mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 22:33:41 +00:00
Merge branch 'master' into whfb-policy-changes
This commit is contained in:
mapalko
@ -154,6 +154,9 @@ These procedures configure NTFS and share permissions on the web server to allow
|
||||
|
||||
9. In the **Advanced Sharing** dialog box, click **OK**.
|
||||
|
||||
> [!Tip]
|
||||
> Make sure that users can access **\\\Server FQDN\sharename**.
|
||||
|
||||
#### Disable Caching
|
||||
1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server).
|
||||
2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**.
|
||||
@ -325,6 +328,9 @@ Sign-in a workstation with access equivalent to a _domain user_.
|
||||
14. Click **Save**
|
||||
15. Sign-out of the Azure portal.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For more details about the actual experience after everything has been configured, please see [Windows Hello for Business and Authentication](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication).
|
||||
|
||||
## Section Review
|
||||
> [!div class="checklist"]
|
||||
> * Configure Internet Information Services to host CRL distribution point
|
||||
|
||||
@ -122,11 +122,9 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co
|
||||
>
|
||||
> If you have one of these subscriptions or licenses, skip the Azure MFA Adapter section.
|
||||
|
||||
#### Azure MFA Provider
|
||||
If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant.
|
||||
|
||||
#### Configure Azure MFA Settings
|
||||
Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
|
||||
#### Azure MFA User States
|
||||
After you have completed configuring your Azure MFA settings, you want to review [How to require two-step verification for a user](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users.
|
||||
|
||||
@ -37,7 +37,7 @@ You are ready to configure device registration for your hybrid environment. Hybr
|
||||
## Configure Azure for Device Registration
|
||||
Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD.
|
||||
|
||||
To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/)
|
||||
To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/).
|
||||
|
||||
Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-manual) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark.
|
||||
|
||||
@ -49,7 +49,7 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory
|
||||
## Follow the Windows Hello for Business hybrid key trust deployment guide
|
||||
1. [Overview](hello-hybrid-cert-trust.md)
|
||||
2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md)
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
3. [New Installation Baseline](hello-hybrid-key-new-install.md)
|
||||
4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md)
|
||||
5. Configure Azure Device Registration (*You are here*)
|
||||
6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md)
|
||||
|
||||
@ -102,8 +102,8 @@ Organizations using older directory synchronization technology, such as DirSync
|
||||
<br>
|
||||
|
||||
|
||||
## Federation with Azure ##
|
||||
You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) or [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later.
|
||||
## Federation with Azure
|
||||
You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/hybrid/whatis-phs) or [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later.
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Non-federated environments
|
||||
|
||||
@ -53,7 +53,7 @@ This table provides info about the most common problems you might encounter whil
|
||||
</tr>
|
||||
<tr>
|
||||
<td>WIP is designed for use by a single user per device.</td>
|
||||
<td>A secondary user on a device might experience app compat issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process.</td>
|
||||
<td>A secondary user on a device might experience app compatibility issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process.</td>
|
||||
<td>We recommend only having one user per managed device.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -121,17 +121,25 @@ This table provides info about the most common problems you might encounter whil
|
||||
<tr>
|
||||
<td>Only enlightened apps can be managed without device enrollment
|
||||
</td>
|
||||
<td>If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintenionally encrypted by unenlighted apps. Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment.</td>
|
||||
<td>If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintentionally encrypted by unenlighted apps. Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment.</td>
|
||||
<td>If all apps need to be managed, enroll the device for MDM.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encypted by one user, other users can't access it.<br/> </td>
|
||||
<td>By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encrypted by one user, other users can't access it.<br/> </td>
|
||||
<td>Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner.
|
||||
</td>
|
||||
<td>If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Microsoft Office Outlook offline data files (PST and OST files) are not marked as <strong>Work</strong> files, and are therefore not protected.
|
||||
</td>
|
||||
<td>If Microsoft Office Outlook is set to work in cached mode (default setting), or if some emails are stored in a local PST file, the data is unprotected.
|
||||
</td>
|
||||
<td>It is recommended to use Microsoft Office Outlook in Online mode, or to use encryption to protect OST and PST files manually.
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -204,28 +204,33 @@
|
||||
#### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
|
||||
#### [What's New](microsoft-defender-atp/mac-whatsnew.md)
|
||||
##### [Deploy]()
|
||||
###### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md)
|
||||
###### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md)
|
||||
###### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md)
|
||||
###### [Manual deployment](microsoft-defender-atp/mac-install-manually.md)
|
||||
##### [Update](microsoft-defender-atp/mac-updates.md)
|
||||
##### [Configure]()
|
||||
###### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md)
|
||||
###### [Set preferences](microsoft-defender-atp/mac-preferences.md)
|
||||
###### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md)
|
||||
##### [Troubleshoot]()
|
||||
###### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md)
|
||||
###### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md)
|
||||
###### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md)
|
||||
###### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md)
|
||||
##### [Privacy](microsoft-defender-atp/mac-privacy.md)
|
||||
##### [Resources](microsoft-defender-atp/mac-resources.md)
|
||||
### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
|
||||
#### [What's New](microsoft-defender-atp/mac-whatsnew.md)
|
||||
|
||||
#### [Deploy]()
|
||||
##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md)
|
||||
##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md)
|
||||
##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md)
|
||||
##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md)
|
||||
#### [Update](microsoft-defender-atp/mac-updates.md)
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md)
|
||||
##### [Set preferences](microsoft-defender-atp/mac-preferences.md)
|
||||
##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md)
|
||||
##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md)
|
||||
##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md)
|
||||
##### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md)
|
||||
|
||||
#### [Privacy](microsoft-defender-atp/mac-privacy.md)
|
||||
#### [Resources](microsoft-defender-atp/mac-resources.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md)
|
||||
#### [What's New](microsoft-defender-atp/linux-whatsnew.md)
|
||||
#### [Deploy]()
|
||||
##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md)
|
||||
##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md)
|
||||
@ -233,13 +238,17 @@
|
||||
|
||||
#### [Update](microsoft-defender-atp/linux-updates.md)
|
||||
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure and validate exclusions](microsoft-defender-atp/linux-exclusions.md)
|
||||
##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md)
|
||||
##### [Set preferences](microsoft-defender-atp/linux-preferences.md)
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot cloud connectivity issues](microsoft-defender-atp/linux-support-connectivity.md)
|
||||
##### [Troubleshoot performance issues](microsoft-defender-atp/linux-support-perf.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot installation issues](microsoft-defender-atp/linux-support-install.md)
|
||||
##### [Troubleshoot cloud connectivity issues](microsoft-defender-atp/linux-support-connectivity.md)
|
||||
##### [Troubleshoot performance issues](microsoft-defender-atp/linux-support-perf.md)
|
||||
|
||||
|
||||
#### [Resources](microsoft-defender-atp/linux-resources.md)
|
||||
|
||||
|
||||
@ -11,7 +11,6 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 10/15/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
|
||||
@ -101,7 +101,7 @@ The following sections describe each of the 15 attack surface reduction rules. T
|
||||
[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | 01443614-cd74-433a-b99e-2ecdc07bfc25 | Supported
|
||||
[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | c1db55ab-c21a-4637-bb3f-a12568109d35 | Supported
|
||||
[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | Supported
|
||||
[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | d1e49aac-8f56-4280-b9ba-993a6d77406c | Not supported
|
||||
[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | d1e49aac-8f56-4280-b9ba-993a6d77406c | Supported
|
||||
[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 | Supported
|
||||
[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | 26190899-1602-49e8-8b27-eb1d0a1ce869 | Supported
|
||||
[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c | Supported
|
||||
@ -273,9 +273,6 @@ GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
|
||||
This rule blocks processes created through [PsExec](https://docs.microsoft.com/sysinternals/downloads/psexec) and [WMI](https://docs.microsoft.com/windows/win32/wmisdk/about-wmi) from running. Both PsExec and WMI can remotely execute code, so there is a risk of malware abusing this functionality for command and control purposes, or to spread an infection throughout an organization's network.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> File and folder exclusions do not apply to this attack surface reduction rule.
|
||||
|
||||
> [!WARNING]
|
||||
> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr) because this rule blocks WMI commands the Configuration Manager client uses to function correctly.
|
||||
|
||||
|
||||
@ -102,7 +102,8 @@ See [Netsh Command Syntax, Contexts, and Formatting](https://docs.microsoft.com/
|
||||
|
||||
## Enable access to Microsoft Defender ATP service URLs in the proxy server
|
||||
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Microsoft Defender ATP service in port 80 and 443:
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed below to the allowed domains list.
|
||||
If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed below from HTTPS scanning.
|
||||
|
||||
> [!NOTE]
|
||||
> settings-win.data.microsoft.com is only needed if you have Windows 10 machines running version 1803 or earlier.<br>
|
||||
|
||||
@ -41,10 +41,17 @@ The follow table shows the exclusion types supported by Microsoft Defender ATP f
|
||||
|
||||
Exclusion | Definition | Examples
|
||||
---|---|---
|
||||
File extension | All files with the extension, anywhere on the machine | .test
|
||||
File | A specific file identified by the full path | /var/log/test.log
|
||||
Folder | All files under the specified folder | /var/log/
|
||||
Process | A specific process (specified either by the full path or file name) and all files opened by it | /bin/cat<br/>cat
|
||||
File extension | All files with the extension, anywhere on the machine | `.test`
|
||||
File | A specific file identified by the full path | `/var/log/test.log`<br/>`/var/log/*.log`<br/>`/var/log/install.?.log`
|
||||
Folder | All files under the specified folder | `/var/log/`<br/>`/var/*/`
|
||||
Process | A specific process (specified either by the full path or file name) and all files opened by it | `/bin/cat`<br/>`cat`<br/>`c?t`
|
||||
|
||||
File, folder, and process exclusions support the following wildcards:
|
||||
|
||||
Wildcard | Description | Example | Matches
|
||||
---|---|---|---
|
||||
\* | Matches any number of any characters including none | `/var/\*/\*.log` | `/var/log/system.log`
|
||||
? | Matches any single character | `file?.log` | `file1.log`<br/>`file2.log`
|
||||
|
||||
## How to configure the list of exclusions
|
||||
|
||||
|
||||
@ -0,0 +1,121 @@
|
||||
---
|
||||
title: Troubleshoot installation issues for Microsoft Defender ATP for Linux
|
||||
ms.reviewer:
|
||||
description: Troubleshoot installation issues for Microsoft Defender ATP for Linux
|
||||
keywords: microsoft, defender, atp, linux, installation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Troubleshoot installation issues for Microsoft Defender ATP for Linux
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md)
|
||||
|
||||
## Verify if installation succeeded
|
||||
|
||||
An error in installation may or may not result in a meaningful error message by the package manager. To verify if the installation succeeded, one can obtain and check the installation logs using:
|
||||
```bash
|
||||
$ sudo journalctl | grep 'microsoft-mdatp' > installation.log
|
||||
$ grep 'postinstall end' installation.log
|
||||
|
||||
microsoft-mdatp-installer[102243]: postinstall end [2020-03-26 07:04:43OURCE +0000] 102216
|
||||
```
|
||||
An output from the previous command with correct date and time of installation indicates success.
|
||||
|
||||
Also check the [Client configuration](linux-install-manually.md#client-configuration) to verify the health of the product and detect the EICAR text file.
|
||||
|
||||
## Installation failed
|
||||
|
||||
Check if the mdatp service is running
|
||||
```bash
|
||||
$ systemctl status mdatp
|
||||
|
||||
● mdatp.service - Microsoft Defender ATP
|
||||
Loaded: loaded (/lib/systemd/system/mdatp.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Thu 2020-03-26 10:37:30 IST; 23h ago
|
||||
Main PID: 1966 (wdavdaemon)
|
||||
Tasks: 105 (limit: 4915)
|
||||
CGroup: /system.slice/mdatp.service
|
||||
├─1966 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
├─1967 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
└─1968 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
|
||||
## Steps to troubleshoot if mdatp service isn't running
|
||||
|
||||
1. Check if “mdatp” user exists:
|
||||
```bash
|
||||
$ id “mdatp”
|
||||
```
|
||||
If there’s no output, run
|
||||
```bash
|
||||
$ sudo useradd --system --no-create-home --user-group --shell /usr/sbin/nologin mdatp
|
||||
```
|
||||
|
||||
2. Try enabling and restarting the service using:
|
||||
```bash
|
||||
$ sudo systemctl enable mdatp
|
||||
$ sudo systemctl restart mdatp
|
||||
```
|
||||
|
||||
3. If mdatp.service isn't found upon running the previous command, run
|
||||
```bash
|
||||
$ sudo cp /opt/microsoft/mdatp/conf/mdatp.service <systemd_path>
|
||||
|
||||
where <systemd_path> is
|
||||
/lib/systemd/system for Ubuntu and Debian distributions
|
||||
/usr/lib/systemd/system for Rhel, CentOS, Oracle and SLES
|
||||
```
|
||||
and then rerun step 2.
|
||||
|
||||
4. If the above steps don’t work, check if SELinux is installed and in enforcing mode. If so, try setting it to permissive (preferably) or disabled mode. It can be done by setting the parameter `SELINUX` to "permissive" or "disabled" in `/etc/selinux/config` file, followed by reboot. Check the man-page of selinux for more details.
|
||||
Now try restarting the mdatp service using step 2. Revert the configuration change immediately though for security reasons after trying it and reboot.
|
||||
|
||||
5. Ensure that the daemon has executable permission.
|
||||
```bash
|
||||
$ ls -l /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
|
||||
-rwxr-xr-x 2 root root 15502160 Mar 3 04:47 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
If the daemon doesn't have executable permissions, make it executable using:
|
||||
```bash
|
||||
$ sudo chmod 0755 /opt/microsoft/mdatp/sbin/wdavdaemon
|
||||
```
|
||||
and retry running step 2.
|
||||
|
||||
6. Ensure that the file system containing wdavdaemon isn't mounted with “noexec”.
|
||||
|
||||
## If mdatp service is running, but EICAR text file detection doesn't work
|
||||
|
||||
1. Check the file system type using:
|
||||
```bash
|
||||
$ findmnt -T <path_of_EICAR_file>
|
||||
```
|
||||
Currently supported file systems for on-access activity are listed [here](microsoft-defender-atp-linux.md#system-requirements). Any files outside these file systems won't be scanned.
|
||||
|
||||
## Command-line tool “mdatp” isn't working
|
||||
|
||||
1. If running the command-line tool `mdatp` gives an error `command not found`, run the following command:
|
||||
```bash
|
||||
$ sudo ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp
|
||||
```
|
||||
and try again.
|
||||
|
||||
If none of the above steps help, collect the diagnostic logs:
|
||||
```bash
|
||||
$ sudo mdatp --diagnostic --create
|
||||
```
|
||||
Path to a zip file that contains the logs will be displayed as an output. Reach out to our customer support with these logs.
|
||||
@ -0,0 +1,27 @@
|
||||
---
|
||||
title: What's new in Microsoft Defender Advanced Threat Protection for Linux
|
||||
description: List of major changes for Microsoft Defender ATP for Linux.
|
||||
keywords: microsoft, defender, atp, linux, whatsnew, release
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: security
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# What's new in Microsoft Defender Advanced Threat Protection for Linux
|
||||
|
||||
## 100.90.70
|
||||
|
||||
- Antivirus [exclusions now support wildcards](linux-exclusions.md#supported-exclusion-types)
|
||||
- Added the ability to [troubleshoot performance issues](linux-support-perf.md) through the `mdatp` command-line tool
|
||||
- Improvements to make the package installation more robust
|
||||
- Performance improvements & bug fixes
|
||||
@ -41,10 +41,10 @@ The follow table shows the exclusion types supported by Microsoft Defender ATP f
|
||||
|
||||
Exclusion | Definition | Examples
|
||||
---|---|---
|
||||
File extension | All files with the extension, anywhere on the machine | .test
|
||||
File | A specific file identified by the full path | /var/log/test.log
|
||||
Folder | All files under the specified folder | /var/log/
|
||||
Process | A specific process (specified either by the full path or file name) and all files opened by it | /bin/cat<br/>cat
|
||||
File extension | All files with the extension, anywhere on the machine | `.test`
|
||||
File | A specific file identified by the full path | `/var/log/test.log`
|
||||
Folder | All files under the specified folder | `/var/log/`
|
||||
Process | A specific process (specified either by the full path or file name) and all files opened by it | `/bin/cat`<br/>`cat`
|
||||
|
||||
## How to configure the list of exclusions
|
||||
|
||||
|
||||
@ -70,6 +70,8 @@ In general you need to take the following steps:
|
||||
- [Deploy using Puppet configuration management tool](linux-install-with-puppet.md)
|
||||
- [Deploy using Ansible configuration management tool](linux-install-with-ansible.md)
|
||||
|
||||
If you experience any installation failures, refer to [Troubleshooting installation failures in Microsoft Defender ATP for Linux](linux-support-install.md).
|
||||
|
||||
### System requirements
|
||||
|
||||
- Supported Linux server distributions and versions:
|
||||
|
||||
@ -28,6 +28,9 @@ Describes the best practices, location, values, management, and security conside
|
||||
|
||||
Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine). You can activate the screen saver by enabling the Group Policy **User Configuration\Administrative Templates\Control Panel\Personalization\Enable screen saver**. This policy setting allows you to control the locking time by using Group Policy.
|
||||
|
||||
> [!NOTE]
|
||||
> If the **Interactive logon: Machine inactivity limit** security policy setting is configured, the device locks not only when inactive time exceeds the inactivity limit, but also when the screensaver activates or when the display turns off because of power settings.
|
||||
|
||||
### Possible values
|
||||
|
||||
The automatic lock of the device is set in elapsed seconds of inactivity, which can range from zero (0) to 599,940 seconds (166.65 hours).
|
||||
|
||||
@ -27,7 +27,7 @@ ms.date: 02/28/2018
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
As you deploy Windows Defender Application Control (WDAC) (also part of Windows Defender Device Guard), you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md).
|
||||
As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md).
|
||||
|
||||
If you have an internal CA, complete these steps to create a code signing certificate.
|
||||
Only RSA algorithm is supported for the code signing certificate, and signatures must be PKCS 1.5 padded.
|
||||
@ -98,7 +98,7 @@ Now that the template is available to be issued, you must request one from the c
|
||||
>[!NOTE]
|
||||
>If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client.
|
||||
|
||||
This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the computer on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps:
|
||||
This certificate must be installed in the user's personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the computer on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps:
|
||||
|
||||
1. Right-click the certificate, point to **All Tasks**, and then click **Export**.
|
||||
|
||||
|
||||
@ -81,7 +81,7 @@ To create a catalog file, you use a tool called **Package Inspector**. You must
|
||||
`PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName`
|
||||
|
||||
>[!NOTE]
|
||||
>Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values.
|
||||
>Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries' hash values.
|
||||
|
||||
When finished, the files will be saved to your desktop. You can double-click the \*.cat file to see its contents, and you can view the \*.cdf file with a text editor.
|
||||
|
||||
@ -95,16 +95,16 @@ Packages can fail for the following reasons:
|
||||
- To diagnose whether USN journal size is the issue, after running through Package Inspector, click Start > install app > PackageInspector stop
|
||||
- Get the value of the reg key at HKEY\_CURRENT\_USER/PackageInspectorRegistryKey/c: (this was the most recent USN when you ran PackageInspector start)
|
||||
- `fsutil usn readjournal C: startusn=RegKeyValue > inspectedusn.txt`
|
||||
- ReadJournal command should throw an error if the older USNs don’t exist anymore due to overflow
|
||||
- ReadJournal command should throw an error if the older USNs don't exist anymore due to overflow
|
||||
- For USN Journal, log size can be expanded using: `fsutil usn createjournal` command with a new size and alloc delta. `Fsutil usn queryjournal` will give the current size and allocation delta, so using a multiple of that may help
|
||||
- To diagnose whether Eventlog size is the issue, look at the Microsoft/Windows/CodeIntegrity/Operational log under Applications and Services logs in Event Viewer and ensure that there are entries present from when you began Package Inspector (You can use write time as a justification; if you started the install 2 hours ago and there are only entries from 30 minutes prior, the log is definitely too small)
|
||||
- To increase Eventlog size, in Event Viewer you can right click the operational log, click properties, and then set new values (some multiple of what it was previously)
|
||||
- Package files that change hash each time the package is installed
|
||||
- Package Inspector is completely incompatible if files in the package (temporary or otherwise) change hash each time the package is installed. You can diagnose this by looking at the hash field in the 3077 block events when the package is failing in enforcement. If each time you attempt to run the package you get a new block event with a different hash, the package will not work with Package Inspector
|
||||
- Files with an invalid signature blob or otherwise “unhashable” files
|
||||
- Files with an invalid signature blob or otherwise "unhashable" files
|
||||
- This issue arises when a file that has been signed is modified post signing in a way that invalidates the PE header and renders the file unable to be hashed by the Authenticode Spec.
|
||||
- WDAC uses Authenticode Hashes to validate files when they are running. If the file is unhashable via the authenticode SIP, there is no way to identify the file to allow it, regardless of if you attempt to add the file to the policy directly, or re-sign the file with a Package Inspector catalog (the signature is invalidated due to file being edited, file can’t be allowed by hash due to authenticode hashing algorithm rejecting it)
|
||||
- Recent versions of InstallShield packages that use custom actions can hit this. If the DLL input to the custom action was signed before being put through InstallShield, InstallShield adds tracking markers to the file (editing it post signature) which leaves the file in this “unhashable” state and renders the file unable to be allowed by Device Guard (regardless of if you try to allow directly by policy or resign with Package Inspector)
|
||||
- WDAC uses Authenticode Hashes to validate files when they are running. If the file is unhashable via the authenticode SIP, there is no way to identify the file to allow it, regardless of if you attempt to add the file to the policy directly, or re-sign the file with a Package Inspector catalog (the signature is invalidated due to file being edited, file can't be allowed by hash due to authenticode hashing algorithm rejecting it)
|
||||
- Recent versions of InstallShield packages that use custom actions can hit this. If the DLL input to the custom action was signed before being put through InstallShield, InstallShield adds tracking markers to the file (editing it post signature) which leaves the file in this "unhashable" state and renders the file unable to be allowed by Windows Defender (regardless of if you try to allow directly by policy or resign with Package Inspector)
|
||||
|
||||
## Catalog signing with SignTool.exe
|
||||
|
||||
@ -124,7 +124,7 @@ To sign the existing catalog file, copy each of the following commands into an e
|
||||
|
||||
`$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"`
|
||||
|
||||
2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user’s personal store.
|
||||
2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user's personal store.
|
||||
|
||||
3. Sign the catalog file with Signtool.exe:
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 02/28/2018
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
WDAC policies can easily be deployed and managed with Group Policy. A Windows Defender Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Windows Defender Device Guard hardware-based security features and Windows Defender Application Control policies. The following procedure walks you through how to deploy a WDAC policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**.
|
||||
WDAC policies can easily be deployed and managed with Group Policy. Windows Defender allows you to simplify deployment Windows Defender hardware-based security features and Windows Defender Application Control policies. The following procedure walks you through how to deploy a WDAC policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**.
|
||||
|
||||
> [!NOTE]
|
||||
> This walkthrough requires that you have previously created a WDAC policy and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a WDAC policy, see [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md), earlier in this topic.
|
||||
|
||||
@ -35,7 +35,7 @@ You should consider using WDAC as part of your organization's application contro
|
||||
|
||||
- You have deployed or plan to deploy the supported versions of Windows in your organization.
|
||||
- You need improved control over the access to your organization's applications and the data your users access.
|
||||
- Your organization has a well-defined process for application management and deployed.
|
||||
- Your organization has a well-defined process for application management and deployment.
|
||||
- You have resources to test policies against the organization's requirements.
|
||||
- You have resources to involve Help Desk or to build a self-help process for end-user application access issues.
|
||||
- The group's requirements for productivity, manageability, and security can be controlled by restrictive policies.
|
||||
|
||||
@ -31,7 +31,7 @@ This topic covers guidelines for using code signing control classic Windows apps
|
||||
|
||||
## Reviewing your applications: application signing and catalog files
|
||||
|
||||
Typically, WDAC policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed.
|
||||
Typically, WDAC policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a "catalog file" from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed.
|
||||
|
||||
Catalog files can be very useful for unsigned LOB applications that cannot easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your WDAC policies typically do not have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of WDAC (compared to using catalog signing).
|
||||
|
||||
@ -45,7 +45,7 @@ To obtain signed applications or embed signatures in your in-house applications,
|
||||
|
||||
To use catalog signing, you can choose from the following options:
|
||||
|
||||
- Use the Windows Defender Device Guard signing portal available in the Microsoft Store for Business and Education. The portal is a Microsoft web service that you can use to sign your Classic Windows applications. For more information, see [Device Guard signing](https://technet.microsoft.com/itpro/windows/manage/device-guard-signing-portal).
|
||||
- Use the Windows Defender signing portal available in the Microsoft Store for Business and Education. The portal is a Microsoft web service that you can use to sign your Classic Windows applications.
|
||||
|
||||
- Create your own catalog files, which are described in the next section.
|
||||
|
||||
@ -53,12 +53,12 @@ To use catalog signing, you can choose from the following options:
|
||||
|
||||
Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application.
|
||||
|
||||
Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated each time an application is updated, which requires the catalog file to be updated also.
|
||||
Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries' hash values are updated each time an application is updated, which requires the catalog file to be updated also.
|
||||
|
||||
After you have created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files.
|
||||
|
||||
> [!NOTE]
|
||||
> Package Inspector only works on operating systems that support Windows Defender Device Guard, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT.
|
||||
> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT.
|
||||
|
||||
For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md).
|
||||
|
||||
|
||||
@ -29,20 +29,20 @@ This topic provides a roadmap for planning and getting started on the Windows De
|
||||
|
||||
1. Review requirements, especially hardware requirements for VBS.
|
||||
|
||||
2. Group devices by degree of control needed. Do most devices fit neatly into a few categories, or are they scattered across all categories? Are users allowed to install any application or must they choose from a list? Are users allowed to use their own peripheral devices?<br>Deployment is simpler if everything is locked down in the same way, but meeting individual departments’ needs, and working with a wide variety of devices, may require a more complicated and flexible deployment.
|
||||
2. Group devices by degree of control needed. Do most devices fit neatly into a few categories, or are they scattered across all categories? Are users allowed to install any application or must they choose from a list? Are users allowed to use their own peripheral devices?<br>Deployment is simpler if everything is locked down in the same way, but meeting individual departments' needs, and working with a wide variety of devices, may require a more complicated and flexible deployment.
|
||||
|
||||
3. Review how much variety in software and hardware is needed by roles or departments. The following questions can help you clarify how many WDAC policies to create:
|
||||
|
||||
- How standardized is the hardware?<br>This can be relevant because of drivers. You could create a WDAC policy on hardware that uses a particular set of drivers, and if other drivers in your environment use the same signature, they would also be allowed to run. However, you might need to create several WDAC policies on different "reference" hardware, then merge the policies together, to ensure that the resulting policy recognizes all the drivers in your environment.
|
||||
|
||||
- What software does each department or role need? Should they be able to install and run other departments’ software?<br>If multiple departments are allowed to run the same list of software, you might be able to merge several WDAC policies to simplify management.
|
||||
- What software does each department or role need? Should they be able to install and run other departments' software?<br>If multiple departments are allowed to run the same list of software, you might be able to merge several WDAC policies to simplify management.
|
||||
|
||||
- Are there departments or roles where unique, restricted software is used?<br>If one department needs to run an application that no other department is allowed, it might require a separate WDAC policy. Similarly, if only one department must run an old version of an application (while other departments allow only the newer version), it might require a separate WDAC policy.
|
||||
|
||||
- Is there already a list of accepted applications?<br>A list of accepted applications can be used to help create a baseline WDAC policy.<br>As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser).
|
||||
|
||||
- As part of a threat review process, have you reviewed systems for software that can load arbitrary DLLs or run code or scripts?
|
||||
In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Application Control policies.
|
||||
In day-to-day operations, your organization's security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Application Control policies.
|
||||
|
||||
Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass WDAC.
|
||||
|
||||
@ -70,7 +70,7 @@ This topic provides a roadmap for planning and getting started on the Windows De
|
||||
|
||||
## Known issues
|
||||
|
||||
This section covers known issues with WDAC and Device Guard. Virtualization-based protection of code integrity may be incompatible with some devices and applications, which might cause unexpected failures, data loss, or a blue screen error (also called a stop error).
|
||||
This section covers known issues with WDAC. Virtualization-based protection of code integrity may be incompatible with some devices and applications, which might cause unexpected failures, data loss, or a blue screen error (also called a stop error).
|
||||
Test this configuration in your lab before enabling it in production.
|
||||
|
||||
### MSI Installations are blocked by WDAC
|
||||
|
||||
Reference in New Issue
Block a user