From 4fea186ce457826b13cc226440d3971ba45a0a49 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sat, 8 Aug 2020 01:25:22 +0530 Subject: [PATCH 01/11] adjusted broken link as per the user report #8020 , so i adjusted ref1 --- ...figure-advanced-scan-types-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md index 3464a06430..8c5b7868d1 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md @@ -27,8 +27,6 @@ manager: dansimp See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. - - ## Use Microsoft Endpoint Configuration Manager to configure scanning options: See [How to create and deploy antimalware policies: Scan settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring Microsoft Endpoint Configuration Manager (current branch). @@ -70,6 +68,8 @@ See [Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx). + + ## Email scanning limitations Email scanning enables scanning of email files used by Outlook and other mail clients during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: From b539936ae487051cf01f20ae6a5756b65f9b9aad Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sun, 9 Aug 2020 19:35:12 +0530 Subject: [PATCH 02/11] added moderate blocking level as per the user report #8033 , si i added after verification using GPO in windows v2004. --- ...cify-cloud-protection-level-microsoft-defender-antivirus.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md index c6a20d3a13..25d828f792 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md @@ -62,7 +62,8 @@ See [How to create and deploy antimalware policies: Cloud-protection service](ht 5. Expand the tree to **Windows components > Microsoft Defender Antivirus > MpEngine**. 6. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: - - **Default Microsoft Defender Antivirus blocking level** provides strong detection without increasing the risk of detecting legitimate files. + - **Default blocking level** provides strong detection without increasing the risk of detecting legitimate files. + - **Moderate blocking level** provides moderate only for high confidence detections - **High blocking level** applies a strong level of detection while optimizing client performance (greater chance of false positives). - **High + blocking level** applies additional protection measures (may impact client performance and increase risk of false positives). - **Zero tolerance blocking level** blocks all unknown executables. From 44e8cd66ca3deb23fb6fb43cbd0c97f382c0fea7 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 12 Aug 2020 09:48:43 +0500 Subject: [PATCH 03/11] Update microsoft-defender-antivirus-on-windows-server-2016.md --- .../microsoft-defender-antivirus-on-windows-server-2016.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md index 2108fffbab..1b1044b148 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -20,7 +20,8 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- Windows Server 2016 +- Windows Server 2019 Microsoft Defender Antivirus is available on Windows Server 2016 and Windows Server 2019. In some instances, Microsoft Defender Antivirus is referred to as Endpoint Protection; however, the protection engine is the same. From a1da694d4df55b38a7e0caac84dd799eb008abe2 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 12 Aug 2020 12:45:05 +0500 Subject: [PATCH 04/11] Update faq-md-app-guard.md --- .../microsoft-defender-application-guard/faq-md-app-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md index c719d57d20..1734d5f66a 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md @@ -45,9 +45,9 @@ Depending on your organization's settings, employees can copy and paste images ( To help keep the Application Guard Edge session secure and isolated from the host device, we don't copy the Favorites stored in the Application Guard Edge session back to the host device. -### Why aren’t employees able to see their Extensions in the Application Guard Edge session? +### Are Extensions supported in the Application Guard? -Currently, the Application Guard Edge session doesn't support Extensions. However, we're closely monitoring your feedback about this. +Extension installs in the container is supported starting from Microsoft Edge version 81. For more details, see [Extension support inside the container](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard#extension-support-inside-the-container). ### How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? From a3a0db94169a3c19e45d814a77b27dc39641ade0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 12 Aug 2020 08:53:24 -0700 Subject: [PATCH 05/11] Update faq-md-app-guard.md --- .../faq-md-app-guard.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md index 1734d5f66a..e63485128d 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 06/02/2020 +ms.date: 08/12/2020 ms.reviewer: manager: dansimp ms.custom: asr @@ -45,7 +45,7 @@ Depending on your organization's settings, employees can copy and paste images ( To help keep the Application Guard Edge session secure and isolated from the host device, we don't copy the Favorites stored in the Application Guard Edge session back to the host device. -### Are Extensions supported in the Application Guard? +### Are extensions supported in the Application Guard? Extension installs in the container is supported starting from Microsoft Edge version 81. For more details, see [Extension support inside the container](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard#extension-support-inside-the-container). @@ -119,8 +119,8 @@ For guidance on how to create a firewall rule by using group policy, see: - [Open Group Policy management console for Microsoft Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security) First rule (DHCP Server): -1. Program path: %SystemRoot%\System32\svchost.exe -2. Local Service: Sid: S-1-5-80-2009329905-444645132-2728249442-922493431-93864177 (Internet Connection Service (SharedAccess)) +1. Program path: `%SystemRoot%\System32\svchost.exe` +2. Local Service: Sid: `S-1-5-80-2009329905-444645132-2728249442-922493431-93864177` (Internet Connection Service (SharedAccess)) 3. Protocol UDP 4. Port 67 @@ -148,14 +148,14 @@ This is a two step process. Step 1: -Enable Internet Connection sharing by changing the Group Policy setting “Prohibit use of Internet Connection Sharing on your DNS domain network” which is part of the MS Security baseline from Enabled to Disabled. +Enable Internet Connection sharing by changing the Group Policy setting **Prohibit use of Internet Connection Sharing on your DNS domain network.** This setting is part of the Microsoft security baseline. Change it from Enabled to Disabled. Step 2: -1. Disable IpNat.sys from ICS load -System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1 -2. Configure ICS (SharedAccess) to enabled -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3 -3. Disabling IPNAT (Optional) -HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4 -4. Reboot. +1. Disable IpNat.sys from ICS load: +`System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1`. +2. Configure ICS (SharedAccess) to enabled: +`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3`. +3. Disable IPNAT (Optional): +`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4`. +4. Restart the device. From 61c9fc833797042cca5c70896c6eda36df7bc205 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 12 Aug 2020 08:53:41 -0700 Subject: [PATCH 06/11] Update windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-application-guard/faq-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md index e63485128d..1dfee7b591 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md @@ -47,7 +47,7 @@ To help keep the Application Guard Edge session secure and isolated from the hos ### Are extensions supported in the Application Guard? -Extension installs in the container is supported starting from Microsoft Edge version 81. For more details, see [Extension support inside the container](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard#extension-support-inside-the-container). +Extension installs in the container are supported from Microsoft Edge version 81. For more details, see [Extension support inside the container](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard#extension-support-inside-the-container). ### How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? From 231f3152db213b2d55da956de3e6509a0cc85976 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 12 Aug 2020 08:59:31 -0700 Subject: [PATCH 07/11] Update configure-advanced-scan-types-microsoft-defender-antivirus.md --- ...figure-advanced-scan-types-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md index 8c5b7868d1..1a30bd6538 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md @@ -23,11 +23,11 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -**Use Microsoft Intune to configure scanning options** +## Use Microsoft Intune to configure scanning options See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. -## Use Microsoft Endpoint Configuration Manager to configure scanning options: +## Use Microsoft Endpoint Configuration Manager to configure scanning options See [How to create and deploy antimalware policies: Scan settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring Microsoft Endpoint Configuration Manager (current branch). From baa4988e0f77de06f3978a6b1a2b38484727ec57 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 12 Aug 2020 09:01:46 -0700 Subject: [PATCH 08/11] Update specify-cloud-protection-level-microsoft-defender-antivirus.md --- ...ecify-cloud-protection-level-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md index 25d828f792..7ba23e9902 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 09/03/2018 +ms.date: 08/12/2020 ms.reviewer: manager: dansimp ms.custom: nextgen From be15030b34d7329bc5771e5cd86e014003e4d06d Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 12 Aug 2020 09:24:06 -0700 Subject: [PATCH 09/11] pencil edit --- ...configure-advanced-scan-types-microsoft-defender-antivirus.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md index 1a30bd6538..9800bbf096 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md @@ -7,7 +7,6 @@ ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb From 0a3fb8679a7a06a4e7559a9b9d9da9decbd58e23 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 12 Aug 2020 09:24:43 -0700 Subject: [PATCH 10/11] pencil edit --- .../microsoft-defender-antivirus-on-windows-server-2016.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md index 1b1044b148..a5087f74b0 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -7,7 +7,6 @@ ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb From 31e78c7e45f269e13d950fce9e2180ced5ea98d6 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 12 Aug 2020 09:26:11 -0700 Subject: [PATCH 11/11] pencil edit --- ...pecify-cloud-protection-level-microsoft-defender-antivirus.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md index 7ba23e9902..07f45f646e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md @@ -7,7 +7,6 @@ ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb