ffu extension.)
|
||||
1. Select **Install software**, and follow the instructions.
|
||||
|
||||
## Go back to a previous version (HoloLens (1st gen))
|
||||
|
||||
In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Windows Device Recovery Tool to reset your HoloLens to the earlier version.
|
||||
|
||||
> [!NOTE]
|
||||
> Going back to an earlier version deletes your personal files and settings.
|
||||
|
||||
To go back to a previous version of HoloLens (1st gen), follow these steps:
|
||||
|
||||
1. Make sure that you don't have any phones or Windows devices plugged in to your PC.
|
||||
1. On your PC, download the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379).
|
||||
1. Download the [HoloLens Anniversary Update recovery package](https://aka.ms/hololensrecovery).
|
||||
1. When the downloads finish, open **File explorer** > **Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all** > **Extract** to unzip it.
|
||||
1. Connect your HoloLens to your PC using the micro-USB cable that it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.)
|
||||
1. The WDRT will automatically detect your HoloLens. Select the **Microsoft HoloLens** tile.
|
||||
1. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the .ffu extension.)
|
||||
1. Select **Install software**, and follow the instructions.
|
||||
|
||||
> [!NOTE]
|
||||
> If the WDRT doesn't detect your HoloLens, try restarting your PC. If that doesn't work, select **My device was not detected**, select **Microsoft HoloLens**, and then follow the instructions.
|
||||
|
||||
# Use policies to manage updates to HoloLens
|
||||
|
||||
>[!NOTE]
|
||||
>HoloLens (1st gen) devices must be [upgraded to Windows Holographic for Business](hololens1-upgrade-enterprise.md) to manage updates.
|
||||
|
||||
To configure how and when updates are applied, use the following policies:
|
||||
|
||||
@ -37,7 +90,8 @@ For devices on Windows 10, version 1607 only: You can use the following update p
|
||||
- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval)
|
||||
- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl)
|
||||
|
||||
## Related topics
|
||||
For more information about using policies to manage HoloLens, see the following articles:
|
||||
|
||||
- [Policies supported by HoloLens 2](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#policies-supported-by-hololens-2)
|
||||
- [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business)
|
||||
- [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure)
|
||||
|
||||
@ -10,7 +10,7 @@ ms.sitesec: library
|
||||
author: v-miegge
|
||||
ms.author: v-miegge
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.localizationpriority: high
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
---
|
||||
|
||||
64
devices/hololens/hololens1-fit-comfort-faq.md
Normal file
64
devices/hololens/hololens1-fit-comfort-faq.md
Normal file
@ -0,0 +1,64 @@
|
||||
---
|
||||
title: HoloLens (1st gen) fit and comfort frequently asked questions
|
||||
description: Answers to frequently asked questions about how to fit your HoloLens (1st gen).
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
ms.topic: article
|
||||
ms.localizationpriority: high
|
||||
ms.date: 10/09/2019
|
||||
ms.reviewer: jarrettr
|
||||
audience: ITPro
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens (1st gen)
|
||||
---
|
||||
|
||||
# HoloLens (1st gen) fit and comfort frequently asked questions
|
||||
|
||||
Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
|
||||
|
||||
For step-by-step instructions and a video about putting on and adjusting your device, see [Get your HoloLens (1st gen) ready to use](hololens1-setup.md).
|
||||
|
||||
> [!NOTE]
|
||||
> The fit and comfort tips in this topic are meant only as general guidance—they don't replace any laws or regulations, or your good judgment when using HoloLens. Stay safe, and have fun!
|
||||
|
||||
Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
|
||||
|
||||
## I'm experiencing discomfort when I use my device. What should I do?
|
||||
|
||||
If you experience discomfort, take a break until you feel better. Try sitting in a well-lit room and relaxing for a bit. The next time your use your HoloLens, try using it for a shorter period of time at first.
|
||||
|
||||
For more information, see [Health and safety on HoloLens](https://go.microsoft.com/fwlink/p/?LinkId=746661).
|
||||
|
||||
## I can't see the whole holographic frame, or my holograms are cut off
|
||||
|
||||
To see the top edge of the holographic frame, move the device so it sits higher on your head, or angle the headband up slightly in front. To see the bottom edge, move the device to sit lower on your head, or angle the headband down slightly in front. If the left or right edge of the view frame isn't visible, make sure the HoloLens visor is centered on your forehead.
|
||||
|
||||
## I need to look up or down to see holograms
|
||||
|
||||
Try adjusting the position of your device visor so the holographic frame matches your natural gaze. Here's how:
|
||||
|
||||
- **If you need to look up to see holograms**. First, shift the back of the headband a bit higher on your head. Then use one hand to hold the headband in place and the other to gently rotate the visor so you have a good view of the holographic frame.
|
||||
- **If you need to look down to see holograms**. First, shift the back of the headband a bit lower on your head. Then place your thumbs under the device arms and your index fingers on top of the headband, and gently squeeze with your thumbs to rotate the visor so you have a good view of the holographic frame.
|
||||
|
||||
## The device slides down when I'm using it, or I need to make the headband too tight to keep it secure
|
||||
|
||||
The overhead strap can help keep your HoloLens secure on your head, particularly if you're moving around a lot. The strap may also let you loosen the headband a bit. [Learn how to use it](hololens1-setup.md#adjust-fit).
|
||||
|
||||
You can also experiment with the positioning of the headband—depending on your head size and shape, you may need to slide it up or down to reposition it on your forehead.
|
||||
|
||||
## My HoloLens feels heavy on my nose
|
||||
|
||||
If your HoloLens is adjusted correctly, the nose pad should rest lightly on your nose. If it feels heavy on your nose, try rotating the visor up or adjusting the angle of the headband. You can also slide the device visor out—grasp the device arms just behind the visor and pull forward gently.
|
||||
|
||||
## How can I adjust HoloLens to fit with my glasses?
|
||||
|
||||
The device visor can slide in and out to accommodate eyewear. Grasp the device arms just behind the visor and pull forward gently to adjust it.
|
||||
|
||||
## My arm gets tired when I use gestures. What can I do?
|
||||
|
||||
When using gestures, there's no need to extend your arm out far from your body. Keep it closer to your side, where it's more comfortable and will get less tired. [Learn more about gestures](hololens1-basic-usage.md#use-hololens-with-your-hands).
|
||||
|
||||
And be sure to try out [voice commands](hololens-cortana.md) and the [HoloLens clicker](hololens1-clicker.md).
|
||||
@ -15,7 +15,7 @@ appliesto:
|
||||
- HoloLens (1st gen)
|
||||
---
|
||||
|
||||
# HoloLens (1st Gen) hardware
|
||||
# HoloLens (1st gen) hardware
|
||||
|
||||
|
||||
|
||||
@ -48,6 +48,14 @@ The HoloLens box contains the following items:
|
||||
>[!TIP]
|
||||
>The [clicker](hololens1-clicker.md) ships with HoloLens (1st Gen), in a separate box.
|
||||
|
||||
### Power Supply details
|
||||
|
||||
The power supply and the USB cable that come with the device are the best supported mechanism for charging. The power supply is an 18W charger. It supplies 9V at 2A.
|
||||
|
||||
Charging rate and speed may vary depending on the environment in which the device is running.
|
||||
|
||||
In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger.
|
||||
|
||||
## Device specifications
|
||||
|
||||
### Display
|
||||
|
||||
@ -7,7 +7,7 @@ author: JesseMcCulloch
|
||||
ms.author: jemccull
|
||||
ms.topic: article
|
||||
ms.localizationpriority: high
|
||||
ms.date: 8/12/19
|
||||
ms.date: 8/12/2019
|
||||
ms.reviewer:
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
@ -29,6 +29,10 @@ When your HoloLens is on, the battery indicator shows the battery level in incre
|
||||
> [!TIP]
|
||||
> To get an estimate of your current battery level, say "Hey Cortana, how much battery do I have left?"
|
||||
|
||||
The power supply and USB cable that come with the device are the best way to charge your HoloLens (1st gen). The power supply provides 18W of power (9V 2A).
|
||||
|
||||
Charging rate and speed may vary depending on the environment in which the device is running.
|
||||
|
||||
## Adjust fit
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/be3cb527-f2f1-4f85-b4f7-a34fbaba980d]
|
||||
|
||||
60
devices/hololens/hololens2-fit-comfort-faq.md
Normal file
60
devices/hololens/hololens2-fit-comfort-faq.md
Normal file
@ -0,0 +1,60 @@
|
||||
---
|
||||
title: HoloLens 2 fit and comfort FAQ
|
||||
description: Answers to frequently asked questions about how to fit your HoloLens 2.
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
ms.topic: article
|
||||
audience: ItPro
|
||||
ms.localizationpriority: high
|
||||
ms.date: 11/07/2019
|
||||
ms.reviewer: jarrettr
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens 2
|
||||
---
|
||||
|
||||
# HoloLens 2 fit and comfort frequently asked questions
|
||||
|
||||
Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
|
||||
|
||||
For step-by-step instructions and a video about putting on and adjusting your device, see [Get your HoloLens 2 ready to use](hololens2-setup.md).
|
||||
|
||||
> [!NOTE]
|
||||
> The fit and comfort tips in this topic are meant only as general guidance—they don't replace any laws or regulations, or your good judgment when using HoloLens. Stay safe, and have fun!
|
||||
|
||||
Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
|
||||
|
||||
## I'm experiencing discomfort when I use my device. What should I do?
|
||||
|
||||
If you experience discomfort, take a break until you feel better. Try sitting in a well-lit room and relaxing for a bit. The next time your use your HoloLens, try using it for a shorter period of time at first.
|
||||
|
||||
For more information, see [Health and safety on HoloLens](https://go.microsoft.com/fwlink/p/?LinkId=746661).
|
||||
|
||||
## I can't see the whole holographic frame, or my holograms are cut off
|
||||
|
||||
To see the top edge of the holographic frame, move the device so it sits higher on your head, or angle the headband up slightly in front. To see the bottom edge, move the device to sit lower on your head, or angle the headband down slightly in front. If the left or right edge of the view frame isn't visible, make sure the HoloLens visor is centered on your forehead.
|
||||
|
||||
## I need to look up or down to see holograms
|
||||
|
||||
Try adjusting the position of your device visor so the holographic frame matches your natural gaze. Here's how:
|
||||
|
||||
- **If you need to look up to see holograms**. First, shift the back of the headband a bit higher on your head. Then use one hand to hold the headband in place and the other to gently rotate the visor so you have a good view of the holographic frame.
|
||||
- **If you need to look down to see holograms**. First, shift the back of the headband a bit lower on your head. Then place your thumbs under the device arms and your index fingers on top of the headband, and gently squeeze with your thumbs to rotate the visor so you have a good view of the holographic frame.
|
||||
|
||||
## The device slides down when I'm using it, or I need to make the headband too tight to keep it secure
|
||||
|
||||
The overhead strap can help keep your HoloLens secure on your head, particularly if you're moving around a lot. The strap may also let you loosen the headband a bit. [Learn how to use it](hololens2-setup.md#adjust-fit).
|
||||
|
||||
You can also experiment with the positioning of the headband—depending on your head size and shape, you may need to slide it up or down to reposition it on your forehead.
|
||||
|
||||
## How can I adjust HoloLens to fit with my glasses?
|
||||
|
||||
To accommodate eyewear, you can tilt the visor.
|
||||
|
||||
## My arm gets tired when I use gestures. What can I do?
|
||||
|
||||
When using gestures, there's no need to extend your arm out far from your body. Keep it closer to your side, where it's more comfortable and will get less tired. You can also use hand rays to interact with holograms without raising your arms [Learn more about gestures and hand rays](hololens2-basic-usage.md#the-hand-tracking-frame).
|
||||
|
||||
And be sure to try out [voice commands](hololens-cortana.md).
|
||||
@ -35,6 +35,14 @@ Microsoft HoloLens 2 is an untethered holographic computer. It refines the holo
|
||||
- **Power supply**. Plugs into a power outlet.
|
||||
- **Microfiber cloth**. Use to clean your HoloLens visor.
|
||||
|
||||
### Power Supply details
|
||||
|
||||
The power supply and the USB cable that come with the device are the best supported mechanism for charging. The power supply is an 18W charger. It's supplies 9V at 2A.
|
||||
|
||||
Charging rate and speed may vary depending on the environment in which the device is running.
|
||||
|
||||
In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger.
|
||||
|
||||
## Device specifications
|
||||
|
||||
### Display
|
||||
@ -83,6 +91,7 @@ Microsoft HoloLens 2 is an untethered holographic computer. It refines the holo
|
||||
| Battery technology | [Lithium batteries](https://www.microsoft.com/download/details.aspx?id=43388) |
|
||||
| Charging behavior | Fully functional when charging |
|
||||
| Cooling type | Passively cooled (no fans) |
|
||||
| Power draw | In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger. |
|
||||
|
||||
### Fit
|
||||
|
||||
|
||||
45
devices/hololens/hololens2-language-support.md
Normal file
45
devices/hololens/hololens2-language-support.md
Normal file
@ -0,0 +1,45 @@
|
||||
---
|
||||
title: Supported languages for HoloLens 2
|
||||
description:
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 9/12/2019
|
||||
audience: ITPro
|
||||
ms.reviewer: jarrettr
|
||||
manager: jarrettr
|
||||
appliesto:
|
||||
- HoloLens 2
|
||||
---
|
||||
|
||||
# Supported languages for HoloLens 2
|
||||
|
||||
HoloLens 2 supports the following languages. This support includes voice commands and dictation features.
|
||||
|
||||
- Chinese Simplified (China)
|
||||
- English (Australia)
|
||||
- English (Canada)
|
||||
- English (Great Britain)
|
||||
- English (United States)
|
||||
- French (Canada)
|
||||
- French (France)
|
||||
- German (Germany)
|
||||
- Italian (Italy)
|
||||
- Japanese (Japan)
|
||||
- Spanish (Mexico)
|
||||
- Spanish (Spain)
|
||||
|
||||
Windows Mixed Reality is also available in the following languages. However, this support does not include speech commands or dictation features.
|
||||
|
||||
- Chinese Traditional (Taiwan and Hong Kong)
|
||||
- Dutch (Netherlands)
|
||||
- Korean (Korea)
|
||||
- Changing language or keyboard
|
||||
|
||||
> [!NOTE]
|
||||
> Your speech and dictation language depends on the Windows display language.
|
||||
>
|
||||
To change the Windows display language, region, or keyboard settings, use the start gesture to open the **Start** menu, and then select **Settings** > **Time and Language** > **Language**.
|
||||
@ -21,7 +21,9 @@ The procedures below will help you set up a HoloLens 2 for the first time.
|
||||
|
||||
## Charge your HoloLens
|
||||
|
||||
Connect the power supply to the charging port by using the USB-C cable (included). Plug the power supply into a power outlet.
|
||||
Connect the power supply to the charging port by using the USB-C cable (included). Plug the power supply into a power outlet. The power supply and USB-C-to-C cable that come with the device are the best way to charge your HoloLens 2. The charger supplies 18W of power (9V at 2A).
|
||||
|
||||
Charging rate and speed may vary depending on the environment in which the device is running.
|
||||
|
||||
- When the device is charging, the battery indicator lights up to indicate the current level of charge. The last light will fade in and out to indicate active charging.
|
||||
- When your HoloLens is on, the battery indicator displays the battery level in increments.
|
||||
@ -102,6 +104,7 @@ Not sure what the indicator lights on your HoloLens mean? Want to know how HoloL
|
||||
| - | - | - |
|
||||
| You press the Power button. | One light flashes five times, then turns off. | The HoloLens battery is critically low. Charge your HoloLens. |
|
||||
| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. [Reinstall the operating system](hololens-recovery.md) to recover your device. |
|
||||
| You press the Power button. | The 1st, 3rd, and 5th lights flash together continually. | HoloLens may have a hardware failure. To be sure, [reinstall the OS](hololens-recovery.md#hololens-2), and try again. After reinstalling the OS, if the light-flash pattern persists, contact [support](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb). |
|
||||
|
||||
## Safety and comfort
|
||||
|
||||
|
||||
@ -99,8 +99,8 @@ There are three ways to mount your Surface Hub:
|
||||
|
||||
For specifications on available mounts for the original Surface Hub, see the following:
|
||||
|
||||
- [Surface Hub Mounts and Stands Datasheet](http://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf)
|
||||
- [Surface Hub Stand and Wall Mount Specifications](http://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf)
|
||||
- [Surface Hub Mounts and Stands Datasheet](https://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf)
|
||||
- [Surface Hub Stand and Wall Mount Specifications](https://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf)
|
||||
|
||||
## The Connect experience
|
||||
|
||||
|
||||
@ -47,8 +47,14 @@ You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firm
|
||||
|
||||
- **Msiexec.exe /i <name of msi> /quiet /norestart**
|
||||
|
||||
> [!NOTE]
|
||||
> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]"
|
||||
|
||||
For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you want to keep your Surface Dock updated using any other method, refer to [Update your Surface Dock](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) for details.
|
||||
|
||||
## Intune deployment
|
||||
You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management).
|
||||
|
||||
@ -84,8 +90,8 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
|
||||
|
||||
| Log | Location | Notes |
|
||||
| -------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Surface Dock Firmware Update log | /l*v %windir%\logs\Applications\SurfaceDockFWI.log | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
|
||||
| Windows Device Install log | %windir%\inf\ setupapi.dev.log | For more information about using Device Install Log, refer [to SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. |
|
||||
| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
|
||||
| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-). |
|
||||
|
||||
|
||||
**Table 2. Event log IDs for Surface Dock Firmware Update**
|
||||
@ -97,6 +103,10 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
|
||||
| 2003 | Dock firmware update failed to get firmware version. |
|
||||
| 2004 | Querying the firmware version. |
|
||||
| 2005 | Dock firmware failed to start update. |
|
||||
| 2006 | Failed to send offer/payload pairs. |
|
||||
| 2007 | Firmware update finished. |
|
||||
| 2008 | BEGIN dock telemetry. |
|
||||
| 2011 | END dock telemetry. |
|
||||
|
||||
## Troubleshooting tips
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 06/16/2016
|
||||
After you have properly deployed the Microsoft Application Virtualization (App-V) 5.0 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application.
|
||||
|
||||
**Note**
|
||||
For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
|
||||
For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -110,7 +110,7 @@ Choose a server that meets the hardware configuration as explained in the [MBAM
|
||||
.NET Framework Environment<br />
|
||||
Configuration APIs
|
||||
|
||||
For the self-service portal to work, you should also [download and install ASP.NET MVC 4.0](http://go.microsoft.com/fwlink/?linkid=392271).
|
||||
For the self-service portal to work, you should also [download and install ASP.NET MVC 4.0](https://go.microsoft.com/fwlink/?linkid=392271).
|
||||
|
||||
The next step is to create the required MBAM users and groups in Active Directory.
|
||||
|
||||
|
||||
@ -82,7 +82,8 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC
|
||||
- Password
|
||||
- Windows Hello for Business, with or without an MDM subscription.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure Active Directory-joined PCs, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -2699,8 +2699,8 @@ Additional lists:
|
||||
## CSP DDF files download
|
||||
|
||||
You can download the DDF files for various CSPs from the links below:
|
||||
- [Download all the DDF files for Windows 10, version 1903](http://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip)
|
||||
- [Download all the DDF files for Windows 10, version 1809](http://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip)
|
||||
- [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip)
|
||||
- [Download all the DDF files for Windows 10, version 1809](https://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip)
|
||||
- [Download all the DDF files for Windows 10, version 1803](https://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip)
|
||||
- [Download all the DDF files for Windows 10, version 1709](https://download.microsoft.com/download/9/7/C/97C6CF99-F75C-475E-AF18-845F8CECCFA4/Windows10_1709_DDF_download.zip)
|
||||
- [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
|
||||
|
||||
@ -20,10 +20,10 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy*
|
||||
|
||||
You can view various Policy DDF files by clicking the following links:
|
||||
|
||||
- [View the Policy DDF file for Windows 10, version 1903](http://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1809](http://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1803 release C](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
|
||||
- [View the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml)
|
||||
|
||||
@ -27,6 +27,12 @@ manager: dansimp
|
||||
|
||||
Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies.
|
||||
|
||||
NOTE: Starting from the following Windows 10 version Replace command is supported
|
||||
- Windows 10, version 1903 with KB4512941 and KB4517211 installed
|
||||
- Windows 10, version 1809 with KB4512534 and KB installed
|
||||
- Windows 10, version 1803 with KB4512509 and KB installed
|
||||
- Windows 10, version 1709 with KB4516071 and KB installed
|
||||
|
||||
When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations:
|
||||
|
||||
- Software\Policies\Microsoft\Office\
|
||||
@ -48,6 +54,8 @@ When the ADMX policies are imported, the registry keys to which each policy is w
|
||||
- software\microsoft\exchange\
|
||||
- software\policies\microsoft\vba\security\
|
||||
- software\microsoft\onedrive
|
||||
- software\Microsoft\Edge
|
||||
- Software\Microsoft\EdgeUpdate\
|
||||
|
||||
> [!Warning]
|
||||
> Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined.
|
||||
|
||||
@ -22,9 +22,9 @@ ms.author: dansimp
|
||||
|
||||
A Stop error is displayed as a blue screen that contains the name of the faulty driver, such as any of the following example drivers:
|
||||
|
||||
- atikmpag.sys
|
||||
- igdkmd64.sys
|
||||
- nvlddmkm.sys
|
||||
- `atikmpag.sys`
|
||||
- `igdkmd64.sys`
|
||||
- `nvlddmkm.sys`
|
||||
|
||||
There is no simple explanation for the cause of Stop errors (also known as blue screen errors or bug check errors). Many different factors can be involved. However, various studies indicate that Stop errors usually are not caused by Microsoft Windows components. Instead, these errors are generally related to malfunctioning hardware drivers or drivers that are installed by third-party software. This includes video cards, wireless network cards, security programs, and so on.
|
||||
|
||||
@ -61,7 +61,7 @@ To troubleshoot Stop error messages, follow these general steps:
|
||||
|
||||
4. Run [Microsoft Safety Scanner](http://www.microsoft.com/security/scanner/en-us/default.aspx) or any other virus detection program that includes checks of the Master Boot Record for infections.
|
||||
|
||||
5. Make sure that there is sufficient free space on the hard disk. The exact requirement varies, but we recommend 10 to 15 percent free disk space.
|
||||
5. Make sure that there is sufficient free space on the hard disk. The exact requirement varies, but we recommend 10–15 percent free disk space.
|
||||
|
||||
6. Contact the respective hardware or software vendor to update the drivers and applications in the following scenarios:
|
||||
|
||||
@ -90,11 +90,11 @@ To configure the system for memory dump files, follow these steps:
|
||||
5. Stop and disable Automatic System Restart Services (ASR) to prevent dump files from being written.
|
||||
6. If the server is virtualized, disable auto reboot after the memory dump file is created. This lets you take a snapshot of the server in-state and also if the problem recurs.
|
||||
|
||||
The memory dump file is saved at the following locations.
|
||||
The memory dump file is saved at the following locations:
|
||||
|
||||
| Dump file type | Location |
|
||||
|----------------|----------|
|
||||
|(none) | %SystemRoot%\MEMORY.DMP (inactive, or greyed out) |
|
||||
|(none) | %SystemRoot%\MEMORY.DMP (inactive, or grayed out) |
|
||||
|Small memory dump file (256 kb) | %SystemRoot%\Minidump |
|
||||
|Kernel memory dump file | %SystemRoot%\MEMORY.DMP |
|
||||
| Complete memory dump file | %SystemRoot%\MEMORY.DMP |
|
||||
@ -118,7 +118,7 @@ More information on how to use Dumpchk.exe to check your dump files:
|
||||
|
||||
### Memory dump analysis
|
||||
|
||||
Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in a variety of symptoms.
|
||||
Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in various symptoms.
|
||||
|
||||
When a Stop error occurs, you should first isolate the problematic components, and then try to cause them to trigger the Stop error again. If you can replicate the problem, you can usually determine the cause.
|
||||
|
||||
@ -138,8 +138,8 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols
|
||||
|
||||
1. Verify that the computer is set up to generate a complete memory dump file when a crash occurs. See the steps [here](troubleshoot-windows-freeze.md#method-1-memory-dump) for more information.
|
||||
2. Locate the memory.dmp file in your Windows directory on the computer that is crashing, and copy that file to another computer.
|
||||
3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk).
|
||||
4. Start the install and choose **Debugging Tools for Windows**. This will install the WinDbg tool.
|
||||
3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk).
|
||||
4. Start the install and choose **Debugging Tools for Windows**. This installs the WinDbg tool.
|
||||
5. Open the WinDbg tool and set the symbol path by clicking **File** and then clicking **Symbol File Path**.<br>
|
||||
a. If the computer is connected to the Internet, enter the [Microsoft public symbol server](https://docs.microsoft.com/windows-hardware/drivers/debugger/microsoft-public-symbols) (https://msdl.microsoft.com/download/symbols) and click **OK**. This is the recommended method.<br>
|
||||
b. If the computer is not connected to the Internet, you must specify a local [symbol path](https://docs.microsoft.com/windows-hardware/drivers/debugger/symbol-path).
|
||||
@ -149,7 +149,7 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols
|
||||
8. A detailed bugcheck analysis will appear. See the example below.
|
||||
|
||||
9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL.
|
||||
10. See [Using the !analyze Exension](https://docs.microsoft.com/windows-hardware/drivers/debugger/using-the--analyze-extension) for details about how to interpret the STACK_TEXT output.
|
||||
10. See [Using the !analyze Extension](https://docs.microsoft.com/windows-hardware/drivers/debugger/using-the--analyze-extension) for details about how to interpret the STACK_TEXT output.
|
||||
|
||||
There are many possible causes of a bugcheck and each case is unique. In the example provided above, the important lines that can be identified from the STACK_TEXT are 20, 21, and 22:
|
||||
|
||||
@ -213,7 +213,7 @@ Use the following guidelines when you use Driver Verifier:
|
||||
|
||||
- Test any “suspicious” drivers (drivers that were recently updated or that are known to be problematic).
|
||||
- If you continue to experience non-analyzable crashes, try enabling verification on all third-party and unsigned drivers.
|
||||
- Enable concurrent verification on groups of 10 to 20 drivers.
|
||||
- Enable concurrent verification on groups of 10–20 drivers.
|
||||
- Additionally, if the computer cannot boot into the desktop because of Driver Verifier, you can disable the tool by starting in Safe mode. This is because the tool cannot run in Safe mode.
|
||||
|
||||
For more information, see [Driver Verifier](https://docs.microsoft.com/windows-hardware/drivers/devtest/driver-verifier).
|
||||
@ -233,13 +233,13 @@ SYSTEM_SERVICE_EXCEPTION <br>Stop error code c000021a {Fatal System Error} The W
|
||||
NTFS_FILE_SYSTEM <br>Stop error code 0x000000024 | This Stop error is commonly caused by corruption in the NTFS file system or bad blocks (sectors) on the hard disk. Corrupted drivers for hard disks (SATA or IDE) can also adversely affect the system's ability to read and write to disk. Run any hardware diagnostics that are provided by the manufacturer of the storage subsystem. Use the scan disk tool to verify that there are no file system errors. To do this, right-click the drive that you want to scan, select Properties, select Tools, and then select the Check now button.We also suggest that you update the NTFS file system driver (Ntfs.sys), and apply the latest cumulative updates for the current operating system that is experiencing the problem.
|
||||
KMODE_EXCEPTION_NOT_HANDLED <br>Stop error code 0x0000001E | If a driver is identified in the Stop error message, disable or remove that driver. Disable or remove any drivers or services that were recently added. <br><br>If the error occurs during the startup sequence, and the system partition is formatted by using the NTFS file system, you might be able to use Safe mode to disable the driver in Device Manager. To do this, follow these steps:<br><br>Go to **Settings > Update & security > Recovery**. Under **Advanced startup**, select **Restart now**. After your PC restarts to the **Choose an option** screen, select **Troubleshoot > Advanced options > Startup Settings > Restart**. After the computer restarts, you'll see a list of options. Press **4** or **F4** to start the computer in Safe mode. Or, if you intend to use the Internet while in Safe mode, press **5** or **F5** for the Safe Mode with Networking option.
|
||||
DPC_WATCHDOG_VIOLATION <br>Stop error code 0x00000133 | This Stop error code is caused by a faulty driver that does not complete its work within the allotted time frame in certain conditions. To enable us to help mitigate this error, collect the memory dump file from the system, and then use the Windows Debugger to find the faulty driver. If a driver is identified in the Stop error message, disable the driver to isolate the problem. Check with the manufacturer for driver updates. Check the system log in Event Viewer for additional error messages that might help identify the device or driver that is causing Stop error 0x133. Verify that any new hardware that is installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications. If Windows Debugger is installed, and you have access to public symbols, you can load the c:\windows\memory.dmp file into the Debugger, and then refer to [Determining the source of Bug Check 0x133 (DPC_WATCHDOG_VIOLATION) errors on Windows Server 2012](https://blogs.msdn.microsoft.com/ntdebugging/2012/12/07/determining-the-source-of-bug-check-0x133-dpc_watchdog_violation-errors-on-windows-server-2012/) to find the problematic driver from the memory dump.
|
||||
USER_MODE_HEALTH_MONITOR <br>Stop error code 0x0000009E | This Stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Therefore, Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.<br>This Stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe.Check the event logs for any storage failures to identify the failing process.Try to update the component or process that is indicated in the event logs. You should see the following event recorded:<br>Event ID: 4870<br>Source: Microsoft-Windows-FailoverClustering<br>Description: User mode health monitoring has detected that the system is not being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID ‘%1’, for ‘%2’ seconds. Recovery action will be taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang. <br />For more information, see ["Why is my Failover Clustering node blue screening with a Stop 0x0000009E?"](https://blogs.technet.microsoft.com/askcore/2009/06/12/why-is-my-failover-clustering-node-blue-screening-with-a-stop-0x0000009e) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw).
|
||||
USER_MODE_HEALTH_MONITOR <br>Stop error code 0x0000009E | This Stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Therefore, Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.<br>This Stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe.Check the event logs for any storage failures to identify the failing process. Try to update the component or process that is indicated in the event logs. You should see the following event recorded:<br>Event ID: 4870<br>Source: Microsoft-Windows-FailoverClustering<br>Description: User mode health monitoring has detected that the system is not being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID ‘%1’, for ‘%2’ seconds. Recovery action is taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang. <br />For more information, see ["Why is my Failover Clustering node blue screening with a Stop 0x0000009E?"](https://blogs.technet.microsoft.com/askcore/2009/06/12/why-is-my-failover-clustering-node-blue-screening-with-a-stop-0x0000009e) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw).
|
||||
|
||||
## Debugging examples
|
||||
|
||||
### Example 1
|
||||
|
||||
This bugcheck is caused by a driver hang during upgrade, resulting in a bugcheck D1 in NDIS.sys (a Microsoft driver). The **IMAGE_NAME** will tell you the faulting driver, but since this is Microsoft driver it cannot be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again.
|
||||
This bugcheck is caused by a driver hang during upgrade, resulting in a bugcheck D1 in NDIS.sys (a Microsoft driver). The **IMAGE_NAME** tells you the faulting driver, but since this is Microsoft driver it cannot be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again.
|
||||
|
||||
```
|
||||
2: kd> !analyze -v
|
||||
@ -391,7 +391,7 @@ ANALYSIS_SESSION_ELAPSED_TIME: 8377
|
||||
ANALYSIS_SOURCE: KM
|
||||
FAILURE_ID_HASH_STRING: km:av_ndis!ndisqueueioworkitem
|
||||
FAILURE_ID_HASH: {10686423-afa1-4852-ad1b-9324ac44ac96}
|
||||
FAILURE_ID_REPORT_LINK: http://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96
|
||||
FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96
|
||||
Followup: ndiscore
|
||||
---------
|
||||
```
|
||||
@ -564,7 +564,7 @@ ANALYSIS_SESSION_ELAPSED_TIME: 162bd
|
||||
ANALYSIS_SOURCE: KM
|
||||
FAILURE_ID_HASH_STRING: km:av_r_invalid_wwanusbmp!unknown_function
|
||||
FAILURE_ID_HASH: {31e4d053-0758-e43a-06a7-55f69b072cb3}
|
||||
FAILURE_ID_REPORT_LINK: http://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3
|
||||
FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3
|
||||
|
||||
Followup: MachineOwner
|
||||
---------
|
||||
|
||||
@ -36,7 +36,7 @@ It is intended that shared PCs are joined to an Active Directory or Azure Active
|
||||
When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Guest** and **Kiosk** options. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low. In Windows 10, version 1703, an inactive option is added which deletes accounts if they haven't signed in after a specified number of days.
|
||||
|
||||
### Maintenance and sleep
|
||||
Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not is use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods.
|
||||
Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not in use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods.
|
||||
|
||||
While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates.
|
||||
|
||||
|
||||
@ -24,6 +24,7 @@ If you run into problems when using Windows Update, start with the following ste
|
||||
2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on SSU.
|
||||
3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:
|
||||
|
||||
- [Windows 10, version 1903 and Windows Server, version 1903](https://support.microsoft.com/help/4498140)
|
||||
- [Windows 10, version 1809 and Windows Server 2019](https://support.microsoft.com/help/4464619/windows-10-update-history)
|
||||
- [Windows 10, version 1803](https://support.microsoft.com/help/4099479/windows-10-update-history)
|
||||
- [Windows 10, version 1709](https://support.microsoft.com/help/4043454)
|
||||
|
||||
@ -9,7 +9,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
author: greg-lindsay
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
---
|
||||
@ -159,6 +160,93 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
|
||||
27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
|
||||
</pre>
|
||||
|
||||
<br><B>setupapi.dev.log</B> content:
|
||||
|
||||
<pre style="font-size: 10px; overflow-y: visible">
|
||||
>>> [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
|
||||
>>> Section start 2019/09/26 20:13:01.623
|
||||
cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
|
||||
ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
|
||||
ndv: Install flags: 0x00000000
|
||||
ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
|
||||
ndv: Search options: 0x00000081
|
||||
ndv: Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
|
||||
dvi: {Build Driver List} 20:13:01.643
|
||||
dvi: Searching for hardware ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_060100
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_0601
|
||||
dvi: Searching for compatible ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f
|
||||
dvi: pci\ven_8086&cc_060100
|
||||
dvi: pci\ven_8086&cc_0601
|
||||
dvi: pci\ven_8086
|
||||
dvi: pci\cc_060100
|
||||
dvi: pci\cc_0601
|
||||
sig: {_VERIFY_FILE_SIGNATURE} 20:13:01.667
|
||||
sig: Key = lynxpointsystem.inf
|
||||
sig: FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
|
||||
sig: Catalog = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
|
||||
sig: Success: File is signed in catalog.
|
||||
sig: {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
|
||||
dvi: Created Driver Node:
|
||||
dvi: HardwareID - PCI\VEN_8086&DEV_8C4F
|
||||
dvi: InfName - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
|
||||
dvi: DevDesc - Intel(R) QM87 LPC Controller - 8C4F
|
||||
dvi: Section - Needs_ISAPNP_DRV
|
||||
dvi: Rank - 0x00ff2001
|
||||
dvi: Signer Score - WHQL
|
||||
dvi: DrvDate - 04/04/2016
|
||||
dvi: Version - 10.1.1.18
|
||||
dvi: {Build Driver List - exit(0x00000000)} 20:13:01.699
|
||||
ndv: Searching currently installed INF
|
||||
dvi: {Build Driver List} 20:13:01.699
|
||||
dvi: Searching for hardware ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f&subsys_05be1028
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_060100
|
||||
dvi: pci\ven_8086&dev_8c4f&cc_0601
|
||||
dvi: Searching for compatible ID(s):
|
||||
dvi: pci\ven_8086&dev_8c4f&rev_04
|
||||
dvi: pci\ven_8086&dev_8c4f
|
||||
dvi: pci\ven_8086&cc_060100
|
||||
dvi: pci\ven_8086&cc_0601
|
||||
dvi: pci\ven_8086
|
||||
dvi: pci\cc_060100
|
||||
dvi: pci\cc_0601
|
||||
dvi: Created Driver Node:
|
||||
dvi: HardwareID - PCI\VEN_8086&DEV_8C4F
|
||||
dvi: InfName - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
|
||||
dvi: DevDesc - Intel(R) QM87 LPC Controller - 8C4F
|
||||
dvi: Section - Needs_ISAPNP_DRV
|
||||
dvi: Rank - 0x00ff2001
|
||||
dvi: Signer Score - WHQL
|
||||
dvi: DrvDate - 10/03/2016
|
||||
dvi: Version - 10.1.1.38
|
||||
dvi: {Build Driver List - exit(0x00000000)} 20:13:01.731
|
||||
dvi: {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
|
||||
dvi: Default installer: Enter 20:13:01.735
|
||||
dvi: {Select Best Driver}
|
||||
dvi: Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
|
||||
dvi: Selected Driver:
|
||||
dvi: Description - Intel(R) QM87 LPC Controller - 8C4F
|
||||
dvi: InfFile - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
|
||||
dvi: Section - Needs_ISAPNP_DRV
|
||||
dvi: {Select Best Driver - exit(0x00000000)}
|
||||
dvi: Default installer: Exit
|
||||
dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
|
||||
ndv: Currently Installed Driver:
|
||||
ndv: Inf Name - oem1.inf
|
||||
ndv: Driver Date - 10/03/2016
|
||||
ndv: Driver Version - 10.1.1.38
|
||||
ndv: {Update Device Driver - exit(00000103)}
|
||||
! ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
|
||||
! ndv: No devices were updated.
|
||||
<<< Section end 2019/09/26 20:13:01.759
|
||||
<<< [Exit status: FAILURE(0xC1900101)]
|
||||
</pre>
|
||||
|
||||
<br>This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f.
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@ Deployment instructions are provided for the following scenarios:
|
||||
|
||||
### Scenario 1
|
||||
- The VM is running Windows 10, version 1803 or later.
|
||||
- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
|
||||
When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure.
|
||||
|
||||
@ -47,7 +47,7 @@ Deployment instructions are provided for the following scenarios:
|
||||
[Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using an Azure Active Directory account.
|
||||
|
||||
### Scenario 3
|
||||
- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx) partner.
|
||||
- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner.
|
||||
|
||||
In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/).
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ Before deploying a device using Windows Autopilot, the device must be registered
|
||||
|
||||
## OEM registration
|
||||
|
||||
When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot).
|
||||
When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers and resellers" section of the [Windows Autopilot information page](https://aka.ms/windowsautopilot).
|
||||
|
||||
Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization).
|
||||
|
||||
|
||||
@ -45,7 +45,7 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn
|
||||
Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
|
||||
|
||||
>[!Important]
|
||||
>It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2023830).
|
||||
>It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2094264).
|
||||
|
||||
### Start the Diagnostic Data Viewer
|
||||
You can start this app from the **Settings** panel.
|
||||
|
||||
@ -398,7 +398,7 @@ The following endpoint is used to retrieve Skype configuration values. To turn o
|
||||
## Windows Defender
|
||||
|
||||
The following endpoint is used for Windows Defender when Cloud-based Protection is enabled.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Windows Defender Antivirus cloud service connections, see [Allow connections to the Windows Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus#allow-connections-to-the-windows-defender-antivirus-cloud-service).
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|
||||
@ -112,7 +112,7 @@ The following table lists the three group scopes and more information about each
|
||||
<p>Global groups from any domain in the same forest</p>
|
||||
<p>Other Universal groups from any domain in the same forest</p></td>
|
||||
<td><p>Can be converted to Domain Local scope</p>
|
||||
<p>Can be converted to Global scope if the group does not contain any other Universal groups</p></td>
|
||||
<p>Can be converted to Global scope if the group is not a member of any other Universal groups</p></td>
|
||||
<td><p>On any domain in the same forest or trusting forests</p></td>
|
||||
<td><p>Other Universal groups in the same forest</p>
|
||||
<p>Domain Local groups in the same forest or trusting forests</p>
|
||||
|
||||
@ -107,7 +107,7 @@ Federation server proxies are computers that run AD FS software that have been c
|
||||
Use the [Setting of a Federation Proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment.
|
||||
|
||||
### Deploy Azure AD Connect
|
||||
Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771).
|
||||
Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
|
||||
|
||||
When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**.
|
||||
|
||||
|
||||
@ -150,7 +150,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq
|
||||
|
||||
Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials.
|
||||
1. Open an elevated command prompt.
|
||||
2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`
|
||||
2. Run `certutil -dsTemplate WHFBAuthentication,msPKI-Private-Key-Flag,+CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`
|
||||
|
||||
> [!NOTE]
|
||||
> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
|
||||
|
||||
@ -27,7 +27,7 @@ ms.reviewer:
|
||||
You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises.
|
||||
|
||||
## Deploy Azure AD Connect
|
||||
Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771).
|
||||
Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -21,7 +21,7 @@ ms.reviewer:
|
||||
> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
|
||||
Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users.
|
||||
Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. See [FIDO2 security keys features and providers](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys).
|
||||
|
||||
The [FIDO2 CTAP specification](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html) contains a few optional features and extensions which are crucial to provide that seamless and secure experience.
|
||||
|
||||
|
||||
@ -10,8 +10,8 @@ ms.mktglfcycl:
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: stephow-MSFT
|
||||
ms.author: stephow
|
||||
author: LauraWi
|
||||
ms.author: laurawi
|
||||
manager: laurawi
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
@ -33,7 +33,7 @@ In the **Website learning report**, you can view a summary of the devices that h
|
||||
|
||||
## Access the WIP Learning reports
|
||||
|
||||
1. Open the [Azure portal](http://portal.azure.com/).
|
||||
1. Open the [Azure portal](https://portal.azure.com/).
|
||||
|
||||
1. Click **All services**, type **Intune** in the text box filter, and click the star to add it to **Favorites**.
|
||||
|
||||
|
||||
@ -196,7 +196,7 @@ Typical **Primary Group** values for user accounts:
|
||||
|
||||
- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. If the value of **userAccountControl** attribute of user object was changed, you will see the new value here.
|
||||
|
||||
To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag.
|
||||
To decode this value, you can go through the property value definitions in the [User’s or Computer’s account UAC flags.](https://support.microsoft.com/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties) from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag.
|
||||
|
||||
Here's an example: Flags value from event: 0x15
|
||||
|
||||
@ -226,7 +226,7 @@ Decoding:
|
||||
|
||||
So this UAC flags value decodes to: LOCKOUT and SCRIPT
|
||||
|
||||
- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: “Table 7. User’s or Computer’s account UAC flags.”. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event.
|
||||
- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: [User’s or Computer’s account UAC flags](https://support.microsoft.com/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties). In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event.
|
||||
|
||||
- **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see **<value changed, but not displayed>** in this field. For local accounts, this field is not applicable and always has “<value not set>“ value.
|
||||
|
||||
|
||||
@ -9,234 +9,211 @@ manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 04/03/2018
|
||||
ms.date: 11/05/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# FIPS 140-2 Validation
|
||||
|
||||
# FIPS 140 Validation
|
||||
## FIPS 140-2 standard overview
|
||||
|
||||
On this page
|
||||
The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard that defines minimum security requirements for cryptographic modules in information technology products, as defined in Section 5131 of the Information Technology Management Reform Act of 1996.
|
||||
|
||||
- [Introduction](https://technet.microsoft.com/library/cc750357.aspx#id0eo)
|
||||
- [FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#id0ebd)
|
||||
- [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#id0ezd)
|
||||
- [Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#id0eve)
|
||||
- [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#id0eibac)
|
||||
- [FIPS 140 FAQ](https://technet.microsoft.com/library/cc750357.aspx#id0eqcac)
|
||||
- [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#id0ewfac)
|
||||
- [Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#id0erobg)
|
||||
The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program), a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS), validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover eleven areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module.
|
||||
|
||||
Updated: March 2018
|
||||
## Microsoft’s approach to FIPS 140-2 validation
|
||||
|
||||
Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since the inception of the standard in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules.
|
||||
|
||||
## Using Windows in a FIPS 140-2 approved mode of operation
|
||||
|
||||
## Introduction
|
||||
Windows 10 and Windows server may be configured to run in a FIPS 140-2 approved mode of operation. This is commonly referred to as “FIPS mode.” Achieving this mode of operation requires administrators to complete all four steps outlined below.
|
||||
|
||||
This document provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard, *Federal Information Processing Standard (FIPS) 140 – Security Requirements for Cryptographic Modules* \[FIPS 140\].
|
||||
### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed
|
||||
|
||||
### Audience
|
||||
Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. This is accomplished by cross-checking the version number of the cryptographic module with the table of validated modules at the end of this topic, organized by operating system release.
|
||||
|
||||
This document is primarily focused on providing information for three parties:
|
||||
### Step 2: Ensure all security policies for all cryptographic modules are followed
|
||||
|
||||
[Procurement Officer](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Responsible for verifying that Microsoft products (or even third-party applications) are either FIPS 140 validated or utilize a Microsoft FIPS 140 validated cryptographic module.
|
||||
Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found by following the links in the table of validated modules at the end of this topic. Click on the module version number to view the published SPD for the module.
|
||||
|
||||
[System Integrator](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Responsible for ensuring that Microsoft Products are configured properly to use only FIPS 140 validated cryptographic modules.
|
||||
### Step 3: Enable the FIPS security policy
|
||||
|
||||
[Software Developer](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Responsible for building software products that utilize Microsoft FIPS 140 validated cryptographic modules.
|
||||
Windows provides the security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,” which is used by some Microsoft products to determine whether to operate in a FIPS 140-2 approved mode. When this policy is enabled, the validated cryptographic modules in Windows will also operate in FIPS approved mode. The policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing).
|
||||
|
||||
### Document Map
|
||||
### Step 4: Ensure only FIPS validated cryptographic algorithms are used
|
||||
|
||||
This document is broken into seven major sections:
|
||||
Neither the operating system nor the cryptographic modules can enforce a FIPS approved mode of operation, regardless of the FIPS security policy setting. To run in a FIPS approved mode, an application or service must check for the policy flag and enforce the security policies of the validated modules. If an application or service uses a non-approved cryptographic algorithm or does not follow the security policies of the validated modules, it is not operating in a FIPS approved mode.
|
||||
|
||||
[FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_overview) – Provides an overview of the FIPS 140 standard as well as provides some historical information about the standard.
|
||||
## Frequently asked questions
|
||||
|
||||
[Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_product_validation) – Provides information on how Microsoft products are FIPS 140 validated.
|
||||
### How long does it take to certify cryptographic modules?
|
||||
|
||||
[Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#_information_for_system) – Describes how to configure and verify that Microsoft Products are being used in a manner consistent with the product’s FIPS 140 Security Policy.
|
||||
Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors.
|
||||
|
||||
[Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) – Identifies how developers can leverage the Microsoft FIPS 140 validated cryptographic modules.
|
||||
### When does Microsoft undertake a FIPS 140 validation?
|
||||
|
||||
[FAQ](https://technet.microsoft.com/library/cc750357.aspx#_fips_140_faq) – Frequently Asked Questions.
|
||||
The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules.
|
||||
|
||||
[Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) – Explains Microsoft cryptographic architecture and identifies specific modules that are FIPS 140 validated.
|
||||
### What is the difference between “FIPS 140 validated” and “FIPS 140 compliant”?
|
||||
|
||||
[Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#_cryptographic_algorithms) – Lists the cryptographic algorithm, modes, states, key sizes, Windows versions, and corresponding cryptographic algorithm validation certificates.
|
||||
“FIPS 140 validated” means that the cryptographic module, or a product that embeds the module, has been validated (“certified”) by the CMVP as meeting as meeting the FIPS 140-2 requirements. “FIPS 140 compliant” is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality.
|
||||
|
||||
## FIPS 140 Overview
|
||||
### I need to know if a Windows service or application is FIPS 140-2 validated.
|
||||
|
||||
### FIPS 140 Standard
|
||||
The cryptographic modules leveraged in Windows are validated through the CMVP, not individual services, applications, hardware peripherals, or other solutions. For a solution to be considered compliant, it must call a FIPS 140-2 validated cryptographic module in the underlying OS and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module.
|
||||
|
||||
FIPS 140 is a US government and Canadian government standard that defines a minimum set of the security requirements for products that implement cryptography. This standard is designed for cryptographic modules that are used to secure sensitive but unclassified information. Testing against the FIPS 140 standard is maintained by the Cryptographic Module Validation Program (CMVP), a joint effort between the US National Institute of Standards and Technology (NIST) and the Communications Security Establishment of Canada (CSEC).
|
||||
### What does "When operated in FIPS mode" mean on a certificate?
|
||||
|
||||
The current standard defines four-levels of increasing security, 1 through 4. Most software products (including all Microsoft products) are tested against the Level 1 security requirements.
|
||||
This caveat identifies required configuration and security rules that must be followed to use the cryptographic module in a way that is consistent with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module.
|
||||
|
||||
### Applicability of the FIPS standard
|
||||
### What is the relationship between FIPS 140-2 and Common Criteria?
|
||||
|
||||
Within the US Federal government, the FIPS 140 standard applies to any security system (whether hardware, firmware, software, or a combination thereof) to be used by agencies for protecting sensitive but unclassified information. Some agencies have expanded its use by requiring that the modules to be procured for secret systems also meet the FIPS 140 requirements.
|
||||
These are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules, while Common Criteria is designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly.
|
||||
|
||||
The FIPS 140 standard has also been used by different standards bodies, specification groups, nations, and private institutions as a requirement or guideline for those products (e.g. – Digital Cinema Systems Specification).
|
||||
### How does FIPS 140 relate to Suite B?
|
||||
|
||||
### History of 140-1
|
||||
Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140-2 standard.
|
||||
|
||||
FIPS 140-1 is the original working version of the standard made official on January 11, 1994. The standard remained in effect until FIPS 140-2 became mandatory for new products on May 25, 2002.
|
||||
|
||||
### FIPS 140-2
|
||||
|
||||
FIPS 140-2 is currently the active version of the standard.
|
||||
|
||||
### Microsoft FIPS Support Policy
|
||||
|
||||
Microsoft actively maintains FIPS 140 validation for its cryptographic modules.
|
||||
|
||||
### FIPS Mode of Operation
|
||||
|
||||
The common term “FIPS mode” is used in this document and Security Policy documents. When a cryptographic module contains both FIPS-approved and non-FIPS approved security methods, it must have a "FIPS mode of operation" to ensure only FIPS-approved security methods may be used. When a module is in "FIPS mode", a non-FIPS approved method cannot be used instead of a FIPS-approved method.
|
||||
|
||||
## Microsoft Product Validation (Information for Procurement Officers and Auditors)
|
||||
|
||||
This section provides information for Procurement Officers and Auditors who are responsible for ensuring that Microsoft products with FIPS 140 validated cryptographic modules are used in their organization. The goal of this section is to provide an overview of the Microsoft developed products and modules and explain how the validated cryptographic modules are used.
|
||||
|
||||
### Microsoft Product Relationship with CNG and CAPI libraries
|
||||
|
||||
Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services.
|
||||
|
||||
The following list contains some of the Windows components and Microsoft products that rely on FIPS 140 validated cryptographic modules:
|
||||
|
||||
- Schannel Security Package
|
||||
- Remote Desktop Protocol (RDP) Client
|
||||
- Encrypting File System (EFS)
|
||||
- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.)
|
||||
- BitLocker® Drive Full-volume Encryption
|
||||
- IPsec Settings of Windows Firewall
|
||||
- Server Message Block (SMB) 3.x
|
||||
|
||||
## Information for System Integrators
|
||||
|
||||
This section provides information for System Integrators and Auditors who are responsible for deploying Microsoft products in a manner consistent with the product’s FIPS 140 Security Policy.
|
||||
|
||||
There are two steps to ensure that Microsoft products operate in FIPS mode:
|
||||
|
||||
1. Selecting/Installing FIPS 140 validated cryptographic modules
|
||||
2. Setting FIPS local/group security policy flag.
|
||||
|
||||
### Step 1 – Selecting/Installing FIPS 140 Validated Cryptographic Modules
|
||||
|
||||
Systems Integrators must ensure that all cryptographic modules installed are, in fact, FIPS 140 validated. This can be accomplished by cross-checking the version number of the installed module with the list of validated binaries. The list of validated CAPI binaries is identified in the [CAPI Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_capi_validated_cryptographic) section below and the list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section below. There are similar sections for all other validated cryptographic modules.
|
||||
|
||||
The version number of the installed binary is found by right-clicking the module file and clicking on the Version or Details tab. Cryptographic modules are stored in the "windows\\system32" or "windows\\system32\\drivers" directory.
|
||||
|
||||
### Step 2 – Setting FIPS Local/Group Security Policy Flag
|
||||
|
||||
The Windows operating system provides a group (or local) security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing”, which is used by many Microsoft products to determine whether to operate in a FIPS-approved mode. When this policy is set, the validated cryptographic modules in Windows will also operate in a FIPS-approved mode.
|
||||
|
||||
**Note** – There is no enforcement of the FIPS policy by the operating system or the validated cryptographic modules. Instead, each individual application must check this flag and enforce the Security Policy of the validated cryptographic modules.
|
||||
|
||||
#### Instructions on Setting the FIPS Local/Group Security Policy Flag
|
||||
|
||||
While there are alternative methods for setting the FIPS local/group security policy flag, the following method is included as a guide to users with Administrative privileges. This description is for the Local Security Policy, but the Group Security Policy may be set in a similar manner.
|
||||
|
||||
1. Open the 'Run' menu by pressing the combination 'Windows Key + R'.
|
||||
2. Type 'secpol.msc' and press 'Enter' or click the 'Ok' button.
|
||||
3. In the Local Security Policy management console window that opens, use the left tab to navigate to the Local Policies -\> Security Options.
|
||||
4. Scroll down the right pane and double-click 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing'.
|
||||
5. In the properties window, select the 'Enabled' option and click the 'Apply' button.
|
||||
|
||||
#### Microsoft Components and Products That Utilize FIPS Local/Group Security Policy
|
||||
|
||||
The following list details some of the Microsoft components that use the cryptographic functionality implemented by either CNG or legacy CAPI. When the FIPS Local/Group Security Policy is set, the following components will enforce the validated module Security Policy.
|
||||
|
||||
- Schannel Security Package
|
||||
- Remote Desktop Protocol (RDP) Client
|
||||
- Encrypting File System (EFS)
|
||||
- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.)
|
||||
- BitLocker® Drive Full-volume Encryption
|
||||
- IPsec Settings of Windows Firewall
|
||||
|
||||
#### Effects of Setting FIPS Local/Group Security Policy Flag
|
||||
|
||||
When setting the FIPS local/group security policy flag, the behavior of several Microsoft components and products are affected. The most noticeable difference will be that the components enforcing this setting will only use those algorithms approved or allowed in FIPS mode. The specific changes to the products listed above are:
|
||||
|
||||
- Schannel Security Package forced to negotiate sessions using TLS. The following supported Cipher Suites are disabled:
|
||||
|
||||
- - TLS\_RSA\_WITH\_RC4\_128\_SHA
|
||||
- TLS\_RSA\_WITH\_RC4\_128\_MD5
|
||||
- SSL\_CK\_RC4\_128\_WITH\_MD5
|
||||
- SSL\_CK\_DES\_192\_EDE3\_CBC\_WITH\_MD5
|
||||
- TLS\_RSA\_WITH\_NULL\_MD5
|
||||
- TLS\_RSA\_WITH\_NULL\_SHA
|
||||
|
||||
- The set of cryptographic algorithms that a Remote Desktop Protocol (RDP) server will use is scoped to:
|
||||
|
||||
- - CALG\_RSA\_KEYX - RSA public key exchange algorithm
|
||||
- CALG\_3DES - Triple DES encryption algorithm
|
||||
- CALG\_AES\_128 - 128 bit AES
|
||||
- CALG\_AES\_256 - 256 bit AES
|
||||
- CALG\_SHA1 - SHA hashing algorithm
|
||||
- CALG\_SHA\_256 - 256 bit SHA hashing algorithm
|
||||
- CALG\_SHA\_384 - 384 bit SHA hashing algorithm
|
||||
- CALG\_SHA\_512 - 512 bit SHA hashing algorithm
|
||||
|
||||
- Any Microsoft .NET Framework applications, such as Microsoft ASP.NET or Windows Communication Foundation (WCF), only allow algorithm implementations that are validated to FIPS 140, meaning only classes that end in "CryptoServiceProvider" or "Cng" can be used. Any attempt to create an instance of other cryptographic algorithm classes or create instances that use non-allowed algorithms will cause an InvalidOperationException exception.
|
||||
|
||||
- Verification of ClickOnce applications fails unless the client computer has .NET Framework 2.0 SP1 or later service pack installed or .NET Framework 3.5 or later installed.
|
||||
|
||||
- On Windows Vista and Windows Server 2008 and later, BitLocker Drive Encryption switches from AES-128 using the elephant diffuser to using the approved AES-256 encryption. Recovery passwords are not created or backed up. Instead, backup a recovery key on a local drive or on a network share. To use the recovery key, put the key on a USB device and plug the device into the computer.
|
||||
|
||||
Please be aware that selection of FIPS mode can limit product functionality (See <http://support.microsoft.com/kb/811833>).
|
||||
|
||||
## Information for Software Developers
|
||||
|
||||
This section is targeted at developers who wish to build their own applications using the FIPS 140 validated cryptographic modules.
|
||||
|
||||
Each of the validated cryptographic modules defines a series of rules that must be followed. The security rules for each validated cryptographic module are specified in the Security Policy document. Links to each of the Security Policy documents is provided in the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section below. Generally, the restriction in Microsoft validated cryptographic modules is limiting the use of cryptography to only FIPS Approved cryptographic algorithms, modes, and key sizes.
|
||||
|
||||
### Using Microsoft Cryptographic Modules in a FIPS mode of operation
|
||||
|
||||
No matter whether developing with native languages or using .NET, it is important to first check whether the CNG modules for the target system are FIPS validated. The list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_cng_validated_cryptographic) section.
|
||||
|
||||
When developing using CNG directly, it is the responsibility of the developer to follow the security rules outlined in the FIPS 140 Security Policy for each module. The security policy for each module is provided on the CMVP website. Links to each of the Security Policy documents is provided in the tables below. It is important to remember that setting the FIPS local/group security policy Flag (discussed above) does not affect the behavior of the modules when used for developing custom applications.
|
||||
|
||||
If you are developing your application using .NET instead of using the native libraries, then setting the FIPS local policy flag will generate an exception when an improper .NET class is used for cryptography (i.e. the cryptographic classes whose names end in "Managed"). The names of these allowed classes end with "Cng", which use the CNG binaries or "CryptoServiceProvider", which use the legacy CAPI binaries.
|
||||
|
||||
### Key Strengths and Validity Periods
|
||||
|
||||
NIST Special Publication 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, dated November 2015, \[[SP 800-131A](http://dx.doi.org/10.6028/nist.sp.800-131ar1)\], offers guidance for moving to stronger cryptographic keys and algorithms. This does not replace NIST SP 800-57, Recommendation for Key Management Part 1: General, \[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\], but gives more specific guidance. One of the most important topics discussed in these publications deals with the key strengths of FIPS Approved algorithms and their validity periods. When developing applications that use FIPS Approved algorithms, it is also extremely important to select appropriate key sizes based on the security lifetimes recommended by NIST.
|
||||
|
||||
## FIPS 140 FAQ
|
||||
|
||||
The following are answers to commonly asked questions for the FIPS 140-2 validation of Microsoft products.
|
||||
|
||||
1. How does FIPS 140 relate to the Common Criteria?
|
||||
**Answer:** These are two separate security standards with different, but complementary, purposes. FIPS 140 is a standard designed specifically for validating product modules that implement cryptography. On the other hand, Common Criteria is designed to help evaluate security functions in IT products.
|
||||
In many cases, Common Criteria evaluations will rely on FIPS 140 validations to provide assurance that cryptographic functionality is implemented properly.
|
||||
2. How does FIPS 140 relate to Suite B?
|
||||
**Answer:** Suite B is simply a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information.
|
||||
The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140 standard.
|
||||
3. There are so many modules listed on the NIST website for each release, how are they related and how do I tell which one applies to me?
|
||||
**Answer:** Microsoft strives to validate all releases of its cryptographic modules. Each module provides a different set of cryptographic algorithms. If you are required to use only FIPS validated cryptographic modules, you simply need to verify that the version being used appears on the validation list.
|
||||
Please see the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140)section for a complete list of Microsoft validated modules.
|
||||
4. My application links against crypt32.dll, cryptsp.dll, advapi32.dll, bcrypt.dll, bcryptprimitives.dll, or ncrypt.dll. What do I need to do to assure I’m using FIPS 140 validated cryptographic modules?
|
||||
**Answer:** crypt32.dll, cryptsp.dll, advapi32.dll, and ncrypt.dll are intermediary libraries that will offload all cryptographic operations to the FIPS validated cryptographic modules. Bcrypt.dll itself is a validated cryptographic module for Windows Vista and Windows Server 2008. For Windows 7 and Windows Server 2008 R2 and later, bcryptprimitives.dll is the validated module, but bcrypt.dll remains as one of the libraries to link against.
|
||||
You must first verify that the underlying CNG cryptographic module is validated. Once verified, you'll need to confirm that you're using the module correctly in FIPS mode (See [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#_information_for_software) section for details).
|
||||
5. What does "When operated in FIPS mode" mean on certificates?
|
||||
**Answer:** This caveat identifies that a required configuration and security rules must be followed in order to use the cryptographic module in a manner consistent with its FIPS 140 Security Policy. The security rules are defined in the Security Policy for the module and usually revolve around using only FIPS Approved cryptographic algorithms and key sizes. Please see the Security Policy for the specific security rules for each cryptographic module (See [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#_microsoft_fips_140) section for links to each policy).
|
||||
6. Which FIPS validated module is called when Windows 7 or Windows 8 is configured to use the FIPS setting in the wireless configuration?
|
||||
**Answer:** CNG is used. This setting tells the wireless driver to call FIPS 140-2 validated cryptographic modules instead of using the driver’s own cryptography, if any.
|
||||
7. Is BitLocker to Go FIPS 140-2 validated?
|
||||
**Answer:** There are two separate parts for BitLocker to Go. One part is simply a native feature of BitLocker and as such, it uses FIPS 140-2 validated cryptographic modules. The other part is the BitLocker to Go Reader application for down-level support of older operating systems such as Windows XP and Windows Vista. The Reader application does not use FIPS 140-2 validated cryptographic modules.
|
||||
8. Are applications FIPS 140-2 validated?
|
||||
**Answer:** Microsoft only has low-level cryptographic modules in Windows FIPS 140-2 validated, not high-level applications. A better question is whether a certain application calls a FIPS 140-2 validated cryptographic module in the underlying Windows OS. That question needs to be directed to the company/product group that created the application of interest.
|
||||
9. How can Systems Center Operations Manager 2012 be configured to use FIPS 140-2 validated cryptographic modules?
|
||||
**Answer:** See [https://technet.microsoft.com/library/hh914094.aspx](https://technet.microsoft.com/library/hh914094.aspx)
|
||||
|
||||
## Microsoft FIPS 140 Validated Cryptographic Modules
|
||||
|
||||
### Modules By Operating System
|
||||
|
||||
The following tables identify the Cryptographic Modules for an operating system.
|
||||
|
||||
#### Windows
|
||||
## Microsoft FIPS 140-2 validated cryptographic modules
|
||||
|
||||
The following tables identify the cryptographic modules used in an operating system, organized by release.
|
||||
|
||||
## Modules used by Windows
|
||||
|
||||
##### Windows 10 Spring 2018 Update (Version 1803)
|
||||
|
||||
Validated Editions: Home, Pro, Enterprise, Education
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><strong>Cryptographic Module</strong></td>
|
||||
<td><strong>Version (link to Security Policy)</strong></td>
|
||||
<td><strong>FIPS Certificate #</strong></td>
|
||||
<td><strong>Algorithms</strong></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3197.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3197">#3197</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Kernel Mode Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3196.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3196">#3196</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3195.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3195">#3195</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Windows OS Loader</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3480.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3480">#3480</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Secure Kernel Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3096.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3096">#3096</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>BitLocker Dump Filter</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3092.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3092">#3092</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Boot Manager</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3089.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3089">#3089</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
##### Windows 10 Fall Creators Update (Version 1709)
|
||||
|
||||
Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><strong>Cryptographic Module</strong></td>
|
||||
<td><strong>Version (link to Security Policy)</strong></td>
|
||||
<td><strong>FIPS Certificate #</strong></td>
|
||||
<td><strong>Algorithms</strong></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3197.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3197">#3197</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Kernel Mode Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3196.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3196">#3196</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3195.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3195">#3195</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Windows OS Loader</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3194.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3194">#3194</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Secure Kernel Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3096.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3096">#3096</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>BitLocker Dump Filter</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3092.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3092">#3092</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Windows Resume</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3091.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3091">#3091</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Boot Manager</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3089.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3089">#3089</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
##### Windows 10 Creators Update (Version 1703)
|
||||
|
||||
@ -1349,8 +1326,141 @@ Validated Editions: Ultimate Edition
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## Modules used by Windows Server
|
||||
|
||||
#### Windows Server
|
||||
##### Windows Server (Version 1803)
|
||||
|
||||
Validated Editions: Standard, Datacenter
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><strong>Cryptographic Module</strong></td>
|
||||
<td><strong>Version (link to Security Policy)</strong></td>
|
||||
<td><strong>FIPS Certificate #</strong></td>
|
||||
<td><strong>Algorithms</strong></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3197.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3197">#3197</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Kernel Mode Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3196.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3196">#3196</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3195.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3195">#3195</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Windows OS Loader</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3480.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3480">#3480</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Secure Kernel Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3096.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3096">#3096</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>BitLocker Dump Filter</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3092.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3092">#3092</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Boot Manager</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3089.pdf">10.0.17134</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3089">#3089</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
##### Windows Server (Version 1709)
|
||||
|
||||
Validated Editions: Standard, Datacenter
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
<col style="width: 25%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><strong>Cryptographic Module</strong></td>
|
||||
<td><strong>Version (link to Security Policy)</strong></td>
|
||||
<td><strong>FIPS Certificate #</strong></td>
|
||||
<td><strong>Algorithms</strong></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3197.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3197">#3197</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Kernel Mode Cryptographic Primitives Library</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3196.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3196">#3196</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3195.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3195">#3195</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Windows OS Loader</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3194.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3194">#3194</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Secure Kernel Code Integrity</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3096.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3096">#3096</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>BitLocker Dump Filter</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3092.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3092">#3092</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Windows Resume</td>
|
||||
<td><a href="https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3091.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3091">#3091</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Boot Manager</td>
|
||||
<td><a href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3089.pdf">10.0.16299</a></td>
|
||||
<td><a href="https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3089">#3089</a></td>
|
||||
<td>See Security Policy and Certificate page for algorithm information</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
##### Windows Server 2016
|
||||
|
||||
@ -7082,10 +7192,3 @@ Version 6.3.9600</p></td>
|
||||
\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised)
|
||||
|
||||
\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
|
||||
|
||||
## Additional Microsoft References
|
||||
|
||||
Enabling FIPS mode - <http://support.microsoft.com/kb/811833>
|
||||
|
||||
Cipher Suites in Schannel - [https://msdn.microsoft.com/library/aa374757(VS.85).aspx](https://msdn.microsoft.com/library/aa374757\(vs.85\).aspx)
|
||||
|
||||
|
||||
@ -24,15 +24,17 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from
|
||||
- [Download Microsoft Safety Scanner (64-bit)](https://go.microsoft.com/fwlink/?LinkId=212732)
|
||||
|
||||
> [!NOTE]
|
||||
> The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/wdsi/definitions).
|
||||
> Starting November 2019, Safety Scanner will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to run Safety Scanner. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
|
||||
|
||||
Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan.
|
||||
## Important information
|
||||
|
||||
> [!NOTE]
|
||||
> This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection).
|
||||
- The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/wdsi/definitions).
|
||||
|
||||
> [!NOTE]
|
||||
> Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download.
|
||||
- Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan.
|
||||
|
||||
- Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download.
|
||||
|
||||
- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection).
|
||||
|
||||
## System requirements
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ API calls per connection | 100 | 60 seconds
|
||||
|
||||
Microsoft and any contributors grant you a license to the Microsoft documentation and other content in this repository under the Creative Commons Attribution 4.0 International Public License, see the LICENSE file.
|
||||
|
||||
Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653.
|
||||
Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. Microsoft's general trademark guidelines can be found at https://go.microsoft.com/fwlink/?LinkID=254653.
|
||||
|
||||
Privacy information can be found at https://privacy.microsoft.com/en-us/
|
||||
Microsoft and any contributors reserve all others rights, whether under their respective copyrights, patents, or trademarks, whether by implication, estoppel or otherwise.
|
||||
|
||||
@ -43,6 +43,9 @@ The service supports the onboarding of the following servers:
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
> [!NOTE]
|
||||
> An Azure Security Center Standard license is required, per node, to enroll Microsoft Defender ATP on a supported Windows Server platform, see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services)
|
||||
|
||||
## Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP:
|
||||
@ -178,9 +181,6 @@ Support for Windows Server, version 1803 and Windows 2019 provides deeper insigh
|
||||
## Integration with Azure Security Center
|
||||
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
---
|
||||
title: Microsoft Defender ATP for Mac
|
||||
ms.reviewer:
|
||||
description: Describes how to install and use Microsoft Defender ATP for Mac.
|
||||
title: Enable Microsoft Defender ATP Insider Machine
|
||||
description: Install and use Microsoft Defender ATP for Mac.
|
||||
keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -20,7 +19,7 @@ ms.topic: conceptual
|
||||
|
||||
# Enable Microsoft Defender ATP Insider Machine
|
||||
|
||||
The following instructions specify how to configure a macOS machine running Microsoft Defender ATP to be an "Insider" machine. For scale deployment we recommend using Jamf, or Intune.
|
||||
Endpoint detection and response capabilities in Microsoft Defender ATP for Mac are now in preview. To get these and other preview features, you must set up your Mac machine to be an "Insider" machine as described in this article. For scale deployment, we recommend using [Jamf](#enable-the-insider-program-with-jamf) or [Intune](#enable-the-insider-program-with-intune).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Make sure you have enabled [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md#how-to-install-microsoft-defender-atp-for-mac), and pay attention to the “earlyPreview” flag. See documentation for [Jamf](mac-install-with-jamf.md), [Intune](mac-install-with-intune.md) and [manual deployment](mac-install-manually.md) instructions.
|
||||
@ -142,7 +141,7 @@ To verify you are running the correct version, run ‘mdatp --health’ on the m
|
||||
|
||||
* The required version is 100.72.15 or later.
|
||||
* If the version is not as expected, verify that Microsoft Auto Update is set to automatically download and install updates by running ‘defaults read com.microsoft.autoupdate2’ from terminal.
|
||||
* To change update settings use documentation in Update Office for Mac automatically.
|
||||
* To change update settings use documentation in [Update Office for Mac automatically](https://support.office.com/article/update-office-for-mac-automatically-bfd1e497-c24d-4754-92ab-910a4074d7c1).
|
||||
* If you are not using Office for Mac, download and run the AutoUpdate tool.
|
||||
|
||||
### A machine still does not appear on Microsoft Defender Security Center
|
||||
@ -151,4 +150,4 @@ After a successful deployment and onboarding of the correct version, check that
|
||||
|
||||
* Check that you enabled the early preview flag. In terminal run “mdatp –health” and look for the value of “edrEarlyPreviewEnabled”. It should be “Enabled”.
|
||||
|
||||
If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the manual deployment documentation and use the “Manual Deployment” section in the troubleshoot kernel extension documentation.
|
||||
If you followed the manual deployment instructions, you were prompted to enable Kernel Extensions. Pay attention to the “System Extension note” in the [manual deployment documentation](mac-install-manually.md#application-installation) and use the “Manual Deployment” section in the [troubleshoot kernel extension documentation](mac-support-kext.md#manual-deployment).
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 212 KiB |
@ -53,6 +53,9 @@ When you have configured exploit protection to your desired state (including bot
|
||||
|
||||
3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you want to use Default configuration, use the settings "On by default" instead of "Use Default (On)" to get the settings exported correctly on the XML file.
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -94,9 +94,9 @@ Important tasks, such as controlling product settings and triggering on-demand s
|
||||
|Protection |Do a full scan |`mdatp --scan --full` |
|
||||
|Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` |
|
||||
|Protection |Request a security intelligence update |`mdatp --definition-update` |
|
||||
|EDR |Turn on/off EDR preview for Mac |`mdatp --early-preview [true/false]` |
|
||||
|EDR |Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp --set-tag GROUP [name]` |
|
||||
|EDR |Remove group tag from machine |`mdatp --remove-tag [name]` |
|
||||
|EDR |Turn on/off EDR preview for Mac |`mdatp --edr --early-preview [true/false]` |
|
||||
|EDR |Add group tag to machine. EDR tags are used for managing machine groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp --edr --set-tag GROUP [name]` |
|
||||
|EDR |Remove group tag from machine |`mdatp --edr --remove-tag [name]` |
|
||||
|
||||
## Microsoft Defender ATP portal information
|
||||
|
||||
|
||||
@ -27,11 +27,14 @@ This topic describes how to install, configure, update, and use Microsoft Defend
|
||||
|
||||
## What’s new in the latest release
|
||||
|
||||
[What's new](mac-whatsnew.md)
|
||||
[What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md)
|
||||
|
||||
If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**.
|
||||
[What's new in Microsoft Defender ATP for Mac](mac-whatsnew.md)
|
||||
|
||||
To learn how to configure a macOS machine running Microsoft Defender ATP to be an "Insider" machine, go to [Enable Microsoft Defender ATP Insider Machine](endpoint-detection-response-mac-preview.md)
|
||||
> [!TIP]
|
||||
> If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**.
|
||||
|
||||
To get the latest features, including preview capabilities (such as endpoint detection and response for your Mac machines), configure your macOS machine running Microsoft Defender ATP to be an "Insider" machine. See [Enable Microsoft Defender ATP Insider Machine](endpoint-detection-response-mac-preview.md).
|
||||
|
||||
## How to install Microsoft Defender ATP for Mac
|
||||
|
||||
@ -45,13 +48,13 @@ To learn how to configure a macOS machine running Microsoft Defender ATP to be a
|
||||
|
||||
There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac.
|
||||
|
||||
* Third-party management tools:
|
||||
* [Microsoft Intune-based deployment](mac-install-with-intune.md)
|
||||
* [JAMF-based deployment](mac-install-with-jamf.md)
|
||||
* [Other MDM products](mac-install-with-other-mdm.md)
|
||||
- Third-party management tools:
|
||||
- [Microsoft Intune-based deployment](mac-install-with-intune.md)
|
||||
- [JAMF-based deployment](mac-install-with-jamf.md)
|
||||
- [Other MDM products](mac-install-with-other-mdm.md)
|
||||
|
||||
* Command-line tool:
|
||||
* [Manual deployment](mac-install-manually.md)
|
||||
- Command-line tool:
|
||||
- [Manual deployment](mac-install-manually.md)
|
||||
|
||||
### System requirements
|
||||
|
||||
@ -91,9 +94,9 @@ $ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'http
|
||||
|
||||
The output from this command should be similar to the following:
|
||||
|
||||
> `OK https://x.cp.wd.microsoft.com/api/report`
|
||||
>
|
||||
> `OK https://cdn.x.cp.wd.microsoft.com/ping`
|
||||
`OK https://x.cp.wd.microsoft.com/api/report`
|
||||
|
||||
`OK https://cdn.x.cp.wd.microsoft.com/ping`
|
||||
|
||||
> [!CAUTION]
|
||||
> We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default.
|
||||
@ -105,9 +108,7 @@ $ mdatp --connectivity-test
|
||||
|
||||
## How to update Microsoft Defender ATP for Mac
|
||||
|
||||
Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used.
|
||||
|
||||
To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md)
|
||||
Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. To learn more, see [Deploy updates for Microsoft Defender ATP for Mac](mac-updates.md)
|
||||
|
||||
## How to configure Microsoft Defender ATP for Mac
|
||||
|
||||
|
||||
@ -55,11 +55,11 @@ You'll need to have access to:
|
||||
- Method: "GET" as a value to get the list of machines.
|
||||
- URI: Enter `https://api.securitycenter.windows.com/api/machines`.
|
||||
- Authentication: Select "Active Directory OAuth".
|
||||
- Tenant: Sign-in to http://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
|
||||
- Tenant: Sign-in to https://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
|
||||
- Audience: `https://securitycenter.onmicrosoft.com/windowsatpservice\`
|
||||
- Client ID: Sign-in to http://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Client ID value.
|
||||
- Client ID: Sign-in to https://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Client ID value.
|
||||
- Credential Type: Select "Secret".
|
||||
- Secret: Sign-in to http://portal.azure.com and navigate tnd navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
|
||||
- Secret: Sign-in to https://portal.azure.com and navigate tnd navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -42,6 +42,8 @@ Turn on the preview experience setting to be among the first to try upcoming fea
|
||||
## Preview features
|
||||
The following features are included in the preview release:
|
||||
|
||||
- [Endpoint detection and response for Mac devices](endpoint-detection-response-mac-preview.md). Recently, [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md) released. Expanding on the protection available in Microsoft Defender ATP for Mac, endpoint detection and response capabilities are now in preview.
|
||||
|
||||
- [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy) <BR> You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy).
|
||||
|
||||
- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table) <BR> You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase.
|
||||
|
||||
@ -27,7 +27,7 @@ The threat protection report provides high-level information about alerts genera
|
||||
|
||||
The dashboard is structured into two sections:
|
||||
|
||||
|
||||
|
||||
|
||||
Section | Description
|
||||
:---|:---
|
||||
|
||||
@ -27,6 +27,9 @@ The following features are generally available (GA) in the latest release of Mic
|
||||
|
||||
For more information preview features, see [Preview features](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection).
|
||||
|
||||
## November 2019
|
||||
|
||||
- [Microsoft Defender ATP for Mac](microsoft-defender-atp-mac.md) <BR> Microsoft Defender ATP for Mac brings the next-generation protection to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices. ([Endpoint detection and response is currently in preview](preview.md).)
|
||||
|
||||
## October 2019
|
||||
|
||||
|
||||
@ -46,7 +46,7 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender
|
||||
|
||||
After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints.
|
||||
|
||||
As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net").
|
||||
As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). Below mention URLs are using port 443 for communication.
|
||||
|
||||
|
||||
| **Service**| **Description** |**URL** |
|
||||
|
||||
@ -1,19 +1,17 @@
|
||||
# [Windows Defender Application Control](windows-defender-application-control.md)
|
||||
|
||||
## [Windows Defender Application Control design guide](windows-defender-application-control-design-guide.md)
|
||||
### [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md)
|
||||
### [Select the types of rules to create](select-types-of-rules-to-create.md)
|
||||
### [Plan for WDAC policy management](plan-windows-defender-application-control-management.md)
|
||||
#### [Document your application control management processes](document-your-windows-defender-application-control-management-processes.md)
|
||||
### [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md)
|
||||
### [Plan for WDAC policy lifecycle management](plan-windows-defender-application-control-management.md)
|
||||
### Design and create your WDAC policy
|
||||
#### [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md)
|
||||
#### [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md)
|
||||
#### [Create an initial default policy](create-initial-default-policy.md)
|
||||
#### [Microsoft recommended block rules](microsoft-recommended-block-rules.md)
|
||||
|
||||
|
||||
|
||||
## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md)
|
||||
### [Types of devices](types-of-devices.md)
|
||||
### Use WDAC with custom policies
|
||||
#### [Create an initial default policy](create-initial-default-policy.md)
|
||||
#### [Microsoft recommended block rules](microsoft-recommended-block-rules.md)
|
||||
### [Audit WDAC policies](audit-windows-defender-application-control-policies.md)
|
||||
### [Merge WDAC policies](merge-windows-defender-application-control-policies.md)
|
||||
### [Deploy multiple WDAC policies](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
@ -34,10 +32,10 @@
|
||||
### [Use signed policies to protect Windows Defender Application Control against tampering](use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md)
|
||||
#### [Signing WDAC policies with SignTool.exe](signing-policies-with-signtool.md)
|
||||
### [Disable WDAC policies](disable-windows-defender-application-control-policies.md)
|
||||
### [Device Guard and AppLocker](windows-defender-device-guard-and-applocker.md)
|
||||
### [LOB Win32 Apps on S Mode](LOB-win32-apps-on-s.md)
|
||||
|
||||
|
||||
|
||||
## [AppLocker](applocker\applocker-overview.md)
|
||||
### [Administer AppLocker](applocker\administer-applocker.md)
|
||||
#### [Maintain AppLocker policies](applocker\maintain-applocker-policies.md)
|
||||
|
||||
@ -80,12 +80,6 @@ The following are examples of scenarios in which AppLocker can be used:
|
||||
|
||||
AppLocker can help you protect the digital assets within your organization, reduce the threat of malicious software being introduced into your environment, and improve the management of application control and the maintenance of application control policies.
|
||||
|
||||
## System requirements
|
||||
|
||||
AppLocker policies can only be configured on and applied to computers that are running on the supported versions and editions of the Windows operating system. Group Policy is required to distribute Group Policy Objects that contain AppLocker policies. For more info, see [Requirements to Use AppLocker](requirements-to-use-applocker.md).
|
||||
|
||||
AppLocker rules can be created on domain controllers.
|
||||
|
||||
## Installing AppLocker
|
||||
|
||||
AppLocker is included with enterprise-level editions of Windows. You can author AppLocker rules for a single computer or for a group of computers. For a single computer, you can author the rules by using the Local Security Policy editor (secpol.msc). For a group of computers, you can author the rules within a Group Policy Object by using the Group Policy Management Console (GPMC).
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Create an initial default policy (Windows 10)
|
||||
title: Create a Windows Defender Application Control policy from a reference computer (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
@ -32,6 +32,14 @@ For this example, you must initiate variables to be used during the creation pro
|
||||
Then create the WDAC policy by scanning the system for installed applications.
|
||||
The policy file is converted to binary format when it gets created so that Windows can interpret it.
|
||||
|
||||
## Overview of the process of creating Windows Defender Application Control policies
|
||||
|
||||
A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md).
|
||||
|
||||
Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
|
||||
|
||||
If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
|
||||
|
||||
> [!NOTE]
|
||||
> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy.
|
||||
|
||||
|
||||
@ -1,382 +0,0 @@
|
||||
---
|
||||
title: Create your Windows Defender Application Control (WDAC) planning document (Windows 10)
|
||||
description: This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 09/21/2017
|
||||
---
|
||||
|
||||
# Create your Windows Defender Application Control (WDAC) planning document
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server
|
||||
|
||||
This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document.
|
||||
|
||||
## The WDAC deployment design
|
||||
|
||||
The design process and the planning document help you investigate application usage in your organization and record your findings so you can effectively deploy and maintain application control policies by using WDAC.
|
||||
|
||||
You should have completed these steps in the design and planning process:
|
||||
|
||||
1. [Select types of rules to create](select-types-of-rules-to-create.md)
|
||||
2. [Plan for WDAC policy management](document-your-windows-defender-application-control-management-processes.md)
|
||||
|
||||
### WDAC planning document contents
|
||||
|
||||
Your planning document should contain:
|
||||
|
||||
- A list of business groups that will participate in the application control policy project, their requirements, a description of their business processes, and contact information.
|
||||
- Application control policy project target dates, both for planning and deployment.
|
||||
- A complete list of apps used by each business group (or organizational unit), including version information and installation paths.
|
||||
- What condition to apply to rules governing each application (or whether to use the default set provided by WDAC).
|
||||
- A strategy for using Group Policy to deploy the WDAC policies.
|
||||
- A strategy in processing the application usage events generated by WDAC.
|
||||
- A strategy to maintain and manage WDAC polices after deployment.
|
||||
|
||||
### Sample template for an WDAC planning document
|
||||
|
||||
You can use the following form to construct your own WDAC planning document.
|
||||
|
||||
**Business group**:
|
||||
|
||||
**Operating system environment**: (Windows and non-Windows)
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>Contacts</strong></p></td>
|
||||
<td align="left"><p>Business contact:</p></td>
|
||||
<td align="left"><p>Technical contact:</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>Other departments</strong></p></td>
|
||||
<td align="left"><p>In this business group:</p></td>
|
||||
<td align="left"><p>Affected by this project:</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>Security policies</strong></p></td>
|
||||
<td align="left"><p>Internal:</p></td>
|
||||
<td align="left"><p>Regulatory/compliance:</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>Business goals</strong></p></td>
|
||||
<td align="left"><p>Primary:</p></td>
|
||||
<td align="left"><p>Secondary:</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>Project target dates</strong></p></td>
|
||||
<td align="left"><p>Design signoff date:</p></td>
|
||||
<td align="left"><p>Policy deployment date:</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<strong>Rules</strong>
|
||||
|
||||
<table style="width:100%;">
|
||||
<colgroup>
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">Organizational unit</th>
|
||||
<th align="left">Implement WDAC?</th>
|
||||
<th align="left">Apps</th>
|
||||
<th align="left">Installation path</th>
|
||||
<th align="left">Use default rule or define new rule condition</th>
|
||||
<th align="left">Allow or deny</th>
|
||||
<th align="left">GPO name</th>
|
||||
<th align="left">Support policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p> </p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<strong>Event processing</strong>
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">WDAC event collection location</th>
|
||||
<th align="left">Archival policy</th>
|
||||
<th align="left">Analyzed?</th>
|
||||
<th align="left">Security policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p> </p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<strong>Policy maintenance</strong>
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">Rule update policy</th>
|
||||
<th align="left">App decommission policy</th>
|
||||
<th align="left">App version policy</th>
|
||||
<th align="left">App deployment policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p> </p></td>
|
||||
<td align="left"><p>Planned:</p>
|
||||
<p>Emergency:</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Example of a WDAC planning document
|
||||
|
||||
**Rules**
|
||||
|
||||
<table style="width:100%;">
|
||||
<colgroup>
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">Organizational unit</th>
|
||||
<th align="left">Implement WDAC?</th>
|
||||
<th align="left">Applications</th>
|
||||
<th align="left">Installation path</th>
|
||||
<th align="left">Use default rule or define new rule condition</th>
|
||||
<th align="left">Allow or deny</th>
|
||||
<th align="left">GPO name</th>
|
||||
<th align="left">Support policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Bank Tellers</p></td>
|
||||
<td align="left"><p>Teller-East and Teller-West</p></td>
|
||||
<td align="left"><p>Yes</p></td>
|
||||
<td align="left"><p>Teller Software</p></td>
|
||||
<td align="left"><p>C:\Program Files\Woodgrove\Teller.exe</p></td>
|
||||
<td align="left"><p>File is signed; create a publisher condition</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p>Tellers-WDACTellerRules</p></td>
|
||||
<td align="left"><p>Web help</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Windows files</p>
|
||||
<p></p></td>
|
||||
<td align="left"><p>C:\Windows</p></td>
|
||||
<td align="left"><p>Create a path exception to the default rule to exclude \Windows\Temp</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Help desk</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Human Resources</p></td>
|
||||
<td align="left"><p>HR-All</p></td>
|
||||
<td align="left"><p>Yes</p></td>
|
||||
<td align="left"><p>Check Payout</p></td>
|
||||
<td align="left"><p>C:\Program Files\Woodgrove\HR\Checkcut.exe</p></td>
|
||||
<td align="left"><p>File is signed; create a publisher condition</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p>HR-WDACHRRules</p></td>
|
||||
<td align="left"><p>Web help</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Time Sheet Organizer</p></td>
|
||||
<td align="left"><p>C:\Program Files\Woodgrove\HR\Timesheet.exe</p></td>
|
||||
<td align="left"><p>File is not signed; create a file hash condition</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Web help</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Internet Explorer 7</p></td>
|
||||
<td align="left"><p>C:\Program Files\Internet Explorer</p></td>
|
||||
<td align="left"><p>File is signed; create a publisher condition</p></td>
|
||||
<td align="left"><p>Deny</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Web help</p>
|
||||
<p></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Windows files</p></td>
|
||||
<td align="left"><p>C:\Windows</p></td>
|
||||
<td align="left"><p>Use the default rule for the Windows path</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Help desk</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<strong>Event processing</strong>
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">WDAC event collection location</th>
|
||||
<th align="left">Archival policy</th>
|
||||
<th align="left">Analyzed?</th>
|
||||
<th align="left">Security policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Bank Tellers</p></td>
|
||||
<td align="left"><p>Forwarded to: WDAC Event Repository on srvBT093</p></td>
|
||||
<td align="left"><p>Standard</p></td>
|
||||
<td align="left"><p>None</p></td>
|
||||
<td align="left"><p>Standard</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Human Resources</p></td>
|
||||
<td align="left"><p>DO NOT FORWARD. srvHR004</p></td>
|
||||
<td align="left"><p>60 months</p></td>
|
||||
<td align="left"><p>Yes, summary reports monthly to managers</p></td>
|
||||
<td align="left"><p>Standard</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<strong>Policy maintenance</strong>
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">Rule update policy</th>
|
||||
<th align="left">App decommission policy</th>
|
||||
<th align="left">App version policy</th>
|
||||
<th align="left">App deployment policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Bank Tellers</p></td>
|
||||
<td align="left"><p>Planned: Monthly through business office triage</p>
|
||||
<p>Emergency: Request through help desk</p></td>
|
||||
<td align="left"><p>Through business office triage</p>
|
||||
<p>30-day notice required</p></td>
|
||||
<td align="left"><p>General policy: Keep past versions for 12 months</p>
|
||||
<p>List policies for each application</p></td>
|
||||
<td align="left"><p>Coordinated through business office</p>
|
||||
<p>30-day notice required</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Human Resources</p></td>
|
||||
<td align="left"><p>Planned: Monthly through HR triage</p>
|
||||
<p>Emergency: Request through help desk</p></td>
|
||||
<td align="left"><p>Through HR triage</p>
|
||||
<p>30-day notice required</p></td>
|
||||
<td align="left"><p>General policy: Keep past versions for 60 months</p>
|
||||
<p>List policies for each application</p></td>
|
||||
<td align="left"><p>Coordinated through HR</p>
|
||||
<p>30-day notice required</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Additional resources
|
||||
|
||||
- [Windows Defender Application Control](windows-defender-application-control.md)
|
||||
|
||||
|
||||
@ -1,240 +0,0 @@
|
||||
---
|
||||
title: Document your application control management processes (Windows 10)
|
||||
description: This planning topic describes the WDAC policy maintenance information to record for your design document.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/21/2017
|
||||
---
|
||||
|
||||
# Document your application control management processes
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server
|
||||
|
||||
This planning topic describes the Windows Defender Application Control (WDAC) policy maintenance information to record for your design document.
|
||||
|
||||
## Record your findings
|
||||
|
||||
To complete this planning document, you should first complete the following steps:
|
||||
|
||||
3. [Select the types of rules to create](select-types-of-rules-to-create.md)
|
||||
4. [Plan for WDAC policy management](plan-windows-defender-application-control-management.md)
|
||||
|
||||
The three key areas to determine for WDAC policy management are:
|
||||
|
||||
1. Support policy
|
||||
|
||||
Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel know recommended troubleshooting steps and escalation points for your policy.
|
||||
|
||||
2. Event processing
|
||||
|
||||
Document whether events will be collected in a central location, how that store will be archived, and whether the events will be processed for analysis.
|
||||
|
||||
3. Policy maintenance
|
||||
|
||||
Detail how rules will be added to the policy, in which Group Policy Object (GPO) the rules should be defined, and how to modify rules when apps are retired, updated, or added.
|
||||
|
||||
The following table contains the added sample data that was collected when determining how to maintain and manage WDAC policies.
|
||||
|
||||
<table style="width:100%;">
|
||||
<colgroup>
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
<col width="11%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">Organizational unit</th>
|
||||
<th align="left">Implement WDAC?</th>
|
||||
<th align="left">Apps</th>
|
||||
<th align="left">Installation path</th>
|
||||
<th align="left">Use default rule or define new rule condition</th>
|
||||
<th align="left">Allow or deny</th>
|
||||
<th align="left">GPO name</th>
|
||||
<th align="left">Support policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Bank Tellers</p></td>
|
||||
<td align="left"><p>Teller-East and Teller-West</p></td>
|
||||
<td align="left"><p>Yes</p></td>
|
||||
<td align="left"><p>Teller Software</p></td>
|
||||
<td align="left"><p>C:\Program Files\Woodgrove\Teller.exe</p></td>
|
||||
<td align="left"><p>File is signed; create a publisher condition</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p>Tellers-WDACTellerRules</p></td>
|
||||
<td align="left"><p>Web help</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Windows files</p>
|
||||
<p></p></td>
|
||||
<td align="left"><p>C:\Windows</p></td>
|
||||
<td align="left"><p>Create a path exception to the default rule to exclude \Windows\Temp</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Help desk</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Human Resources</p></td>
|
||||
<td align="left"><p>HR-All</p></td>
|
||||
<td align="left"><p>Yes</p></td>
|
||||
<td align="left"><p>Check Payout</p></td>
|
||||
<td align="left"><p>C:\Program Files\Woodgrove\HR\Checkcut.exe</p></td>
|
||||
<td align="left"><p>File is signed; create a publisher condition</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p>HR-WDACHRRules</p></td>
|
||||
<td align="left"><p>Web help</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Time Sheet Organizer</p></td>
|
||||
<td align="left"><p>C:\Program Files\Woodgrove\HR\Timesheet.exe</p></td>
|
||||
<td align="left"><p>File is not signed; create a file hash condition</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Web help</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Internet Explorer 7</p></td>
|
||||
<td align="left"><p>C:\Program Files\Internet Explorer</p></td>
|
||||
<td align="left"><p>File is signed; create a publisher condition</p></td>
|
||||
<td align="left"><p>Deny</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Web help</p>
|
||||
<p></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Windows files</p></td>
|
||||
<td align="left"><p>C:\Windows</p></td>
|
||||
<td align="left"><p>Use the default rule for the Windows path</p></td>
|
||||
<td align="left"><p>Allow</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>Help desk</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
The following two tables illustrate examples of documenting considerations to maintain and manage WDAC policies.
|
||||
|
||||
**Event processing policy**
|
||||
|
||||
One discovery method for app usage is to use Audit mode. This will write events to the CodeIntegrity log, which can be managed and analyzed like other Windows logs.
|
||||
|
||||
The following table is an example of what to consider and record.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">WDAC event collection location</th>
|
||||
<th align="left">Archival policy</th>
|
||||
<th align="left">Analyzed?</th>
|
||||
<th align="left">Security policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Bank Tellers</p></td>
|
||||
<td align="left"><p>Forwarded to: CodeIntegrity Event Repository on srvBT093</p></td>
|
||||
<td align="left"><p>Standard</p></td>
|
||||
<td align="left"><p>None</p></td>
|
||||
<td align="left"><p>Standard</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Human Resources</p></td>
|
||||
<td align="left"><p>DO NOT FORWARD. srvHR004</p></td>
|
||||
<td align="left"><p>60 months</p></td>
|
||||
<td align="left"><p>Yes, summary reports monthly to managers</p></td>
|
||||
<td align="left"><p>Standard</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<strong>Policy maintenance policy</strong>
|
||||
When applications are identified and policies are created for application control, then you can begin documenting how you intend to update those policies.
|
||||
The following table is an example of what to consider and record.
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Business group</th>
|
||||
<th align="left">Rule update policy</th>
|
||||
<th align="left">Application decommission policy</th>
|
||||
<th align="left">Application version policy</th>
|
||||
<th align="left">Application deployment policy</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Bank Tellers</p></td>
|
||||
<td align="left"><p>Planned: Monthly through business office triage</p>
|
||||
<p>Emergency: Request through help desk</p></td>
|
||||
<td align="left"><p>Through business office triage</p>
|
||||
<p>30-day notice required</p></td>
|
||||
<td align="left"><p>General policy: Keep past versions for 12 months</p>
|
||||
<p>List policies for each application</p></td>
|
||||
<td align="left"><p>Coordinated through business office</p>
|
||||
<p>30-day notice required</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Human Resources</p></td>
|
||||
<td align="left"><p>Planned: Monthly through HR triage</p>
|
||||
<p>Emergency: Request through help desk</p></td>
|
||||
<td align="left"><p>Through HR triage</p>
|
||||
<p>30-day notice required</p></td>
|
||||
<td align="left"><p>General policy: Keep past versions for 60 months</p>
|
||||
<p>List policies for each application</p></td>
|
||||
<td align="left"><p>Coordinated through HR</p>
|
||||
<p>30-day notice required</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## Next steps
|
||||
|
||||
After you determine your application control management strategy for each business group, [create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md).
|
||||
@ -17,20 +17,57 @@ manager: dansimp
|
||||
ms.date: 02/21/2018
|
||||
---
|
||||
|
||||
# Plan for Windows Defender Application Control policy management
|
||||
# Plan for Windows Defender Application Control lifecycle policy management
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows Server 2016 and above
|
||||
|
||||
This topic for describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies.
|
||||
This topic describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies.
|
||||
|
||||
## Policy management
|
||||
## Policy XML lifecycle management
|
||||
|
||||
Before you begin the deployment process, consider how the WDAC rules will be managed. Developing a process for managing WDAC rules helps assure that WDAC continues to effectively control how applications are allowed to run in your organization.
|
||||
Before you begin deploying WDAC, consider how your policies will be managed and maintained over time. Developing a process for managing WDAC policies helps assure that WDAC continues to effectively control how applications are allowed to run in your organization.
|
||||
|
||||
### Application and user support policy
|
||||
<!-- We should insert a diagram to show this visually -->
|
||||
Most WDAC policies will evolve over time and proceed through a set of identifiable phases during their lifetime. Typically, these phases include:
|
||||
|
||||
1. [Define (or refine) the "circle-of-trust"](understand-windows-defender-application-control-policy-design-decisions.md) for the policy and build an audit mode version of the policy XML.
|
||||
2. Deploy the audit mode policy to intended computers.
|
||||
3. Monitor audit block events from the intended computers and add/edit/delete rules as needed to address unexpected/unwanted blocks.
|
||||
4. Repeat steps 2-3 until the remaining block events meet expectations.
|
||||
5. Generate the enforced mode version of the policy.
|
||||
6. Deploy the enforced mode policy to intended computers. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly.
|
||||
7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes.
|
||||
|
||||
### Keep WDAC policies in a source control or document management solution
|
||||
|
||||
To effectively manage WDAC policies, you should store and maintain your policy XML documents in a central repository that is accessible to everyone responsible for WDAC policy management. We recommend a source control solution such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration), which provide version control and allow you to specify metadata about the XML documents.
|
||||
|
||||
### Set PolicyName, PolicyID, and Version metadata for each policy
|
||||
|
||||
Use the [Set-CIPolicyIDInfo](https://docs.microsoft.com/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing WDAC events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system auto-generate a unique ID for the policy.
|
||||
|
||||
> [!NOTE]
|
||||
> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-windows-defender-application-control-policies.md) on computers running Windows 10, version 1903 and above. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10.
|
||||
> PolicyID should be set only once per policy and use different PolicyID's for the audit and enforced mode versions of each policy.
|
||||
|
||||
In addition, we recommend using the [Set-CIPolicyVersion](https://docs.microsoft.com/powershell/module/configci/set-cipolicyversion) cmdlet to increment the policy's internal version number when you make changes to the policy. The version must be defined as a standard four-part version string (e.g. "1.0.0.0").
|
||||
|
||||
### Policy rule updates
|
||||
|
||||
As new apps are deployed or existing apps are updated by the software publisher, you may need to make revisions to your rules to ensure that these apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you leverage WDAC [managed installer](use-windows-defender-application-control-with-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you are less likely to need policy updates.
|
||||
|
||||
## WDAC event management
|
||||
|
||||
Each time that a process is blocked by WDAC, events will be written to either the CodeIntegrity\Operational or the AppLocker\MSI and Script Windows event logs. The event details which file tried to run, the attributes of that file and its signatures, and the process that attempted to run the blocked file.
|
||||
|
||||
Collecting these events in a central location can help you maintain your WDAC policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](https://go.microsoft.com/fwlink/p/?LinkId=145012).
|
||||
|
||||
Additionally, WDAC events are collected by [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) and can be queried using the [advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md) feature.
|
||||
|
||||
## Application and user support policy
|
||||
|
||||
Considerations include:
|
||||
|
||||
@ -39,7 +76,7 @@ Considerations include:
|
||||
- How are existing rules updated?
|
||||
- Are events forwarded for review?
|
||||
|
||||
**Help desk support**
|
||||
### Help desk support
|
||||
|
||||
If your organization has an established help desk support department in place, consider the following when deploying WDAC policies:
|
||||
|
||||
@ -48,49 +85,17 @@ If your organization has an established help desk support department in place, c
|
||||
- Who are the contacts in the support department?
|
||||
- How will the support department resolve application control issues between the end user and those who maintain the WDAC rules?
|
||||
|
||||
**End-user support**
|
||||
### End-user support
|
||||
|
||||
Because WDAC is preventing unapproved apps from running, it is important that your organization carefully plan how to provide end-user support. Considerations include:
|
||||
|
||||
- Do you want to use an intranet site as a first line of support for users who have tried to run a blocked app?
|
||||
- How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app?
|
||||
|
||||
**WDAC event management**
|
||||
|
||||
Each time that a process requests permission to run, WDAC creates an event in the CodeIntegrity log. The event details which file tried to run, the attributes of that file, and the user that initiated the request.
|
||||
|
||||
Collecting these events in a central location can help you maintain your WDAC policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](https://go.microsoft.com/fwlink/p/?LinkId=145012).
|
||||
|
||||
### Policy maintenance
|
||||
|
||||
As new apps are deployed or existing apps are updated by the software publisher, you will need to make revisions to your rule collections to ensure that the policy is current.
|
||||
|
||||
To ensure version control when modifying an WDAC policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013) (https://go.microsoft.com/fwlink/p/?LinkId=145013).
|
||||
|
||||
**New version of a supported app**
|
||||
|
||||
When a new version of an app is deployed in the organization, you need to determine whether to continue to support the previous version of that app. To add the new version, you might only need to create a new rule for each file that is associated with the app. If you are using publisher conditions and the version is not specified, then the existing rule or rules might be sufficient to allow the updated file to run. You must ensure, however, that the updated app has not altered the file names or added files to support new functionality. If so, then you must modify the existing rules or create new rules. To continue to reuse a publisher-based rule without a specific file version, you must also ensure that the file's digital signature is still identical to the previous version—the publisher, product name, and file name (if configured in your rule) must all match for the rule to be correctly applied.
|
||||
|
||||
To determine whether a file has been modified during an app update, review the publisher's release details provided with the update package. You can also review the publisher's web page to retrieve this information. Each file can also be inspected to determine the version.
|
||||
|
||||
For files that are allowed or denied with file hash conditions, you must retrieve the new file hash. To add support for a new version and maintain support for the older version, you can either create a new file hash rule for the new version or edit the existing rule and add the new file hash to the list of conditions.
|
||||
|
||||
For files with path conditions, you should verify that the installation path has not changed from what is stated in the rule. If the path has changed, you need to update the rule before installing the new version of the app
|
||||
|
||||
**Recently deployed app**
|
||||
|
||||
To support a new app, you must add one or more rules to the existing WDAC policy.
|
||||
|
||||
**App is no longer supported**
|
||||
|
||||
If your organization has determined that it will no longer support an application that has WDAC rules associated with it, the easiest way to prevent users from running the app is to delete these rules.
|
||||
|
||||
## Next steps
|
||||
## Document your plan
|
||||
|
||||
After deciding how your organization will manage your WDAC policy, record your findings.
|
||||
|
||||
- **End-user support policy.** Document the process that you will use for handling calls from users who have attempted to run a blocked app, and ensure that support personnel have clear escalation steps so that the administrator can update the WDAC policy, if necessary.
|
||||
- **Event processing.** Document whether events will be collected in a central location called a store, how that store will be archived, and whether the events will be processed for analysis.
|
||||
- **Policy maintenance.** Detail how rules will be added to the policy and in which GPO the rules are defined.
|
||||
|
||||
For information and steps how to document your processes, see [Document your application control management processes](document-your-windows-defender-application-control-management-processes.md).
|
||||
- **Policy management.** Detail what policies are planned, how they will be managed, and how rules will be maintained over time.
|
||||
|
||||
@ -17,43 +17,35 @@ manager: dansimp
|
||||
ms.date: 04/20/2018
|
||||
---
|
||||
|
||||
# Deploy Windows Defender Application Control policy rules and file rules
|
||||
# Understand WDAC policy rules and file rules
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows Server 2016 and above
|
||||
|
||||
Windows Defender Application Control (WDAC) provides control over a computer running Windows 10 by using policies that specify whether a driver or application is trusted and can be run. A policy includes *policy rules* that control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a WDAC policy, and *file rules* (or *file rule levels*) that specify the level at which applications will be identified and trusted.
|
||||
|
||||
## Overview of the process of creating Windows Defender Application Control policies
|
||||
|
||||
A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md).
|
||||
|
||||
Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
|
||||
|
||||
If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
|
||||
|
||||
## Windows Defender Application Control policy rules
|
||||
|
||||
To modify the policy rule options of an existing WDAC policy, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
|
||||
To modify the policy rule options of an existing WDAC policy XML, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
|
||||
|
||||
- To ensure that UMCI is enabled for a WDAC policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
|
||||
|
||||
`Set-RuleOption -FilePath <Path to policy> -Option 0`
|
||||
`Set-RuleOption -FilePath <Path to policy XML> -Option 0`
|
||||
|
||||
Note that a policy that was created without the `-UserPEs` option is empty of user mode executables, that is, applications. If you enable UMCI (Option 0) for such a policy and then attempt to run an application, Windows Defender Application Control will see that the application is not on its list (which is empty of applications), and respond. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. To create a policy that includes user mode executables (applications), when you run `New-CIPolicy`, include the `-UserPEs` option.
|
||||
|
||||
- To disable UMCI on an existing WDAC policy, delete rule option 0 by running the following command:
|
||||
|
||||
`Set-RuleOption -FilePath <Path to policy> -Option 0 -Delete`
|
||||
`Set-RuleOption -FilePath <Path to policy XML> -Option 0 -Delete`
|
||||
|
||||
You can set several rule options within a WDAC policy. Table 2 describes each rule option.
|
||||
You can set several rule options within a WDAC policy. Table 1 describes each rule option.
|
||||
|
||||
> [!NOTE]
|
||||
> We recommend that you use **Enabled:Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. To allow these applications, you can capture the policy information from the event log, and then merge that information into the existing policy. When the **Enabled:Audit Mode** is deleted, the policy runs in enforced mode.
|
||||
|
||||
**Table 2. Windows Defender Application Control policy - policy rule options**
|
||||
**Table 1. Windows Defender Application Control policy - policy rule options**
|
||||
|
||||
| Rule option | Description |
|
||||
|------------ | ----------- |
|
||||
@ -68,7 +60,7 @@ You can set several rule options within a WDAC policy. Table 2 describes each ru
|
||||
| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. |
|
||||
| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. |
|
||||
| **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
|
||||
| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to Restricted Language Mode. NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. |
|
||||
| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. |
|
||||
| **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. |
|
||||
| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as System Center Configuration Manager, that has been defined as a managed installer. |
|
||||
| **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). |
|
||||
@ -82,15 +74,15 @@ You can set several rule options within a WDAC policy. Table 2 describes each ru
|
||||
|
||||
File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as fine-tuned as the hash of each binary or as general as a CA certificate. You specify file rule levels both when you create a new WDAC policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, WDAC policies combine their file rules, so that any application that would be allowed by either of the original policies will be allowed by the combined policy.
|
||||
|
||||
Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario.
|
||||
Each file rule level has its benefit and disadvantage. Use Table 2 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario.
|
||||
|
||||
Table 3. Windows Defender Application Control policy - file rule levels
|
||||
**Table 2. Windows Defender Application Control policy - file rule levels**
|
||||
|
||||
| Rule level | Description |
|
||||
|----------- | ----------- |
|
||||
| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
|
||||
| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
|
||||
| **FilePath** | Beginning with Windows 10 version 1903, this specifies rules that allow execution of binaries contained in paths that are admin-writeable only. By default, WDAC performs a user-writeability check at runtime which ensures that the current permissions on the specified filepath and its parent directories (recursively) do not allow standard users write access. <br> Note that filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. IT Pros should take care while crafting path rules to allow paths that they know are likely to remain to be admin-writeable only and deny execution from sub-directories where standard users can modify ACLs on the folder. <br> There is a defined list of SIDs which are recognized as admins (below). If a file has write permissions for a SID not in this list, the file will be flagged as user writeable. <br> S-1-3-0; S-1-5-18; S-1-5-19; S-1-5-20; S-1-5-32-544; S-1-5-32-549; S-1-5-32-550; S-1-5-32-551; S-1-5-32-577; S-1-5-32-559; S-1-5-32-568; S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394; S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523. <br> Wildcards can be used at the beginning or end of a path rule: only one wildcard is allowed per path rule. Wildcards placed at the end of a path authorize all files in that path and its subdirectories recursively (ex. C:\\* would include C:\foo\\* ). Wildcards placed at the beginning of a path scan all directories for files with a specific name (ex. \*\bar.exe would allow C:\bar.exe and C:\foo\bar.exe). Wildcards in the middle of a path are not supported (ex. C:\\*\foo.exe). Without a wildcard, the rule will allow only a specific file (ex. C:\foo\bar.exe). <br> Supported macros: %WINDIR%, %SYSTEM32%, %OSDRIVE%.|
|
||||
| **FilePath** | Beginning with Windows 10 version 1903, this specifies rules that allow execution of binaries contained under specific file path locations. Additional information about FilePath level rules can be found below. |
|
||||
> [!NOTE]
|
||||
> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
|
||||
@ -119,3 +111,20 @@ As part of normal operations, they will eventually install software updates, or
|
||||
|
||||
They could also choose to create a catalog that captures information about the unsigned internal application, then sign and distribute the catalog. Then the internal application could be handled by WDAC policies in the same way as any other signed application. An update to the internal application would only require that the catalog be regenerated, signed, and distributed (no restarts would be required).
|
||||
|
||||
## More information about filepath rules
|
||||
|
||||
Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. IT Pros should take care while crafting path rules to allow paths that they know are likely to remain to be admin-writeable only and deny execution from sub-directories where standard users can modify ACLs on the folder.
|
||||
|
||||
By default, WDAC performs a user-writeability check at runtime which ensures that the current permissions on the specified filepath and its parent directories (recursively) do not allow standard users write access.
|
||||
|
||||
There is a defined list of SIDs which WDAC recognizes as admins. If a filepath allows write permissions for any SID not in this list, the filepath is considered to be user-writeable even if the additional SID is associated to a custom admin user. To handle these special cases, you can override WDAC's runtime admin-writeable check with the **Disabled:Runtime FilePath Rule Protection** option described above.
|
||||
|
||||
WDAC's list of well-known admin SIDs are: <br>
|
||||
S-1-3-0; S-1-5-18; S-1-5-19; S-1-5-20; S-1-5-32-544; S-1-5-32-549; S-1-5-32-550; S-1-5-32-551; S-1-5-32-577; S-1-5-32-559; S-1-5-32-568; S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394; S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523.
|
||||
|
||||
When generating filepath rules using [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy), a unique, fully-qualified path rule is generated for every file discovered in the scanned path(s). To create rules that instead allow all files under a specified folder path, use [New-CIPolicyRule](https://docs.microsoft.com/powershell/module/configci/new-cipolicyrule) to define rules containing wildcards and include them in your [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy) scan using the -Rules switch.
|
||||
|
||||
Wildcards can be used at the beginning or end of a path rule: only one wildcard is allowed per path rule. Wildcards placed at the end of a path authorize all files in that path and its subdirectories recursively (ex. C:\\* would include C:\foo\\* ). Wildcards placed at the beginning of a path will allow the exact specified filename under any path (ex. \*\bar.exe would allow C:\bar.exe and C:\foo\bar.exe). Wildcards in the middle of a path are not supported (ex. C:\\*\foo.exe). Without a wildcard, the rule will allow only a specific file (ex. C:\foo\bar.exe). <br> Supported macros: %WINDIR%, %SYSTEM32%, %OSDRIVE%.
|
||||
|
||||
> [!NOTE]
|
||||
> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
|
||||
@ -25,55 +25,62 @@ ms.date: 02/08/2018
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows Server 2016 and above
|
||||
|
||||
This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment.
|
||||
This topic is for the IT professional and lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment.
|
||||
|
||||
When you begin the design and planning process, you should consider the ramifications of your design choices. The resulting decisions will affect your policy deployment scheme and subsequent application control policy maintenance.
|
||||
|
||||
You should consider using WDAC as part of your organization's application control policies if all the following are true:
|
||||
You should consider using WDAC as part of your organization's application control policies if the following are true:
|
||||
|
||||
- You have deployed or plan to deploy the supported versions of Windows in your organization.
|
||||
- You need improved control over the access to your organization's applications and the data your users access.
|
||||
- The number of applications in your organization is known and manageable.
|
||||
- Your organization has a well-defined process for application management and deployed.
|
||||
- You have resources to test policies against the organization's requirements.
|
||||
- You have resources to involve Help Desk or to build a self-help process for end-user application access issues.
|
||||
- The group's requirements for productivity, manageability, and security can be controlled by restrictive policies.
|
||||
|
||||
The following questions are not in priority or sequential order. They should be considered when you deploy application control policies (as appropriate for your targeted environment).
|
||||
## Decide what policies to create
|
||||
|
||||
### Which apps do you need to control in your organization?
|
||||
Beginning with Windows 10, version 1903, WDAC allows [multiple simultaneous policies](deploy-multiple-windows-defender-application-control-policies.md) to be applied to each device. While this opens up many new use cases for organizations, your policy management can easily become unwieldy without a well-thought-out plan for the number and types of policies to create.
|
||||
|
||||
You might need to control a limited number of apps because they access sensitive data, or you might have to exclude all applications except those that are sanctioned for business purposes. There might be certain business groups that require strict control, and others that promote independent application usage.
|
||||
The first step is to define the desired "circle-of-trust" for your WDAC policies. By "circle-of-trust", we mean a description of the business intent of the policy expressed in natural language. This "circle-of-trust" definition will guide you as you create the actual policy rules for your policy XML.
|
||||
|
||||
For example, the DefaultWindows policy, which can be found under %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies, establishes a "circle-of-trust" that allows Windows, 3rd-party hardware and software kernel drivers, and applications from the Microsoft Store.
|
||||
|
||||
Microsoft Endpoint Configuration Manager (previously known as System Center Configuration Manager (SCCM)), uses the DefaultWindows policy as the basis for its policy but then modifies the policy rules to allow SCCM and its dependencies, sets the managed installer policy rule, and additionally configures SCCM as a managed installer. It also can optionally authorize apps with positive reputation and perform a one-time scan of folder paths specified by the SCCM administrator which adds rules for any apps found in the specified paths on the managed endpoint. This establishes the "circle-of-trust" for SCCM's native WDAC integration.
|
||||
|
||||
The following questions can help you plan your WDAC deployment and determine the right "circle-of-trust" for your policies. They are not in priority or sequential order and are not meant to be an exhaustive set of design considerations.
|
||||
|
||||
## WDAC design considerations
|
||||
|
||||
### How are apps managed and deployed in your organization?
|
||||
|
||||
Organizations with well-defined, centrally-managed app management and deployment processes can create more restrictive, more secure policies. Other organizations may be able to deploy WDAC with more relaxed rules or may choose to deploy WDAC in audit mode to gain better visibility to the apps being used in their organization.
|
||||
|
||||
| Possible answers | Design considerations|
|
||||
| - | - |
|
||||
| Control all apps | WDAC policies control applications by creating an allowed list of applications. Exceptions are also possible. WDAC policies can only be applied to applications installed on computers running Windows 10 . |
|
||||
| Control specific apps | When you create WDAC rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. WDAC policies can only be applied to apps installed on computers running Windows 10 or Windows Server 2016. |
|
||||
|Control only Classic Windows applications, only Universal Windows apps, or both| WDAC policies control apps by creating an allowed list of apps based on code signing certificate and\or file hash information. Because Universal Windows apps are all signed by the Windows Store, Classic Windows applications and Universal Windows apps can be controlled together. WDAC policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Microsoft Store, but Classic Windows applications can be controlled with WDAC on Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.|
|
||||
| Control apps by business group | WDAC policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). |
|
||||
| Control apps by computer, not user | WDAC is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your WDAC planning. Otherwise, you will have to identify users, their computers, and their app access requirements.|
|
||||
|Understand app usage, but there is no need to control any apps yet | WDAC policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the CodeIntegrity log in Event Viewer to create WDAC policies.|
|
||||
| All apps are centrally managed and deployed using endpoint management tools like [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). | Organizations that centrally manage all apps are best-suited for application control. WDAC options like [managed installer](use-windows-defender-application-control-with-managed-installer.md) can make it easy to authorize apps that are deployed by the organization's app distribution management solution. |
|
||||
| Some apps are centrally managed and deployed, but teams can install additional apps for their members. | [Supplemental policies](deploy-multiple-windows-defender-application-control-policies.md) can be used to allow team-specific exceptions to your core organization-wide WDAC policy. Alternatively, teams can leverage managed installers to install their team-specific apps or admin-only file path rules can be used to allow apps installed by admin users. |
|
||||
| Users and teams are free to download and install apps but the organization wants to restrict that right to prevalent and reputable apps only. | WDAC can integrate with Microsoft's [Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md) (the same source of intelligence that powers Windows Defender Antivirus and SmartScreen) to allow only apps and binaries that have positive reputation. |
|
||||
| Users and teams are free to download and install apps without restriction. | WDAC policies can be deployed in audit mode to gain insight into the apps and binaries running in your organization without impacting user and team productivity.|
|
||||
|
||||
### How do you currently control app usage in your organization?
|
||||
### Are internally-developed line-of-business (LOB) apps and apps developed by 3rd parties digitally signed?
|
||||
|
||||
Most organizations have evolved app control policies and methods over time. With heightened security concerns and an emphasis on tighter IT control over desktop use, your organization might decide to consolidate app control practices or design a comprehensive application control scheme. WDAC includes improvements over AppLocker and SRP in the architecture and management of application control policies.
|
||||
Traditional Win32 apps on Windows can run without being digitally signed. This practice can expose Windows devices to malicious or tampered code and presents a security vulnerability to your Windows devices. Adopting code-signing as part of your organization's app development practices or augmenting apps with signed catalog files as part of your app ingestion and distribution can greatly improve the integrity and security of apps used.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Security polices (locally set or through Mobile Device Management (MDM) or Group Policy) | Using WDAC requires increased effort in planning to create correct policies, but this results in a simpler distribution method.|
|
||||
| Non-Microsoft app control software | Using WDAC requires a complete app control policy evaluation and implementation.|
|
||||
| Managed usage by group or OU | Using WDAC requires a complete app control policy evaluation and implementation.|
|
||||
| Authorization Manager or other role-based access technologies | Using WDAC requires a complete app control policy evaluation and implementation.|
|
||||
| Other | Using WDAC requires a complete app control policy evaluation and implementation.|
|
||||
| All apps used in your organization must be signed. | Organizations that enforce [codesigning](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) for all executable code are best-positioned to protect their Windows computers from malicious code execution. WDAC rules can be created to authorize apps and binaries from the organization's internal development teams and from trusted independent software vendors (ISV). |
|
||||
| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows 10 tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific app catalog signatures to existing apps as a part of the app deployment process which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed app catalogs. |
|
||||
|
||||
### Are there specific groups in your organization that need customized application control policies?
|
||||
|
||||
Most business groups or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization.
|
||||
Most business teams or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. There is overhead in managing policies which may lead you to choose between broad, organization-wide policies and multiple team-specific policies.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Yes | For each group, you need to create a list that includes their application control requirements. Although this may increase the planning time, it will most likely result in a more effective deployment.<br/>If your GPO structure is not currently configured so that you can apply different policies to specific groups, you can alternatively apply WDAC rules in a GPO to specific user groups.|
|
||||
| Yes | WDAC policies can be created unique per team, or team-specific supplemental policies can be used to expand what is allowed by a common, centrally-defined base policy.|
|
||||
| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.|
|
||||
|
||||
### Does your IT department have resources to analyze application usage, and to design and manage the policies?
|
||||
@ -83,7 +90,7 @@ The time and resources that are available to you to perform the research and ana
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.|
|
||||
| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. |
|
||||
| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. |
|
||||
|
||||
### Does your organization have Help Desk support?
|
||||
|
||||
@ -93,56 +100,3 @@ Preventing your users from accessing known, deployed, or personal applications w
|
||||
| - | - |
|
||||
| Yes | Involve the support department early in the planning phase because your users may inadvertently be blocked from using their applications, or they may seek exceptions to use specific applications. |
|
||||
| No | Invest time in developing online support processes and documentation before deployment. |
|
||||
|
||||
|
||||
### Do you know what applications require restrictive policies?
|
||||
Any successful application control policy implementation is based on your knowledge and understanding of app usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the apps that access that data.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Yes | You should determine the application control priorities for a business group and then attempt to design the simplest scheme for their application control policies. |
|
||||
| No | You will have to perform an audit and requirements gathering project to discover the application usage. WDAC provides the means to deploy policies in audit mode.|
|
||||
|
||||
### How do you deploy or sanction applications (upgraded or new) in your organization?
|
||||
|
||||
Implementing a successful application control policy is based on your knowledge and understanding of application usage within the organization or business group. In addition, the application control design is dependent on the security requirements for data and the applications that access that data. Understanding the upgrade and deployment policy will help shape the construction of the application control policies.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Ad hoc | You need to gather requirements from each group. Some groups might want unrestricted access or installation, while other groups might want strict controls.|
|
||||
| Strict written policy or guidelines to follow | You need to develop WDAC rules that reflect those policies, and then test and maintain the rules. |
|
||||
| No process in place | You need to determine if you have the resources to develop an application control policy, and for which groups. |
|
||||
|
||||
### What are your organization's priorities when implementing application control policies?
|
||||
|
||||
Some organizations will benefit from application control policies as shown by an increase in productivity or conformance, while others will be hindered in performing their duties. Prioritize these aspects for each group to allow you to evaluate the effectiveness of WDAC.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Productivity: The organization assures that tools work and required applications can be installed. | To meet innovation and productivity goals, some groups require the ability to install and run a variety of software from different sources, including software that they developed. Therefore, if innovation and productivity is a high priority, managing application control policies through an allowed list might be time consuming and an impediment to progress. |
|
||||
| Management: The organization is aware of and controls the apps it supports. | In some business groups, application usage can be managed from a central point of control. WDAC policies can be built into a GPO for that purpose. This shifts the burden of app access to the IT department, but it also has the benefit of controlling the number of apps that can be run and controlling the versions of those apps|
|
||||
| Security: The organization must protect data in part by ensuring that only approved apps are used. | WDAC can help protect data by allowing a defined set of users access to apps that access the data. If security is the top priority, the application control policies will be the most restrictive.|
|
||||
|
||||
### How are apps currently accessed in your organization?
|
||||
|
||||
WDAC is very effective for organizations that have application restriction requirements if they have environments with a simple topography and application control policy goals that are straightforward. For example, WDAC can benefit an environment where non-employees have access to computers that are connected to the organizational network, such as a school or library. Large organizations also benefit from WDAC policy deployment when the goal is to achieve a detailed level of control on the desktop computers with a relatively small number of applications to manage, or when the applications are manageable with a small number of rules.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Users run without administrative rights. | Apps are installed by using an installation deployment technology.|
|
||||
| WDAC can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using WDAC to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.<br/>**Note: **WDAC can also be effective in helping create standardized desktops in organizations where users run as administrators. | Users must be able to install applications as needed.
|
||||
| Users currently have administrator access, and it would be difficult to change this.|Enforcing WDAC rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using WDAC or to implement the audit only enforcement setting.|
|
||||
|
||||
### Is the structure in Active Directory Domain Services based on the organization's hierarchy?
|
||||
|
||||
Designing application control policies based on an organizational structure that is already built into Active Directory Domain Services (AD DS) is easier than converting the existing structure to an organizational structure.
|
||||
Because the effectiveness of application control policies is dependent on the ability to update policies, consider what organizational work needs to be accomplished before deployment begins.
|
||||
|
||||
| Possible answers | Design considerations |
|
||||
| - | - |
|
||||
| Yes | WDAC rules can be developed and implemented through Group Policy, based on your AD DS structure.|
|
||||
| No | The IT department must create a scheme to identify how application control policies can be applied to the correct user or computer.|
|
||||
|
||||
## Record your findings
|
||||
|
||||
The next step in the process is to record and analyze your answers to the preceding questions. If WDAC is the right solution for your goals, you can set your application control policy objectives and plan your WDAC rules.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Application Control design guide (Windows 10)
|
||||
description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security.
|
||||
description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows 10 devices.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
@ -22,10 +22,20 @@ ms.date: 02/20/2018
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server
|
||||
- Windows Server 2016 and above
|
||||
|
||||
This guide covers design and planning for Windows Defender Application Control (WDAC). It is intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization.
|
||||
|
||||
## Plan for success
|
||||
|
||||
A common refrain you may hear about application control is that it is "too hard". While it is true that application control is not as simple as flipping a switch, organizations can be very successful if they take a methodical approach and carefully plan their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning:
|
||||
|
||||
- Executive sponsorship and organizational buy-in is in place.
|
||||
- There is a clear **business** objective for using application control and it is not being planned as a purely technical problem from IT.
|
||||
- The organization has a plan to handle potential helpdesk support requests for users who are blocked from running some apps.
|
||||
- The organization has considered where application control can be most useful (e.g. securing sensitive workloads or business functions) and also where it may be difficult to achieve (e.g. developer workstations).
|
||||
|
||||
Once these business factors are in place, you are ready to begin planning your WDAC deployment. The following topics can help guide you through your planning process.
|
||||
|
||||
## In this section
|
||||
|
||||
@ -34,6 +44,5 @@ This guide covers design and planning for Windows Defender Application Control (
|
||||
| [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. |
|
||||
| [Select the types of rules to create](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. |
|
||||
| [Plan for WDAC policy management](plan-windows-defender-application-control-management.md) | This topic describes the decisions you need to make to establish the processes for managing and maintaining WDAC policies. |
|
||||
| [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. |
|
||||
|
||||
After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Application Control (WDAC) (Windows 10)
|
||||
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
title: Application Control for Windows
|
||||
description: Application Control restricts which applications users are allowed to run and the code that runs in the system core.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
@ -17,7 +17,7 @@ manager: dansimp
|
||||
ms.date: 01/08/2019
|
||||
---
|
||||
|
||||
# Windows Defender Application Control
|
||||
# Application Control
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -26,35 +26,76 @@ ms.date: 01/08/2019
|
||||
- Windows Server 2019
|
||||
|
||||
With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks.
|
||||
In most organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative.
|
||||
|
||||
However, when a user runs a process, that process has the same level of access to data that the user has.
|
||||
As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software.
|
||||
In most organizations, information is the most valuable asset, and ensuring that only approved users have access to that information is imperative. However, when a user runs a process, that process has the same level of access to data that the user has. As a result, sensitive information could easily be deleted or transmitted out of the organization if a user knowingly or unknowingly runs malicious software.
|
||||
|
||||
Application control is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions.
|
||||
Specifically, application control moves away from the traditional application trust model where all applications are assumed trustworthy by default to one where applications must earn trust in order to run.
|
||||
Many organizations, like the Australian Signals Directorate, understand this and frequently cite application control as one of the most effective means for addressing the threat of executable file-based malware (.exe, .dll, etc.).
|
||||
Application control can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel). Application control policies can also block unsigned scripts and MSIs, and restrict Windows PowerShell to run in [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes).
|
||||
|
||||
Windows Defender Application Control (WDAC) can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel).
|
||||
WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs in [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-5.1).
|
||||
Application control is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions. Specifically, application control moves away from an application trust model where all applications are assumed trustworthy to one where applications must earn trust in order to run. Many organizations, like the Australian Signals Directorate, understand this and frequently cite application control as one of the most effective means for addressing the threat of executable file-based malware (.exe, .dll, etc.).
|
||||
|
||||
> [!NOTE]
|
||||
> Although application control can significantly harden your computers against malicious code, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
|
||||
|
||||
Windows 10 includes two technologies that can be used for application control depending on your organization's specific scenarios and requirements:<br>
|
||||
- **Windows Defender Application Control**; and
|
||||
- **AppLocker**
|
||||
|
||||
## Windows Defender Application Control
|
||||
|
||||
Windows Defender Application Control (WDAC) was introduced with Windows 10 and allows organizations to control what drivers and applications are allowed to run on their Windows 10 clients. WDAC was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria) defined by the Microsoft Security Response Center (MSRC).
|
||||
|
||||
> [!NOTE]
|
||||
> Prior to Windows 10, version 1709, Windows Defender Application Control was known as configurable code integrity policies.
|
||||
|
||||
## WDAC System Requirements
|
||||
WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on:
|
||||
- Attributes of the codesigning certificate(s) used to sign an app and its binaries;
|
||||
- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file;
|
||||
- The reputation of the app as determined by Microsoft's Intelligent Security Graph;
|
||||
- The identity of the process that initiated the installation of the app and its binaries (managed installer);
|
||||
- The path from which the app or file is launched (beginning with Windows 10 version 1903);
|
||||
- The process that launched the app or binary.
|
||||
|
||||
### WDAC System Requirements
|
||||
|
||||
WDAC policies can only be created on computers beginning with Windows 10 Enterprise or Windows Server 2016 and above.
|
||||
They can be applied to computers running any edition of Windows 10 or Windows Server 2016 and optionally managed via Mobile Device Management (MDM), such as Microsoft Intune.
|
||||
Group Policy or Intune can be used to distribute WDAC policies.
|
||||
Group Policy can also be used to deploy WDAC policies to Windows 10 Enterprise edition or Windows Server 2016 and above.
|
||||
|
||||
## New and changed functionality
|
||||
## AppLocker
|
||||
|
||||
Prior to Windows 10, version 1709, Windows Defender Application Control was known as Windows Defender Device Guard configurable code integrity policies.
|
||||
AppLocker was introduced with Windows 7 and allows organizations to control what applications their users are allowed to run on their Windows clients. AppLocker provides security value as a defense in depth feature and helps end users avoid running unapproved software on their computers.
|
||||
|
||||
Beginning with Windows 10, version 1703, you can use WDAC not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser).
|
||||
For more information, see [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md).
|
||||
AppLocker policies can apply to all users on a computer or to individual users and groups. AppLocker rules can be defined based on:
|
||||
- Attributes of the codesigning certificate(s) used to sign an app and its binaries;
|
||||
- Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file;
|
||||
- The path from which the app or file is launched (beginning with Windows 10 version 1903).
|
||||
|
||||
### AppLocker System Requirements
|
||||
|
||||
AppLocker policies can only be configured on and applied to computers that are running on the supported versions and editions of the Windows operating system. For more info, see [Requirements to Use AppLocker](applocker/requirements-to-use-applocker.md).
|
||||
AppLocker policies can be deployed using Group Policy or MDM.
|
||||
|
||||
## Choose when to use WDAC or AppLocker
|
||||
|
||||
Although either AppLocker or WDAC can be used to control application execution on Windows 10 clients, the following factors can help you decide when to use each of the technologies.
|
||||
|
||||
**WDAC is best when:**
|
||||
- You are adopting application control primarily for security reasons.
|
||||
- Your application control policy can be applied to all users on the managed computers.
|
||||
- All of the devices you wish to manage are running Windows 10.
|
||||
|
||||
**AppLocker is best when:**
|
||||
- You have a mixed Windows operating system (OS) environment and need to apply the same policy controls to Windows 10 and earlier versions of the OS.
|
||||
- You need to apply different policies for different users or groups on a shared computer.
|
||||
- You are using application control to help users avoid running unapproved software, but you do not require a solution designed as a security feature.
|
||||
- You do not wish to enforce application control on application files such as DLLs or drivers.
|
||||
|
||||
**When to use both WDAC and AppLocker together**
|
||||
AppLocker can also be deployed as a complement to WDAC to add user- or group-specific rules for shared device scenarios where its important to prevent some users from running specific apps.
|
||||
As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
|
||||
|
||||
## See also
|
||||
|
||||
- [WDAC design guide](windows-defender-application-control-design-guide.md)
|
||||
- [WDAC deployment guide](windows-defender-application-control-deployment-guide.md)
|
||||
- [AppLocker overview](applocker/applocker-overview.md)
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
---
|
||||
title: Windows Defender Device Guard and AppLocker (Windows 10)
|
||||
description: Explains how
|
||||
keywords: virtualization, whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 05/03/2018
|
||||
---
|
||||
|
||||
# Windows Defender Device Guard with AppLocker
|
||||
|
||||
Although [AppLocker](applocker/applocker-overview.md) is not considered a new Windows Defender Device Guard feature, it complements Windows Defender Device Guard functionality when Windows Defender Application Control (WDAC) cannot be fully implemented or its functionality does not cover every desired scenario.
|
||||
There are many scenarios in which WDAC would be used alongside AppLocker rules.
|
||||
As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level.
|
||||
|
||||
> [!NOTE]
|
||||
> One example of how Windows Defender Device Guard functionality can be enhanced by AppLocker is when you want to apply different policies for different users on the same device. For example, you may allow your IT support personnel to run additional apps that you do not allow for your end-users. You can accomplish this user-specific enforcement by using an AppLocker rule.
|
||||
|
||||
AppLocker and Windows Defender Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible.
|
||||
In addition to these features, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio.
|
||||
@ -23,7 +23,7 @@ Microsoft is committed to optimizing the security of its products and services.
|
||||
|
||||
The Security Target describes security functionality and assurance measures used to evaluate Windows.
|
||||
|
||||
- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/0/7/6/0764E933-DD0B-45A7-9144-1DD9F454DCEF/Windows%2010%201803%20GP%20OS%20Security%20Target.pdf)
|
||||
- [Microsoft Windows 10 (April 2018 Update)](https://download.microsoft.com/download/0/7/6/0764E933-DD0B-45A7-9144-1DD9F454DCEF/Windows%2010%201803%20GP%20OS%20Security%20Target.pdf)
|
||||
- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/B/6/A/B6A5EC2C-6351-4FB9-8FF1-643D4BD5BE6E/Windows%2010%201709%20GP%20OS%20Security%20Target.pdf)
|
||||
- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf)
|
||||
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/1/c/3/1c3b5ab0-e064-4350-a31f-48312180d9b5/st_vid10823-st.pdf)
|
||||
@ -43,7 +43,7 @@ The Security Target describes security functionality and assurance measures used
|
||||
- [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-st.pdf)
|
||||
- [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-st.pdf)
|
||||
- [Windows 7 and Windows Server 2008 R2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-st.pdf)
|
||||
- [Microsoft Windows Server 2008 R2 Hyper-V Role](http://www.microsoft.com/download/en/details.aspx?id=29305)
|
||||
- [Microsoft Windows Server 2008 R2 Hyper-V Role](https://www.microsoft.com/download/en/details.aspx?id=29305)
|
||||
- [Windows Vista and Windows Server 2008 at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-st.pdf)
|
||||
- [Microsoft Windows Server 2008 Hyper-V Role](http://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf)
|
||||
- [Windows Vista and Windows Server 2008 at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_st_v1.0.pdf)
|
||||
@ -60,7 +60,7 @@ These documents describe how to configure Windows to replicate the configuration
|
||||
**Windows 10, Windows 10 Mobile, Windows Server 2016, Windows Server 2012 R2**
|
||||
|
||||
|
||||
- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/C/1/6C13FBFF-9CB0-455F-A1C8-3E3CB0ACBD7B/Windows%2010%201803%20GP%20OS%20Administrative%20Guide.pdf)
|
||||
- [Microsoft Windows 10 (April 2018 Update)](https://download.microsoft.com/download/6/C/1/6C13FBFF-9CB0-455F-A1C8-3E3CB0ACBD7B/Windows%2010%201803%20GP%20OS%20Administrative%20Guide.pdf)
|
||||
- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/5/D/2/5D26F473-0FCE-4AC4-9065-6AEC0FE5B693/Windows%2010%201709%20GP%20OS%20Administrative%20Guide.pdf)
|
||||
- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf)
|
||||
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/d/c/4/dc40b5c8-49c2-4587-8a04-ab3b81eb6fc4/st_vid10823-agd.pdf)
|
||||
@ -137,7 +137,7 @@ These documents describe how to configure Windows to replicate the configuration
|
||||
|
||||
An Evaluation Technical Report (ETR) is a report submitted to the Common Criteria certification authority for how Windows complies with the claims made in the Security Target. A Certification / Validation Report provides the results of the evaluation by the validation team.
|
||||
|
||||
- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/7/1/67167BF2-885D-4646-A61E-96A0024B52BB/Windows%2010%201803%20GP%20OS%20Certification%20Report.pdf)
|
||||
- [Microsoft Windows 10 (April 2018 Update)](https://download.microsoft.com/download/6/7/1/67167BF2-885D-4646-A61E-96A0024B52BB/Windows%2010%201803%20GP%20OS%20Certification%20Report.pdf)
|
||||
- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/2/C/2/2C20D013-0610-4047-B2FA-516819DFAE0A/Windows%2010%201709%20GP%20OS%20Certification%20Report.pdf)
|
||||
- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf)
|
||||
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/a/3/3/a336f881-4ac9-4c79-8202-95289f86bb7a/st_vid10823-vr.pdf)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user