diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 9912a334f2..a4e6e02c6d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -14602,6 +14602,11 @@ "redirect_document_id": true }, { +"source_path": "browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md", +"redirect_url": "https://docs.microsoft.com/internet-explorer/kb-support/ie-edge-faqs", +"redirect_document_id": false +}, +{ "source_path": "windows/keep-secure/security-technologies.md", "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true diff --git a/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md b/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md deleted file mode 100644 index 7adcb24c17..0000000000 --- a/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Clear the Internet Explorer cache from a command line -description: Introduces command-line commands and a sample batch file for clearing the IE cache. -audience: ITPro -manager: msmets -author: ramakoni1 -ms.author: ramakoni -ms.reviewer: ramakoni, DEV_Triage -ms.prod: internet-explorer -ms.technology: -ms.topic: kb-support -ms.custom: CI=111026 -ms.localizationpriority: Normal -# localization_priority: medium -# ms.translationtype: MT -ms.date: 01/23/2020 ---- -# How to clear Internet Explorer cache by using the command line - -This article outlines the procedure to clear the Internet Explorer cache by using the command line. - -## Command line commands to clear browser cache - -1. Delete history from the Low folder - `del /s /q C:\Users\\%username%\AppData\Local\Microsoft\Windows\History\low\* /ah` - -2. Delete history - `RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 1` - -3. Delete cookies - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2` - -4. Delete temporary internet files - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8` - -5. Delete form data - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16` - -6. Delete stored passwords - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32` - -7. Delete all - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255` - -8. Delete files and settings stored by add-ons - `InetCpl.cpl,ClearMyTracksByProcess 4351` - -If you upgraded from a previous version of Internet Explorer, you have to use the following commands to delete the files from older versions: -`RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 9` - -Command to reset Internet Explorer settings: -`Rundll32.exe inetcpl.cpl ResetIEtoDefaults` - -## Sample batch file to clear Internet Explorer cache files - -A sample batch file is available that you can use to clear Internet Explorer cache files and other items. You can download the file from [https://msdnshared.blob.core.windows.net/media/2017/09/ClearIE_Cache.zip](https://msdnshared.blob.core.windows.net/media/2017/09/ClearIE_Cache.zip). - -The batch file offers the following options: - -- Delete Non-trusted web History (low-level hidden cleanup) -- Delete History -- Delete Cookies -- Delete Temporary Internet Files -- Delete Form Data -- Delete Stored Passwords -- Delete All -- Delete All "Also delete files and settings stored by add-ons" -- Delete IE10 and IE9 Temporary Internet Files -- Resets IE Settings -- EXIT - -**Contents of the batch file** - -```dos -@echo off -# This sample script is not supported under any Microsoft standard support program or service. -# The sample script is provided AS IS without warranty of any kind. Microsoft further disclaims -# all implied warranties including, without limitation, any implied warranties of merchantability -# or of fitness for a particular purpose. The entire risk arising out of the use or performance of -# the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, -# or anyone else involved in the creation, production, or delivery of the scripts be liable for any -# damages whatsoever (including, without limitation, damages for loss of business profits, business -# interruption, loss of business information, or other pecuniary loss) arising out of the use of or -# inability to use the sample scripts or documentation, even if Microsoft has been advised of the -# possibility of such damages - -:home -cls -COLOR 00 -echo Delete IE History -echo Please select the task you wish to run. -echo Pick one: -echo. -echo 1. Delete History -echo 2. Delete Cookies -echo 3. Delete Temporary Internet Files -echo 4. Delete Form Data -echo 5. Delete Stored Passwords -echo 6. Delete All -echo 7. Delete All "Also delete files and settings stored by add-ons" -echo 8. Delete IE10 and 9 Temporary Internet Files -echo 9. Reset IE Settings -echo 00. EXIT -:choice -Echo Hit a number [1-10] and press enter. -set /P CH=[1-10] - -if "%CH%"=="1" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1 -if "%CH%"=="2" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2 -if "%CH%"=="3" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8 -if "%CH%"=="4" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16 -if "%CH%"=="5" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32 -if "%CH%"=="6" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255 -if "%CH%"=="7" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351 -if "%CH%"=="8" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 9 -if "%CH%"=="9" set x=rundll32.exe inetcpl.cpl ResetIEtoDefaults -if "%CH%"=="00" goto quit - -%x% - -goto Home -:quit -``` diff --git a/devices/hololens/hololens-diagnostic-logs.md b/devices/hololens/hololens-diagnostic-logs.md index 212f936079..0423539b62 100644 --- a/devices/hololens/hololens-diagnostic-logs.md +++ b/devices/hololens/hololens-diagnostic-logs.md @@ -27,19 +27,20 @@ HoloLens users and administrators can choose from among four different methods t - Feedback Hub app - DiagnosticLog CSP - Settings app -- Fallback diagnostics > [!IMPORTANT] > Device diagnostic logs contain personally identifiable information (PII), such as about what processes or applications the user starts during typical operations. When multiple users share a HoloLens device (for example, users sign in to the same device by using different Microsoft Azure Active Directory (AAD) accounts) the diagnostic logs may contain PII information that applies to multiple users. For more information, see [Microsoft Privacy statement](https://privacy.microsoft.com/privacystatement). -The following table compares the four collection methods. The method names link to more detailed information in the sections that follow the table. +The following table compares the three collection methods. The method names link to more detailed information in the sections that follow the table. |Method |Prerequisites |Data locations |Data access and use |Data retention | | --- | --- | --- | --- | --- | |[Feedback Hub](#feedback-hub) |Network and internet connection

Feedback Hub app

Permission to upload files to the Microsoft cloud |Microsoft cloud

HoloLens device (optional) |User requests assistance, agrees to the terms of use, and uploads the data

Microsoft employees view the data, as consistent with the terms of use |Data in the cloud is retained for the period that is defined by Next Generation Privacy (NGP). Then the data is deleted automatically.

Data on the device can be deleted at any time by a user who has **Device owner** or **Admin** permissions. | -|[Settings Troubleshooter](#settings-troubleshooter) |Settings app |HoloLens device

Connected computer (optional) |The user stores the data, and only the user accesses the data (unless the user specifically shares the data with another user). |The data is retained until the user deletes it. | +|[Settings Troubleshooter](#settings-troubleshooter) |Settings app |HoloLens device

Connected computer (optional) |The user stores the data, and only the user accesses the data (unless the user specifically shares the data with another user). |The data is retained until the user deletes it.* | |[DiagnosticLog CSP](#diagnosticlog-csp) |Network connection

MDM environment that supports the DiagnosticLog CSP |Administrator configures storage locations |In the managed environment, the user implicitly consents to administrator access to the data.

Administrator configures access roles and permissions. | Administrator configures retention policy. | -|[Fallback diagnostics](#fallback-diagnostics) |Device configuration: |HoloLens device

Connected computer |The user stores the data, and only the user accesses the data (unless the user specifically shares the data with another user). |The data is retained until the user deletes it. | + + +- End-user is responsible for sharing the logs responsibly with someone else. These files are primarily useful when contacting customer service and support. ## Feedback Hub @@ -110,160 +111,4 @@ The IT administrator uses the DiagnosticLog CSP to configure the data storage, r - The retention period for the diagnostic information. - Permissions that control access to the diagnostic information. -## Fallback diagnostics -While device telemetry usually provides an initial understanding of a problem report, some issues require a broader and deeper understanding of the device state. When you (as a user or an administrator) investigate such issues, diagnostic logs that reside on the device are more useful than the basic device telemetry. - -The fallback diagnostics process provides a way for you to gather diagnostic information if no other methods are available. Such scenarios include the following: - -- The network or network-based resources (such as the Feedback Hub, MDM, and so on) are not available. -- The device is "stuck" or locked in a state in which usual troubleshooting capabilities (such as the Settings app) are not available. Such scenarios include the Out-of-Box-Experience (OOBE), kiosk mode, and a locked or "hung" user interface. - -> [!IMPORTANT] -> - On HoloLens 2 devices, you can use fallback diagnostics under the following conditions only: -> - During the Out-of-the-Box-Experience (OOBE) and when you select **Send Full Diagnostics Data**. -> - If the environment's Group Policy enforces the **System\AllowTelemetry** policy value of **Full**. -> - On HoloLens (1st gen) devices, you can use fallback diagnostics on HoloLens version 17763.316 or a later version. This version is the version that the Windows Device Recovery Tool restores when it resets the device. - -### How to use fallback diagnostics - -Before you start the fallback diagnostics process, make sure of the following: - -- The device is connected to a computer by using a USB cable. -- The device is powered on. -- The Power and Volume buttons on the device are functioning correctly. - -To collect fallback diagnostic information, follow these steps: - -1. On the device, press the Power and Volume Down buttons at the same time and then release them. -1. Wait for few seconds while the device collects the data. - -### Data locations - -The device stores the data locally. You can access that information from the connected desktop computer at the following location: - -> This PC\\\<*HoloLens device name*>\\Internal Storage\\Documents - -For more information about the files that the fallback diagnostics process collects, see [What diagnostics files does the fallback diagnostics process collect?](#what-diagnostics-files-does-the-fallback-diagnostics-process-collect). - -### Data access, use, and retention - -Because you store the data yourself, only you have access to the data. If you choose to share the data with another user, you implicitly grant permission for that user to access or store the data. - -The data remains until you delete it. - -### Frequently asked questions about fallback diagnostics on HoloLens - -#### Does the device have to be enrolled with an MDM system? - -No. - -#### How can I use fallback diagnostics on HoloLens? - -Before you start the fallback diagnostics process, make sure of the following: - -- The device is connected to a computer by using a USB cable. -- The device is powered on. -- The Power and Volume buttons on the device are functioning correctly. - -To collect fallback diagnostic information, follow these steps: - -1. On the device, press the Power and Volume Down buttons at the same time and then release them. -1. Wait for few seconds while the device collects the data. - -#### How would I know that data collection finished? - -The fallback diagnostics process does not have a user interface. On HoloLens 2, when the process starts to collect data, it creates a file that is named HololensDiagnostics.temp. When the process finishes, it removes the file. - -#### What diagnostics files does the fallback diagnostics process collect? - -The fallback diagnostics process collects one or more .zip files, depending on the version of HoloLens. The following table lists each of the possible .zip files, and the applicable versions of HoloLens. - -|File |Contents |HoloLens (1st gen) |HoloLens 2 10.0.18362+ |HoloLens 2 10.0.19041+ | -| --- | --- | --- | --- | --- | -|HololensDiagnostics.zip |Files for tracing sessions that ran on the device.

Diagnostic information that's specific to Hololens. |✔️ |✔️ |✔️ | -|DeviceEnrollmentDiagnostics.zip |Information that's related to MDM, device enrollment, CSPs, and policies. | |✔️ |✔️ | -|AutoPilotDiagnostics.zip |Information that's related to autopilot and licensing.| | |✔️ | -|TPMDiagnostics.zip |Information that's related to the trusted platform module (TPM) on the device | | |✔️ | - -> [!NOTE] -> Starting on May 2, 2019, the fallback diagnostics process collects EventLog*.etl files only if the signed-in user is the device owner. This is because these files may contain PII data. Such data is accessible to device owners only. This behavior matches the behavior of Windows desktop computers, where administrators have access to event log files but other users do not. - -**Sample diagnostic content for HoloLens (1st gen)** - -HololensDiagnostics.zip contains files such as the following: - -- AuthLogon.etl -- EventLog-HupRe.etl.001 -- FirstExperience.etl.001 -- HetLog.etl -- HoloInput.etl.001 -- HoloShell.etl.001 -- WiFi.etl.001 - -**Sample diagnostic content for HoloLens 2 10.0.18362+** - -HololensDiagnostics.zip contains files such as the following: - -- EventLog-Application.etl.001* -- EventLog-System.etl.001* -- AuthLogon.etl -- EventLog-HupRe.etl.001 -- FirstExperience.etl.001 -- HetLog.etl -- HoloInput.etl.001 -- HoloShell.etl.001 -- WiFi.etl.001 -- CSPsAndPolicies.etl.001 -- RadioMgr.etl -- WiFiDriverIHVSession.etl - -DeviceEnrollmentDiagnostics.zip contains files such as the following: - -- MDMDiagHtmlReport.html -- MdmDiagLogMetadata.json -- MDMDiagReport.xml -- MdmDiagReport_RegistryDump.reg -- MdmLogCollectorFootPrint.txt - -**Sample diagnostic content for HoloLens 2 10.0.19041+** - -HololensDiagnostics.zip contains files such as the following: - -- EventLog-Application.etl.001* -- EventLog-System.etl.001* -- AuthLogon.etl -- EventLog-HupRe.etl.001 -- FirstExperience.etl.001 -- HetLog.etl -- HoloInput.etl.001 -- HoloShell.etl.001 -- WiFi.etl.001 -- CSPsAndPolicies.etl.001 -- RadioMgr.etl -- WiFiDriverIHVSession.etl -- DisplayDiagnosticData.json -- HUP dumps - -DeviceEnrollmentDiagnostics.zip contains files such as the following: - -- MDMDiagHtmlReport.html -- MdmDiagLogMetadata.json -- MDMDiagReport.xml -- MdmDiagReport_RegistryDump.reg -- MdmLogCollectorFootPrint.txt - -AutoPilotDiagnostics.zip contains files such as the following: - -- DeviceHash_HoloLens-U5603.csv -- LicensingDiag.cab -- LicensingDiag_Output.txt -- TpmHliInfo_Output.txt -- DiagnosticLogCSP_Collector_DeviceEnrollment_\*.etl -- DiagnosticLogCSP_Collector_Autopilot_*.etl - -TPMDiagnostics.zip contains files such as the following: - -- CertReq_enrollaik_Output.txt -- CertUtil_tpminfo_Output.txt -- TPM\*.etl diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c08a6c076b..1bbd7ddefd 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -98,7 +98,9 @@ If you use a Mobile Device Management (MDM) system or a provisioning package to |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | +|File Explorer |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|Mail |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | +|Microsoft Store |Microsoft.WindowsStore_8wekyb3d8bbwe!App | |Miracast4 |  | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md index 6653076c8c..a41f581400 100644 --- a/devices/hololens/hololens-release-notes.md +++ b/devices/hololens/hololens-release-notes.md @@ -142,9 +142,6 @@ You can now quickly access and use commands with your voice while using any app The updated app integrates with Microsoft 365, currently in English (United States) only, to help you get more done across your devices. On HoloLens 2, Cortana will no longer support certain device-specific commands like adjusting the volume or restarting the device, which are now supported with the new system voice commands mentioned above. Learn more about the new Cortana app and its direction on our blog [here](https://blogs.windows.com/windowsexperience/2020/02/28/cortana-in-the-upcoming-windows-10-release-focused-on-your-productivity-with-enhanced-security-and-privacy/). -> [!NOTE] -> There's currently an issue we're investigating that requires you to launch the app after booting the device in order to use the "Hey Cortana" keyword activation, and if you updated from a 18362 build, you may see an app tile for the previous version of the Cortana app in Start that no longer works. - ### Quality improvements and fixes Improvements and Fixes also in the update: @@ -162,6 +159,11 @@ Improvements and Fixes also in the update: - Added ‘Share’ button in Feedback Hub so users can more easily share feedback. - Fixed a bug where RoboRaid did not install correctly. +### Known issues + +- We are investigating an issue surrounding the use of the zh-CN system language that prevents the voice commands for taking a mixed reality capture or displaying the device IP address from working. +- We're investigating an issue that requires you to launch the Cortana app after booting the device in order to use the "Hey Cortana" voice activation, and if you updated from a 18362 build, you may see a second app tile for the previous version of the Cortana app in Start that no longer works. + ## Windows Holographic, version 1903 - May 2020 Update - Build 18362.1061 diff --git a/devices/surface/documentation/surface-system-sku-reference.md b/devices/surface/documentation/surface-system-sku-reference.md index 227d58d778..0014ad0c25 100644 --- a/devices/surface/documentation/surface-system-sku-reference.md +++ b/devices/surface/documentation/surface-system-sku-reference.md @@ -26,6 +26,7 @@ System SKU is a variable (along with System Model and others) stored in System M | Surface Book 2 15inch | Surface Book 2 | Surface_Book_1793 | | Surface Go Consumer | Surface Go | Surface_Go_1824_Consumer | | Surface Go Commercial | Surface Go | Surface_Go_1824_Commercial | +| Surface Go 2 | Surface Go 2 | Surface_Go_2_1927 | | Surface Pro 6 Consumer | Surface Pro 6 | Surface_Pro_6_1796_Consumer | | Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | | Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 55b5978287..34baf85bf1 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -37,11 +37,18 @@ SetupDiag works by examining Windows Setup log files. It attempts to parse these ## SetupDiag in Windows 10, version 2004 and later -With the release of Windows 10, version 2004, SetupDiag is included with Windows Setup. +With the release of Windows 10, version 2004, SetupDiag is included with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files#windows-setup-scenario). During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, **setupdiag.exe** is also installed to this directory. If there is an issue with the upgrade, SetupDiag will automatically run to determine the cause of the failure. -When run by Windows Setup, results of the SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\Setup\SetupDiag\Results**. +When run by Windows Setup, the following [parameters](#parameters) are used: + +- /ZipLogs:False +- /Format:xml +- /Output:%windir%\logs\SetupDiag\SetupDiagResults.xml +- /RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results + +The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\Setup\SetupDiag\Results**. If the upgrade process proceeds normally, the **Sources** directory including **setupdiag.exe** is moved under **%SystemDrive%\Windows.Old** for cleanup. If the **Windows.old** directory is deleted later, **setupdiag.exe** will also be removed. @@ -51,13 +58,13 @@ To quickly use SetupDiag on your current computer: 1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137). 2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). 3. If your web browser asks what to do with the file, choose **Save**. By default, the file will be saved to your **Downloads** folder. You can also save it to a different location if desired by using **Save As**. -4. When SetupDiag has finished downloading, open the folder where you downloaded the file. As mentioned above, by default this is your **Downloads** folder which is displayed in File Explorer under **Quick access** in the left navigation pane. +4. When SetupDiag has finished downloading, open the folder where you downloaded the file. By default, this is your **Downloads** folder, which is displayed in File Explorer under **Quick access** in the left navigation pane. 5. Double-click the **SetupDiag** file to run it. Click **Yes** if you are asked to approve running the program. - Double-clicking the file to run it will automatically close the command window when SetupDiag has completed its analysis. If you wish to keep this window open instead, and review the messages that you see, run the program by typing **SetupDiag** at the command prompt instead of double-clicking it. You will need to change directories to the location of SetupDiag to run it this way. 6. A command window will open while SetupDiag diagnoses your computer. Wait for this to finish. 7. When SetupDiag finishes, two files will be created in the same folder where you double-clicked SetupDiag. One is a configuration file, the other is a log file. 8. Use Notepad to open the log file: **SetupDiagResults.log**. -9. Review the information that is displayed. If a rule was matched this can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. +9. Review the information that is displayed. If a rule was matched, this can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. For instructions on how to run the tool in offline mode and with more advanced options, see the [Parameters](#parameters) and [Examples](#examples) sections below. @@ -117,7 +124,7 @@ The following example specifies that SetupDiag is to run in offline mode, and to SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 ``` -The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the resuts to the directory specified by the /Output parameter. +The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the results to the directory specified by the /Output parameter. ``` SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery @@ -204,7 +211,7 @@ Logs ZipFile created at: c:\setupdiag\Logs_14.zip ## Rules -When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file which is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. See [Release notes](#release-notes) for more information. +When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file which is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. See the [release notes](#release-notes) section for more information. Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term "down-level" refers to the first phase of the upgrade process, which runs under the starting OS. @@ -389,7 +396,7 @@ Each rule name and its associated unique rule identifier are listed with a descr - Telemetry is refactored to only send the rule name and GUID (or “NoRuleMatched” if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. 05/02/2018 - SetupDiag v1.10 is released with 34 rules, as a standalone tool available from the Download Center. -- A performance enhancment has been added to result in faster rule processing. +- A performance enhancement has been added to result in faster rule processing. - Rules output now includes links to support articles, if applicable. - SetupDiag now provides the path and name of files that it is processing. - You can now run SetupDiag by simply clicking on it and then examining the output log file. diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index 7da78c244e..25fee702e2 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -14,6 +14,9 @@ author: greg-lindsay ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article +ms.custom: +- CI 116757 +- CSSTroubleshooting --- @@ -68,10 +71,10 @@ If the Delivery Optimization Service is inaccessible, the AutoPilot process will Diagnostics dataStarting in Windows 10, 1903, diagnostic data collection will be enabled by default. To disable Windows Analytics and related diagnostics capabilities, see Manage enterprise diagnostic data level.
If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work. -Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI). +Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI). www.msftconnecttest.com must be resolvable via DNS and accessible via HTTP. -Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
+Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
If the WNS services are not available, the Autopilot process will still continue without notifications. Microsoft Store, Microsoft Store for BusinessApps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in. For more information, see Prerequisites for Microsoft Store for Business and Education (also includes Azure AD and Windows Notification Services).
diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 09d6973301..436ef15fe7 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -1882,7 +1882,7 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. Secure Boot also provides more flexibility for managing preboot configurations than BitLocker integrity checks prior to Windows Server 2012 and Windows 8. When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored, and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker. ->**Warning:** Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. +>**Warning:** Disabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. ### Provide the unique identifiers for your organization diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md index 70ee1607f8..d6788c3add 100644 --- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md +++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md @@ -111,7 +111,7 @@ For example: If you want to prevent the installation of a device class or certain devices, you can use the prevent device installation policies: 1. Enable **Prevent installation of devices that match any of these device IDs**. -2. Enable **Prevent installation of devices that match these device setup classes**. +2. Enable **Prevent installation of devices using drivers that match these device setup classes**. > [!Note] > The prevent device installation policies take precedence over the allow device installation policies. @@ -145,6 +145,14 @@ Get-WMIObject -Class Win32_DiskDrive | Select-Object -Property * ``` +The **Prevent installation of devices using drivers that match these device setup classes** policy allows you to specify device setup classes that Windows is prevented from installing. + +To prevent installation of particular classes of devices: + +1. Find the GUID of the device setup class from [System-Defined Device Setup Classes Available to Vendors](https://docs.microsoft.com/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors). +2. Enable **Prevent installation of devices using drivers that match these device setup classes** and add the class GUID to the list. +![Add device setup class to prevent list](images/Add-device-setup-class-to-prevent-list.png) + ### Block installation and usage of removable storage 1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). diff --git a/windows/security/threat-protection/device-control/images/Add-device-setup-class-to-prevent-list.png b/windows/security/threat-protection/device-control/images/Add-device-setup-class-to-prevent-list.png new file mode 100644 index 0000000000..043da38016 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/Add-device-setup-class-to-prevent-list.png differ diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md new file mode 100644 index 0000000000..708ec3f869 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md @@ -0,0 +1,95 @@ +--- +title: Collect diagnostic data of Microsoft Defender Antivirus +description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 06/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Collect Windows Defender AV diagnostic data + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV. + +On at least two devices that are experiencing the same issue, obtain the .cab diagnostic file by taking the following steps: + +1. Open an administrator-level version of the command prompt as follows: + + a. Open the **Start** menu. + + b. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. + + c. Enter administrator credentials or approve the prompt. + +2. Navigate to the Windows Defender directory. By default, this is `C:\Program Files\Windows Defender`. + +> [!NOTE] +> If you're running an updated Windows Defender Platform version, please run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\`. + +3. Type the following command, and then press **Enter** + + ```Dos + mpcmdrun.exe -GetFiles + ``` + +4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. + +> [!NOTE] +> To redirect the cab file to a a different path or UNC share, use the following command: `mpcmdrun.exe -GetFiles -SupportLogLocation `
For more information see [Redirect diagnostic data to a UNC share](#redirect-diagnostic-data-to-a-unc-share). + +5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. + +> [!NOTE] +>If you have a problem with Update compliance, send an email using the Update Compliance support email template, and fill out the template with the following information: +>``` +> I am encountering the following issue when using Microsoft Defender Antivirus in Update Compliance: +> I have provided at least 2 support .cab files at the following location: +> +> +> My OMS workspace ID is: +> +> Please contact me at: + +## Redirect diagnostic data to a UNC share +To collect diagnostic data on a central repository, you can specify the SupportLogLocation parameter. + +```Dos +mpcmdrun.exe -GetFiles -SupportLogLocation +``` + +Copies the diagnostic data to the specified path. If the path is not specified, the diagnostic data will be copied to the location specified in the Support Log Location Configuration. + +When the SupportLogLocation parameter is used, a folder structure as below will be created in the destination path: + +```Dos +\\MpSupport--.cab +``` + +| field | Description | +|:----|:----| +| path | The path as specified on the commandline or retrieved from configuration +| MMDD | Month Day when the diagnostic data was collected (eg 0530) +| hostname | the hostname of the device on which the diagnostic data was collected. +| HHMM | Hours Minutes when the diagnostic data was collected (eg 1422) + +> [!NOTE] +> When using a File share please make sure that account used to collect the diagnostic package has write access to the share. + +## See also + +- [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md index 32f43ac10a..cf81f65145 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md @@ -36,7 +36,7 @@ MpCmdRun.exe [command] [-options] ``` Here's an example: ``` -MpCmdRun.exe -scan -2 +MpCmdRun.exe -Scan -ScanType 2 ``` | Command | Description | @@ -44,7 +44,7 @@ MpCmdRun.exe -scan -2 | `-?` **or** `-h` | Displays all available options for this tool | | `-Scan [-ScanType [0\|1\|2\|3]] [-File [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout ] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. CpuThrottling will honor the configured CPU throttling from policy | | `-Trace [-Grouping #] [-Level #]` | Starts diagnostic tracing | -| `-GetFiles` | Collects support information | +| `-GetFiles [-SupportLogLocation ]` | Collects support information. See '[collecting diagnostic data](collect-diagnostic-data.md)' | | `-GetFilesDiagTrack` | Same as `-GetFiles`, but outputs to temporary DiagTrack folder | | `-RemoveDefinitions [-All]` | Restores the installed Security intelligence to a previous backup copy or to the original default set | | `-RemoveDefinitions [-DynamicSignatures]` | Removes only the dynamically downloaded Security intelligence | diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 0e591bca8c..f619b37fca 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -58,11 +58,32 @@ All our updates contain: * serviceability improvements * integration improvements (Cloud, MTP)
+
+ May-2020 (Platform: 4.18.2005.4 | Engine: 1.1.17100.2) + + Security intelligence update version: **1.317.20.0** + Released: **May 26, 2020** + Platform: **4.18.2005.4** + Engine: **1.1.17100.2** + Support phase: **Security and Critical Updates** + +### What's new +* Improved logging for scan events +* Improved user mode crash handling. +* Added event tracing for Tamper protection +* Fixed AMSI Sample submission +* Fixed AMSI Cloud blocking +* Fixed Security update install log + +### Known Issues +No known issues +
+
April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2) - Security intelligence update version: **TBD** + Security intelligence update version: **1.315.12.0**  Released: **April 30, 2020**  Platform: **4.18.2004.6**  Engine: **1.1.17000.2** diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md index b1872a430d..8abffb90b1 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md @@ -62,12 +62,7 @@ In order for devices to properly show up in Update Compliance, you have to meet If the above prerequisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. > [!div class="nextstepaction"] -> [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data-update-compliance.md) - - - - - +> [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data.md) ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md index 866f6d5277..a1ed7741c5 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md @@ -22,7 +22,7 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) Microsoft Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). @@ -38,7 +38,7 @@ Although you can use a non-Microsoft antivirus solution with Microsoft Defender |4|Details about blocked malware |More details and actions for blocked malware are available with Microsoft Defender Antivirus and Microsoft Defender ATP. [Understand malware & other threats](../intelligence/understanding-malware.md).| |5|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| |6|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| -|7|Attack Surface Reduction |Your organization's security team can reduce your vulnerabilities (attack surfaces), giving attackers fewer ways to perform attacks. Attack surface reduction uses cloud protection for a number of rules. [Reduce attack surfaces with attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction).| +|7|Attack Surface Reduction |Your organization's security team can reduce your vulnerabilities (attack surfaces), giving attackers fewer ways to perform attacks. Attack surface reduction uses cloud protection for a number of rules. [Get an overview of attack surface reduction](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction).| |8|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | |9|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | |10|File recovery via OneDrive |If you are using Microsoft Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/TOC.md b/windows/security/threat-protection/microsoft-defender-application-guard/TOC.md new file mode 100644 index 0000000000..35f40da2a5 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/TOC.md @@ -0,0 +1,7 @@ +# [Microsoft Defender Application Guard](md-app-guard-overview.md) + +## [System requirements](reqs-md-app-guard.md) +## [Install WDAG](install-md-app-guard.md) +## [Configure WDAG policies](configure-md-app-guard.md) +## [Test scenarios](test-scenarios-md-app-guard.md) +## [FAQ](faq-md-app-guard.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md new file mode 100644 index 0000000000..121ed70fbe --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -0,0 +1,66 @@ +--- +title: Configure the Group Policy settings for Microsoft Defender Application Guard (Windows 10) +description: Learn about the available Group Policy settings for Microsoft Defender Application Guard. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 10/17/2017 +ms.reviewer: +manager: dansimp +ms.custom: asr +--- + +# Configure Microsoft Defender Application Guard policy settings + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain. + +Application Guard uses both network isolation and application-specific settings. + +## Network isolation settings + +These settings, located at **Computer Configuration\Administrative Templates\Network\Network Isolation**, help you define and manage your company's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. + +>[!NOTE] +>You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy. + + + +|Policy name|Supported versions|Description| +|-----------|------------------|-----------| +|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| +|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| + +## Network isolation settings wildcards + +|Value|Number of dots to the left|Meaning| +|-----|--------------------------|-------| +|`contoso.com`|0|Trust only the literal value of `contoso.com`.| +|`www.contoso.com`|0|Trust only the literal value of `www.contoso.com`.| +|`.contoso.com`|1|Trust any domain that ends with the text `contoso.com`. Matching sites include `spearphishingcontoso.com`, `contoso.com`, and `www.contoso.com`.| +|`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.| + +## Application-specific settings +These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard**, can help you to manage your company's implementation of Application Guard. + +|Name|Supported versions|Description|Options| +|-----------|------------------|-----------|-------| +|Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:
-Disable the clipboard functionality completely when Virtualization Security is enabled.
- Enable copying of certain content from Application Guard into Microsoft Edge.
- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.

**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.| +|Configure Microsoft Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:
- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.

**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| +|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container. **Note:** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.

**Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | +|Allow Persistence|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Microsoft Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

**Disabled or not configured.** All user data within Application Guard is reset between sessions.

**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**
1. Open a command-line program and navigate to `Windows/System32`.
2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.
3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.| +|Turn on Microsoft Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1809 or higher|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device. Available options:
- Enable Microsoft Defender Application Guard only for Microsoft Edge
- Enable Microsoft Defender Application Guard only for Microsoft Office
- Enable Microsoft Defender Application Guard for both Microsoft Edge and Microsoft Office

**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.| +|Allow files to download to host operating system|Windows 10 Enterprise, 1803 or higher|Determines whether to save downloaded files to the host operating system from the Microsoft Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Microsoft Defender Application Guard container to the host operating system.

**Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.| +|Allow hardware-accelerated rendering for Microsoft Defender Application Guard|Windows 10 Enterprise, 1803 or higher

Windows 10 Pro, 1803 or higher|Determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.

**Disabled or not configured.** Microsoft Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.| +|Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| +|Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

**Disabled or not configured.** Certificates are not shared with Microsoft Defender Application Guard.| +|Allow users to trust files that open in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.

**Disabled or not configured.** Users are unable to manually trust files and files continue to open in Microsoft Defender Application Guard.| + + diff --git a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md similarity index 75% rename from windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md rename to windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md index 1e8839b354..cc79291b60 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md @@ -1,6 +1,6 @@ --- -title: FAQ - Windows Defender Application Guard (Windows 10) -description: Learn about the commonly asked questions and answers for Windows Defender Application Guard. +title: FAQ - Microsoft Defender Application Guard (Windows 10) +description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -14,11 +14,11 @@ manager: dansimp ms.custom: asr --- -# Frequently asked questions - Windows Defender Application Guard +# Frequently asked questions - Microsoft Defender Application Guard **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Answering frequently asked questions about Windows Defender Application Guard (Application Guard) features, integration with the Windows operating system, and general configuration. +Answering frequently asked questions about Microsoft Defender Application Guard (Application Guard) features, integration with the Windows operating system, and general configuration. ## Frequently Asked Questions @@ -49,13 +49,13 @@ To help keep the Application Guard Edge session secure and isolated from the hos Currently, the Application Guard Edge session doesn't support Extensions. However, we're closely monitoring your feedback about this. -### How do I configure Windows Defender Application Guard to work with my network proxy (IP-Literal Addresses)? +### How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? -Windows Defender Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. +Microsoft Defender Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. ### Which Input Method Editors (IME) in 19H1 are not supported? -The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Windows Defender Application Guard. +The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Microsoft Defender Application Guard. - Vietnam Telex keyboard - Vietnam number key-based keyboard - Hindi phonetic keyboard @@ -83,12 +83,12 @@ To trust a subdomain, you must precede your domain with two dots, for example: ` ### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise? -When using Windows Pro or Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). +When using Windows Pro or Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard). ### Is there a size limit to the domain lists that I need to configure? Yes, both the Enterprise Resource domains hosted in the cloud and the Domains categorized as both work and personal have a 16383B limit. -### Why does my encryption driver break Windows Defender Application Guard? +### Why does my encryption driver break Microsoft Defender Application Guard? -Windows Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT"). +Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT"). diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg b/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg rename to windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-root-certificates.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-root-certificates.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-root-certificates.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-root-certificates.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-clipboard.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-clipboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-clipboard.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-clipboard.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-download.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-download.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation-neutral.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation-neutral.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation-neutral.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation-neutral.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-persistence.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-persistence.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-persistence.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-persistence.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-print.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-print.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-print.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-print.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-turn-on.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-turn-on.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-turn-on.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-turn-on.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-vgpu.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-vgpu.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-hardware-isolation.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-hardware-isolation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-hardware-isolation.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-hardware-isolation.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-new-window.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-new-window.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-new-window.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-new-window.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-security-center-settings.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-security-center-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-security-center-settings.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-security-center-settings.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-turned-on-with-trusted-site.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-turned-on-with-trusted-site.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-turned-on-with-trusted-site.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-turned-on-with-trusted-site.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-visual-cues.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-visual-cues.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-visual-cues.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-visual-cues.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/application-guard-container-v-host.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/application-guard-container-v-host.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/application-guard-container-v-host.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/application-guard-container-v-host.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/host-screen-no-application-guard.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/host-screen-no-application-guard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/host-screen-no-application-guard.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/host-screen-no-application-guard.png diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on-off.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on-off.png new file mode 100644 index 0000000000..fe4236c8cf Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on-off.png differ diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/turn-windows-features-on.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/turn-windows-features-on.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md similarity index 74% rename from windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md rename to windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index e5630f24a3..8aba080ae4 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -1,6 +1,6 @@ --- title: Enable hardware-based isolation for Microsoft Edge (Windows 10) -description: Learn about the Windows Defender Application Guard modes (Standalone or Enterprise-managed) and how to install Application Guard in your enterprise. +description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -14,19 +14,19 @@ manager: dansimp ms.custom: asr --- -# Prepare to install Windows Defender Application Guard +# Prepare to install Microsoft Defender Application Guard **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ## Review system requirements -See [System requirements for Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard) to review the hardware and software installation requirements for Windows Defender Application Guard. +See [System requirements for Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard) to review the hardware and software installation requirements for Microsoft Defender Application Guard. >[!NOTE] ->Windows Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. +>Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. -## Prepare for Windows Defender Application Guard -Before you can install and use Windows Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode. +## Prepare for Microsoft Defender Application Guard +Before you can install and use Microsoft Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode. ### Standalone mode @@ -34,7 +34,7 @@ Applies to: - Windows 10 Enterprise edition, version 1709 or higher - Windows 10 Pro edition, version 1803 -Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-wd-app-guard.md) testing scenario. +Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-md-app-guard.md) testing scenario. ## Enterprise-managed mode @@ -54,9 +54,9 @@ Application Guard functionality is turned off by default. However, you can quick 1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**. - ![Windows Features, turning on Windows Defender Application Guard](images/turn-windows-features-on.png) + ![Windows Features, turning on Microsoft Defender Application Guard](images/turn-windows-features-on-off.png) -2. Select the check box next to **Windows Defender Application Guard** and then click **OK**. +2. Select the check box next to **Microsoft Defender Application Guard** and then click **OK**. Application Guard and its underlying dependencies are all installed. @@ -83,7 +83,7 @@ Application Guard functionality is turned off by default. However, you can quick ### To install by using Intune > [!IMPORTANT] -> Make sure your organization's devices meet [requirements](reqs-wd-app-guard.md) and are [enrolled in Intune](https://docs.microsoft.com/mem/intune/enrollment/device-enrollment). +> Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](https://docs.microsoft.com/mem/intune/enrollment/device-enrollment). :::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune"::: @@ -119,5 +119,5 @@ Application Guard functionality is turned off by default. However, you can quick 1. Click **Save**. -After the profile is created, any devices to which the policy should apply will have Windows Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place. +After the profile is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place. diff --git a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md similarity index 63% rename from windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md rename to windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 390bee5992..652cc3b40b 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Application Guard (Windows 10) -description: Learn about Windows Defender Application Guard and how it helps to combat malicious content and malware out on the Internet. +title: Microsoft Defender Application Guard (Windows 10) +description: Learn about Microsoft Defender Application Guard and how it helps to combat malicious content and malware out on the Internet. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -14,11 +14,11 @@ manager: dansimp ms.custom: asr --- -# Windows Defender Application Guard overview +# Microsoft Defender Application Guard overview **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Windows Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete. +Microsoft Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete. ## What is Application Guard and how does it work? @@ -44,8 +44,8 @@ Application Guard has been created to target several types of systems: |Article |Description | |------|------------| -|[System requirements for Windows Defender Application Guard](reqs-wd-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.| -|[Prepare and install Windows Defender Application Guard](install-wd-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| -|[Configure the Group Policy settings for Windows Defender Application Guard](configure-wd-app-guard.md) |Provides info about the available Group Policy and MDM settings.| -|[Testing scenarios using Windows Defender Application Guard in your business or organization](test-scenarios-wd-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| -|[Frequently asked questions - Windows Defender Application Guard](faq-wd-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| \ No newline at end of file +|[System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.| +|[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| +|[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| +|[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| +|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md similarity index 78% rename from windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md rename to windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md index ca449ea92c..5757f18c10 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -1,6 +1,6 @@ --- -title: System requirements for Windows Defender Application Guard (Windows 10) -description: Learn about the system requirements for installing and running Windows Defender Application Guard. +title: System requirements for Microsoft Defender Application Guard (Windows 10) +description: Learn about the system requirements for installing and running Microsoft Defender Application Guard. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -14,17 +14,17 @@ manager: dansimp ms.custom: asr --- -# System requirements for Windows Defender Application Guard +# System requirements for Microsoft Defender Application Guard **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Windows Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive. +The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Microsoft Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive. >[!NOTE] ->Windows Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. +>Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. ## Hardware requirements -Your environment needs the following hardware to run Windows Defender Application Guard. +Your environment needs the following hardware to run Microsoft Defender Application Guard. |Hardware|Description| |--------|-----------| @@ -35,7 +35,7 @@ Your environment needs the following hardware to run Windows Defender Applicatio |Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended| ## Software requirements -Your environment needs the following software to run Windows Defender Application Guard. +Your environment needs the following software to run Microsoft Defender Application Guard. |Software|Description| |--------|-----------| diff --git a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md similarity index 85% rename from windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md rename to windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index a5eebdf2a2..e2a6d3e0ec 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -1,6 +1,6 @@ --- -title: Testing scenarios with Windows Defender Application Guard (Windows 10) -description: Suggested testing scenarios for Windows Defender Application Guard, showing how it works in both Standalone and Enterprise-managed mode. +title: Testing scenarios with Microsoft Defender Application Guard (Windows 10) +description: Suggested testing scenarios for Microsoft Defender Application Guard, showing how it works in both Standalone and Enterprise-managed mode. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -29,7 +29,7 @@ You can see how an employee would use standalone mode with Application Guard. ### To test Application Guard in Standalone mode -1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). +1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard). 2. Restart the device, start Microsoft Edge, and then click **New Application Guard window** from the menu. @@ -52,7 +52,7 @@ How to install, set up, turn on, and configure Application Guard for Enterprise- Before you can use Application Guard in enterprise mode, you must install Windows 10 Enterprise edition, version 1709, which includes the functionality. Then, you must use Group Policy to set up the required settings. -1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard#install-application-guard). +1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard#install-application-guard). 2. Restart the device and then start Microsoft Edge. @@ -72,7 +72,7 @@ Before you can use Application Guard in enterprise mode, you must install Window ![Group Policy editor with Neutral resources setting](images/appguard-gp-network-isolation-neutral.png) -4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Turn on Windows Defender Application Guard in Enterprise Mode** setting. +4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Turn on Microsoft Defender Application Guard in Enterprise Mode** setting. 5. Click **Enabled**, choose Option **1**, and click **OK**. @@ -113,7 +113,7 @@ You have the option to change each of these settings to work with your enterpris #### Copy and paste options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard clipboard settings**. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Configure Microsoft Defender Application Guard clipboard settings**. 2. Click **Enabled** and click **OK**. @@ -139,7 +139,7 @@ You have the option to change each of these settings to work with your enterpris #### Print options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard print** settings. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Configure Microsoft Defender Application Guard print** settings. 2. Click **Enabled** and click **OK**. @@ -151,7 +151,7 @@ You have the option to change each of these settings to work with your enterpris #### Data persistence options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow data persistence for Microsoft Defender Application Guard** setting. 2. Click **Enabled** and click **OK**. @@ -176,7 +176,7 @@ You have the option to change each of these settings to work with your enterpris #### Download options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow files to download and save to the host operating system from Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow files to download and save to the host operating system from Microsoft Defender Application Guard** setting. 2. Click **Enabled** and click **OK**. @@ -184,13 +184,13 @@ You have the option to change each of these settings to work with your enterpris 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Download a file from Windows Defender Application Guard. +4. Download a file from Microsoft Defender Application Guard. 5. Check to see the file has been downloaded into This PC > Downloads > Untrusted files. #### Hardware acceleration options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow hardware-accelerated rendering for Microsoft Defender Application Guard** setting. 2. Click **Enabled** and click **OK**. @@ -206,7 +206,7 @@ You have the option to change each of these settings to work with your enterpris #### File trust options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow users to trust files that open in Microsoft Defender Application Guard** setting. 2. Click **Enabled**, set **Options** to 2, and click **OK**. @@ -220,7 +220,7 @@ You have the option to change each of these settings to work with your enterpris #### Camera and microphone options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow camera and microphone access in Microsoft Defender Application Guard** setting. 2. Click **Enabled** and click **OK**. @@ -234,7 +234,7 @@ You have the option to change each of these settings to work with your enterpris #### Root certificate sharing options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user's device** setting. 2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md index 33337c0f38..f150156c0e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-alerts.md @@ -26,7 +26,7 @@ ms.topic: article ## API description Retrieves a collection of Alerts.
Supports [OData V4 queries](https://www.odata.org/documentation/). -
The OData's ```$filter``` query is supported on: ```alertCreationTime```, ```incidentId```, ```InvestigationId```, ```status```, ```severity``` and ```category``` properties. +
The OData's ```$filter``` query is supported on: ```alertCreationTime```, ```lastUpdateTime```, ```incidentId```,```InvestigationId```, ```status```, ```severity``` and ```category``` properties.
See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md) diff --git a/windows/security/threat-protection/windows-defender-application-guard/TOC.md b/windows/security/threat-protection/windows-defender-application-guard/TOC.md deleted file mode 100644 index 9e42b2b691..0000000000 --- a/windows/security/threat-protection/windows-defender-application-guard/TOC.md +++ /dev/null @@ -1,7 +0,0 @@ -# [Windows Defender Application Guard](wd-app-guard-overview.md) - -## [System requirements](reqs-wd-app-guard.md) -## [Install WDAG](install-wd-app-guard.md) -## [Configure WDAG policies](configure-wd-app-guard.md) -## [Test scenarios](test-scenarios-wd-app-guard.md) -## [FAQ](faq-wd-app-guard.md) \ No newline at end of file