mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-24 23:03:42 +00:00
Merge branch 'master' into asr-content-updates
This commit is contained in:
martyav
@ -3375,7 +3375,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
### <a href="" id="bkmk-serveroperators"></a>Server Operators
|
||||
|
||||
Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Memebers of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved.
|
||||
Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Members of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved.
|
||||
|
||||
By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups, Administrators and Domain Admins, in the domain, and the Enterprise Admins group. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table.
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ ms.reviewer:
|
||||
The Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> The Microsoft PIN Reset service only works with Windows 10, version 1709 to 1809 with **Enterprise Edition**. The feature works with **Pro** edition with Windows 10, version 1903 and newer.
|
||||
> The Microsoft PIN Reset service only works with **Enterprise Edition** for Windows 10, version 1709 to 1809. The feature works with **Enterprise Edition** and **Pro** edition with Windows 10, version 1903 and newer.
|
||||
|
||||
### Onboarding the Microsoft PIN reset service to your Intune tenant
|
||||
|
||||
|
||||
@ -46,6 +46,7 @@
|
||||
|
||||
### [Next-generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md)
|
||||
#### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md)
|
||||
|
||||
### [Endpoint detection and response]()
|
||||
#### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md)
|
||||
@ -135,8 +136,8 @@
|
||||
|
||||
|
||||
#### [Custom detections]()
|
||||
##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md)
|
||||
##### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
##### [Understand custom detections](microsoft-defender-atp/overview-custom-detections.md)
|
||||
##### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
|
||||
### [Management and APIs]()
|
||||
#### [Overview of management and APIs](microsoft-defender-atp/management-apis.md)
|
||||
@ -276,7 +277,7 @@
|
||||
###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md)
|
||||
###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
|
||||
###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md)
|
||||
###### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md)
|
||||
###### [Configure antivirus exclusions Windows Server 2016 and 2019](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md)
|
||||
|
||||
##### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md)
|
||||
##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md)
|
||||
|
||||
@ -38,7 +38,7 @@ Microsoft classifies most malicious software into one of the following categorie
|
||||
|
||||
* **Downloader:** A type of malware that downloads other malware onto your device. It must connect to the internet to download files.
|
||||
|
||||
* **Dropper:** A type of malware that installs other malware files onto your device. Unlike a downloader, a dropper doesn’t have to connect to the internet to drop malicious files. The dropped files are typically embedded in the dropper itself.
|
||||
* **Dropper:** A type of malware that installs other malware files onto your device. Unlike a downloader, a dropper doesn't have to connect to the internet to drop malicious files. The dropped files are typically embedded in the dropper itself.
|
||||
|
||||
* **Exploit:** A piece of code that uses software vulnerabilities to gain access to your device and perform other tasks, such as installing malware. [See more information about exploits](exploits-malware.md).
|
||||
|
||||
@ -84,7 +84,7 @@ Software that exhibits lack of choice might:
|
||||
|
||||
Software must not mislead or coerce you into making decisions about your device. This is considered behavior that limits your choices. In addition to the previous list, software that exhibits lack of choice might:
|
||||
|
||||
* Display exaggerated claims about your device’s health.
|
||||
* Display exaggerated claims about your device's health.
|
||||
|
||||
* Make misleading or inaccurate claims about files, registry entries, or other items on your device.
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Top scoring in industry tests (AV-TEST, AV Comparatives, SE Labs, MITRE ATT&CK)
|
||||
ms.reviewer:
|
||||
description: Microsoft Defender ATP consistently achieves high scores in independent tests. View the latest scores and analysis.
|
||||
keywords: av-test, av-comparatives, SE labs, MITRE ATT&CK, antivirus test, av testing, security product testing, security industry tests, industry antivirus tests, best antivirus, endpoint protection platform, EPP, endpoint detection and response, EDR, Windows Defender Antivirus, Windows 10, Microsoft Defender Antivirus, WDAV, MDATP, Microsoft Threat Protection, security, malware, av, antivirus, scores, next generation protection
|
||||
keywords: Windows Defender Antivirus, av reviews, antivirus test, av testing, latest av scores, detection scores, security product testing, security industry tests, industry antivirus tests, best antivirus, av-test, av-comparatives, SE labs, MITRE ATT&CK, endpoint protection platform, EPP, endpoint detection and response, EDR, Windows 10, Microsoft Defender Antivirus, WDAV, MDATP, Microsoft Threat Protection, security, malware, av, antivirus, scores, next generation protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: secure
|
||||
ms.sitesec: library
|
||||
@ -50,7 +50,7 @@ The AV-TEST Product Review and Certification Report tests on three categories: p
|
||||
|
||||
### AV-Comparatives: Protection rating of 99.9% in the latest test
|
||||
|
||||
Business Security Test consists of three main parts: the Real-World Protection Test that mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (for example by USB), and the Performance Test that looks at the impact on the system’s performance.
|
||||
Business Security Test consists of three main parts: the Real-World Protection Test that mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (for example by USB), and the Performance Test that looks at the impact on the system's performance.
|
||||
|
||||
- Business Security Test 2019 (August — September): [Real-World Protection Rate 99.9%](https://www.av-comparatives.org/tests/business-security-test-august-september-2019-factsheet/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp) <sup>**Latest**</sup>
|
||||
|
||||
@ -94,7 +94,7 @@ MITRE tested the ability of products to detect techniques commonly used by the t
|
||||
|
||||
## To what extent are tests representative of protection in the real world?
|
||||
|
||||
Independent security industry tests aim to evaluate the best antivirus and security products in an unbiased manner. However, it is important to remember that Microsoft sees a wider and broader set of threats beyond what’s tested in the evaluations highlighted in this topic. For example, in an average month Microsoft's security products identify over 100 million new threats. Even if an independent tester can acquire and test 1% of those threats, that is a million tests across 20 or 30 products. In other words, the vastness of the malware landscape makes it extremely difficult to evaluate the quality of protection against real world threats.
|
||||
Independent security industry tests aim to evaluate the best antivirus and security products in an unbiased manner. However, it is important to remember that Microsoft sees a wider and broader set of threats beyond what's tested in the evaluations highlighted in this topic. For example, in an average month Microsoft's security products identify over 100 million new threats. Even if an independent tester can acquire and test 1% of those threats, that is a million tests across 20 or 30 products. In other words, the vastness of the malware landscape makes it extremely difficult to evaluate the quality of protection against real world threats.
|
||||
|
||||
The capabilities within Microsoft Defender ATP provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses) that are not factored into industry antivirus tests, and address some of the latest and most sophisticated threats. Isolating AV from the rest of Microsoft Defender ATP creates a partial picture of how Microsoft's security stack operates in the real world. For example, attack surface reduction and endpoint detection & response capabilities can help prevent malware from getting onto devices in the first place. We have proven that [Microsoft Defender ATP components catch samples](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA) that Windows Defender Antivirus missed in these industry tests, which is more representative of how effectively Microsoft's security suite protects customers in the real world.
|
||||
|
||||
|
||||
@ -35,13 +35,16 @@ If you're already a Microsoft Defender ATP customer, you can apply through the M
|
||||
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**.
|
||||
|
||||
2. Click **Apply**.
|
||||
2. Click **Apply**.
|
||||
|
||||
|
||||
|
||||
3. Enter your name and email address so that Microsoft can get back to you on your application.
|
||||
3. Enter your name and email address so that Microsoft can get back to you on your application.
|
||||
|
||||
|
||||
|
||||
4. Read the privacy statement, then click **Submit** when you're done. You will receive a welcome email once your application is approved.
|
||||
4. Read the [privacy statement](https://privacy.microsoft.com/en-us/privacystatement), then click **Submit** when you're done. You will receive a welcome email once your application is approved.
|
||||
|
||||
|
||||
|
||||
6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**.
|
||||
@ -74,15 +77,17 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
|
||||
2. From the upper right-hand menu, click **?**. Then, select **Consult a threat expert**.
|
||||
|
||||
>
|
||||
|
||||
|
||||
>A flyout screen opens. The following screen shows when you are on a trial subscription.
|
||||
>
|
||||
A flyout screen opens. The following screen shows when you are on a trial subscription.
|
||||
|
||||
> The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription.
|
||||
>
|
||||
|
||||
|
||||
>The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request.
|
||||
The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription.
|
||||
|
||||
|
||||
|
||||
The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request.
|
||||
|
||||
3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation.
|
||||
|
||||
|
||||
@ -129,11 +129,12 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, please refer to the supported methods and versions below.
|
||||
|
||||
> [!NOTE]
|
||||
> The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Microsoft Endpoint Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs).
|
||||
> The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs).
|
||||
|
||||
Supported tools include:
|
||||
- Local script
|
||||
- Group Policy
|
||||
- Microsoft Endpoint Configuration Manager
|
||||
- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602
|
||||
- VDI onboarding scripts for non-persistent machines
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Create and manage custom detection rules in Microsoft Defender ATP
|
||||
ms.reviewer:
|
||||
description: Learn how to create and manage custom detections rules based on advanced hunting queries
|
||||
description: Learn how to create and manage custom detection rules based on advanced hunting queries
|
||||
keywords: custom detections, create, manage, alerts, edit, run on demand, frequency, interval, detection rules, advanced hunting, hunt, query, response actions, mdatp, microsoft defender atp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -19,7 +19,7 @@ ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Create and manage custom detections rules
|
||||
# Create and manage custom detection rules
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -34,7 +34,7 @@ Custom detection rules built from [Advanced hunting](advanced-hunting-overview.m
|
||||
In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using an new query, run the query to identify errors and understand possible results.
|
||||
|
||||
#### Required columns in the query results
|
||||
To use a query for a custom detection rule, the query must return the `Timestamp`, `DeviceId`, and `ReportId` columns in the results. Simple queries, such as those that don’t use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns.
|
||||
To use a query for a custom detection rule, the query must return the `Timestamp`, `DeviceId`, and `ReportId` columns in the results. Simple queries, such as those that don't use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns.
|
||||
|
||||
There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `DeviceId`, you can still return `Timestamp` and `ReportId` by getting them from the most recent event involving each machine.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Create an Application to access Microsoft Defender ATP without a user
|
||||
title: Create an app to access Microsoft Defender ATP without a user
|
||||
ms.reviewer:
|
||||
description: Learn how to design a web app to get programmatic access to Microsoft Defender ATP without a user.
|
||||
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file, advanced hunting, query
|
||||
@ -23,104 +23,88 @@ ms.topic: article
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
This page describes how to create an application to get programmatic access to Microsoft Defender ATP without a user.
|
||||
|
||||
If you need programmatic access Microsoft Defender ATP on behalf of a user, see [Get access with user context](exposed-apis-create-app-nativeapp.md)
|
||||
|
||||
If you are not sure which access you need, see [Get started](apis-intro.md).
|
||||
This page describes how to create an application to get programmatic access to Microsoft Defender ATP without a user. If you need programmatic access to Microsoft Defender ATP on behalf of a user, see [Get access with user context](exposed-apis-create-app-nativeapp.md). If you are not sure which access you need, see [Get started](apis-intro.md).
|
||||
|
||||
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will help you automate work flows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
|
||||
In general, you’ll need to take the following steps to use the APIs:
|
||||
- Create an AAD application
|
||||
- Get an access token using this application
|
||||
- Use the token to access Microsoft Defender ATP API
|
||||
- Create an Azure Active Directory (Azure AD) application.
|
||||
- Get an access token using this application.
|
||||
- Use the token to access Microsoft Defender ATP API.
|
||||
|
||||
This page explains how to create an AAD application, get an access token to Microsoft Defender ATP and validate the token.
|
||||
This article explains how to create an Azure AD application, get an access token to Microsoft Defender ATP, and validate the token.
|
||||
|
||||
## Create an app
|
||||
|
||||
1. Log on to [Azure](https://portal.azure.com) with user that has **Global Administrator** role.
|
||||
1. Log on to [Azure](https://portal.azure.com) with a user that has the **Global Administrator** role.
|
||||
|
||||
2. Navigate to **Azure Active Directory** > **App registrations** > **New registration**.
|
||||
|
||||
|
||||
|
||||
3. In the registration form, choose a name for your application and then click **Register**.
|
||||
3. In the registration form, choose a name for your application, and then select **Register**.
|
||||
|
||||
4. Allow your Application to access Microsoft Defender ATP and assign it **'Read all alerts'** permission:
|
||||
4. To enable your app to access Microsoft Defender ATP and assign it **'Read all alerts'** permission, on your application page, select **API Permissions** > **Add permission** > **APIs my organization uses** >, type **WindowsDefenderATP**, and then select **WindowsDefenderATP**.
|
||||
|
||||
- On your application page, click **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and click on **WindowsDefenderATP**.
|
||||
|
||||
- **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear.
|
||||
> [!NOTE]
|
||||
> WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear.
|
||||
|
||||
|
||||
|
||||
- Choose **Application permissions** > **Alert.Read.All** > Click on **Add permissions**
|
||||
- Select **Application permissions** > **Alert.Read.All**, and then select **Add permissions**.
|
||||
|
||||
|
||||
|
||||
**Important note**: You need to select the relevant permissions. 'Read All Alerts' is only an example!
|
||||
Note that you need to select the relevant permissions. 'Read All Alerts' is only an example. For instance:
|
||||
|
||||
For instance,
|
||||
|
||||
- To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission
|
||||
- To [isolate a machine](isolate-machine.md), select 'Isolate machine' permission
|
||||
- To [run advanced queries](run-advanced-query-api.md), select the 'Run advanced queries' permission.
|
||||
- To [isolate a machine](isolate-machine.md), select the 'Isolate machine' permission.
|
||||
- To determine which permission you need, please look at the **Permissions** section in the API you are interested to call.
|
||||
|
||||
5. Click **Grant consent**
|
||||
5. Select **Grant consent**.
|
||||
|
||||
- **Note**: Every time you add permission you must click on **Grant consent** for the new permission to take effect.
|
||||
> [!NOTE]
|
||||
> Every time you add a permission, you must select **Grant consent** for the new permission to take effect.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Add a secret to the application.
|
||||
6. To add a secret to the application, select **Certificates & secrets**, add a description to the secret, and then select **Add**.
|
||||
|
||||
- Click **Certificates & secrets**, add description to the secret and click **Add**.
|
||||
|
||||
**Important**: After click Add, **copy the generated secret value**. You won't be able to retrieve after you leave!
|
||||
> [!NOTE]
|
||||
> After you select **Add**, select **copy the generated secret value**. You won't be able to retrieve this value after you leave.
|
||||
|
||||
|
||||
|
||||
7. Write down your application ID and your tenant ID:
|
||||
|
||||
- On your application page, go to **Overview** and copy the following:
|
||||
7. Write down your application ID and your tenant ID. On your application page, go to **Overview** and copy the following.
|
||||
|
||||
|
||||
|
||||
8. **For Microsoft Defender ATP Partners only** - Set your application to be multi-tenanted (available in all tenants after consent)
|
||||
8. **For Microsoft Defender ATP Partners only**. Set your app to be multi-tenanted (available in all tenants after consent). This is **required** for third-party apps (for example, if you create an app that is intended to run in multiple customers' tenant). This is **not required** if you create a service that you want to run in your tenant only (for example, if you create an application for your own usage that will only interact with your own data). To set your app to be multi-tenanted:
|
||||
|
||||
This is **required** for 3rd party applications (for example, if you create an application that is intended to run in multiple customers tenant).
|
||||
- Go to **Authentication**, and add https://portal.azure.com as the **Redirect URI**.
|
||||
|
||||
This is **not required** if you create a service that you want to run in your tenant only (i.e. if you create an application for your own usage that will only interact with your own data)
|
||||
- On the bottom of the page, under **Supported account types**, select the **Accounts in any organizational directory** application consent for your multi-tenant app.
|
||||
|
||||
- Go to **Authentication** > Add https://portal.azure.com as **Redirect URI**.
|
||||
You need your application to be approved in each tenant where you intend to use it. This is because your application interacts Microsoft Defender ATP on behalf of your customer.
|
||||
|
||||
- On the bottom of the page, under **Supported account types**, mark **Accounts in any organizational directory**
|
||||
You (or your customer if you are writing a third-party app) need to select the consent link and approve your app. The consent should be done with a user who has administrative privileges in Active Directory.
|
||||
|
||||
- Application consent for your multi-tenant Application:
|
||||
|
||||
You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with Microsoft Defender ATP application on behalf of your customer.
|
||||
|
||||
You (or your customer if you are writing a 3rd party application) need to click the consent link and approve your application. The consent should be done with a user who has admin privileges in the active directory.
|
||||
|
||||
Consent link is of the form:
|
||||
The consent link is formed as follows:
|
||||
|
||||
```
|
||||
https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=00000000-0000-0000-0000-000000000000&response_type=code&sso_reload=true
|
||||
```
|
||||
|
||||
where 00000000-0000-0000-0000-000000000000 should be replaced with your Application ID
|
||||
Where 00000000-0000-0000-0000-000000000000 is replaced with your application ID.
|
||||
|
||||
|
||||
- **Done!** You have successfully registered an application!
|
||||
- See examples below for token acquisition and validation.
|
||||
**Done!** You have successfully registered an application! See examples below for token acquisition and validation.
|
||||
|
||||
## Get an access token examples:
|
||||
## Get an access token
|
||||
|
||||
For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)
|
||||
For more details on Azure AD tokens, see the [Azure AD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds).
|
||||
|
||||
### Using PowerShell
|
||||
### Use PowerShell
|
||||
|
||||
```
|
||||
# That code gets the App Context Token and save it to a file named "Latest-token.txt" under the current directory
|
||||
@ -144,19 +128,19 @@ Out-File -FilePath "./Latest-token.txt" -InputObject $token
|
||||
return $token
|
||||
```
|
||||
|
||||
### Using C#:
|
||||
### Use C#:
|
||||
|
||||
>The below code was tested with Nuget Microsoft.IdentityModel.Clients.ActiveDirectory 3.19.8
|
||||
The following code was tested with Nuget Microsoft.IdentityModel.Clients.ActiveDirectory 3.19.8.
|
||||
|
||||
- Create a new Console Application
|
||||
- Install Nuget [Microsoft.IdentityModel.Clients.ActiveDirectory](https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/)
|
||||
- Add the below using
|
||||
1. Create a new console application.
|
||||
1. Install Nuget [Microsoft.IdentityModel.Clients.ActiveDirectory](https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/).
|
||||
1. Add the following:
|
||||
|
||||
```
|
||||
using Microsoft.IdentityModel.Clients.ActiveDirectory;
|
||||
```
|
||||
|
||||
- Copy/Paste the below code in your application (do not forget to update the 3 variables: ```tenantId, appId, appSecret```)
|
||||
1. Copy and paste the following code in your app (don't forget to update the three variables: ```tenantId, appId, appSecret```):
|
||||
|
||||
```
|
||||
string tenantId = "00000000-0000-0000-0000-000000000000"; // Paste your own tenant ID here
|
||||
@ -173,26 +157,25 @@ return $token
|
||||
```
|
||||
|
||||
|
||||
### Using Python
|
||||
### Use Python
|
||||
|
||||
Refer to [Get token using Python](run-advanced-query-sample-python.md#get-token)
|
||||
See [Get token using Python](run-advanced-query-sample-python.md#get-token).
|
||||
|
||||
### Using Curl
|
||||
### Use Curl
|
||||
|
||||
> [!NOTE]
|
||||
> The below procedure supposed Curl for Windows is already installed on your computer
|
||||
> The following procedure assumes that Curl for Windows is already installed on your computer.
|
||||
|
||||
- Open a command window
|
||||
- Set CLIENT_ID to your Azure application ID
|
||||
- Set CLIENT_SECRET to your Azure application secret
|
||||
- Set TENANT_ID to the Azure tenant ID of the customer that wants to use your application to access Microsoft Defender ATP application
|
||||
- Run the below command:
|
||||
1. Open a command prompt, and set CLIENT_ID to your Azure application ID.
|
||||
1. Set CLIENT_SECRET to your Azure application secret.
|
||||
1. Set TENANT_ID to the Azure tenant ID of the customer that wants to use your app to access Microsoft Defender ATP.
|
||||
1. Run the following command:
|
||||
|
||||
```
|
||||
curl -i -X POST -H "Content-Type:application/x-www-form-urlencoded" -d "grant_type=client_credentials" -d "client_id=%CLIENT_ID%" -d "scope=https://securitycenter.onmicrosoft.com/windowsatpservice/.default" -d "client_secret=%CLIENT_SECRET%" "https://login.microsoftonline.com/%TENANT_ID%/oauth2/v2.0/token" -k
|
||||
```
|
||||
|
||||
You will get an answer of the form:
|
||||
You will get an answer in the following form:
|
||||
|
||||
```
|
||||
{"token_type":"Bearer","expires_in":3599,"ext_expires_in":0,"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIn <truncated> aWReH7P0s0tjTBX8wGWqJUdDA"}
|
||||
@ -200,20 +183,21 @@ You will get an answer of the form:
|
||||
|
||||
## Validate the token
|
||||
|
||||
Sanity check to make sure you got a correct token:
|
||||
- Copy/paste into [JWT](https://jwt.ms) the token you get in the previous step in order to decode it
|
||||
- Validate you get a 'roles' claim with the desired permissions
|
||||
- In the screen shot below you can see a decoded token acquired from an Application with permissions to all of Microsoft Defender ATP's roles:
|
||||
Ensure that you got the correct token:
|
||||
|
||||
1. Copy and paste the token you got in the previous step into [JWT](https://jwt.ms) in order to decode it.
|
||||
1. Validate that you get a 'roles' claim with the desired permissions
|
||||
1. In the following image, you can see a decoded token acquired from an app with permissions to all of Microsoft Defender ATP's roles:
|
||||
|
||||
|
||||
|
||||
## Use the token to access Microsoft Defender ATP API
|
||||
|
||||
- Choose the API you want to use, for more information, see [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- Set the Authorization header in the Http request you send to "Bearer {token}" (Bearer is the Authorization scheme)
|
||||
- The Expiration time of the token is 1 hour (you can send more then one request with the same token)
|
||||
1. Choose the API you want to use. For more information, see [Supported Microsoft Defender ATP APIs](exposed-apis-list.md).
|
||||
1. Set the authorization header in the http request you send to "Bearer {token}" (Bearer is the authorization scheme).
|
||||
1. The expiration time of the token is one hour. You can send more then one request with the same token.
|
||||
|
||||
- Example of sending a request to get a list of alerts **using C#**
|
||||
The following is an example of sending a request to get a list of alerts **using C#**:
|
||||
```
|
||||
var httpClient = new HttpClient();
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 93 KiB |
@ -144,6 +144,13 @@ More details about certain events are provided in the **Additional information**
|
||||
|
||||
You can also use the [Artifact timeline](investigate-alerts.md#artifact-timeline) feature to see the correlation between alerts and events on a specific machine.
|
||||
|
||||
#### Event details
|
||||
Select an event to view relevant details about that event. A panel displays to show general event information. When applicable and data is available, a graph showing related entities and their relationships are also shown.
|
||||
|
||||
To further inspect the event and related events, you can quickly run an [advanced hunting](advanced-hunting-overview.md) query by selecting **Hunt for related events**. The query will return the selected event and the list of other events that occurred around the same time on the same endpoint.
|
||||
|
||||
|
||||
|
||||
### Security recommendations
|
||||
|
||||
**Security recommendations** are generated from Microsoft Defender ATP's [Threat & Vulnerability Management](tvm-dashboard-insights.md) capability. Selecting a recommendation will show a panel where you can view relevant details such as description of the recommendation and the potential risks associated with not enacting it. See [Security recommendation](tvm-security-recommendation.md) for details.
|
||||
|
||||
@ -45,7 +45,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
||||
3. Set the deployment method to **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
>[!NOTE]
|
||||
>JamF falls under **Mobile Device Management**.
|
||||
>Jamf falls under **Mobile Device Management**.
|
||||
|
||||
4. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory.
|
||||
5. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory.
|
||||
|
||||
@ -100,27 +100,4 @@ Important tasks, such as controlling product settings and triggering on-demand s
|
||||
|
||||
## Microsoft Defender ATP portal information
|
||||
|
||||
In the Microsoft Defender ATP portal, you'll see two categories of information.
|
||||
|
||||
Antivirus alerts, including:
|
||||
|
||||
- Severity
|
||||
- Scan type
|
||||
- Device information (hostname, machine identifier, tenant identifier, app version, and OS type)
|
||||
- File information (name, path, size, and hash)
|
||||
- Threat information (name, type, and state)
|
||||
|
||||
Device information, including:
|
||||
|
||||
- Machine identifier
|
||||
- Tenant identifier
|
||||
- App version
|
||||
- Hostname
|
||||
- OS type
|
||||
- OS version
|
||||
- Computer model
|
||||
- Processor architecture
|
||||
- Whether the device is a virtual machine
|
||||
|
||||
> [!NOTE]
|
||||
> Certain device information might be subject to upcoming releases. To send us feedback, use the Microsoft Defender ATP for Mac app and select **Help** > **Send feedback** on your device. Optionally, use the **Feedback** button in the Microsoft Defender Security Center.
|
||||
[This blog](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/edr-capabilities-for-macos-have-now-arrived/ba-p/1047801) provides detailed guidance on what to expect in Microsoft Defender ATP Security Center.
|
||||
@ -19,6 +19,22 @@ ms.topic: conceptual
|
||||
|
||||
# What's new in Microsoft Defender Advanced Threat Protection for Mac
|
||||
|
||||
> [!NOTE]
|
||||
> In alignment with macOS evolution, we are preparing a Microsoft Defender ATP for Mac update that leverages system extensions instead of kernel extensions.
|
||||
>
|
||||
> In the meantime, starting with macOS Catalina update 10.15.4, Apple introduced a user facing *Legacy System Extension* warning to signal applications that rely on kernel extensions.
|
||||
>
|
||||
> If you have previously whitelisted the kernel extension as part of your remote deployment, that warning should not be presented to the end user. If you have not previously deployed a policy to whitelist the kernel extension, your users will be presented with the warning. To proactively silence the warning, you can still deploy a configuration to whitelist the kernel extension. Refer to the instructions in the [JAMF-based deployment](mac-install-with-jamf.md#approved-kernel-extension) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics.
|
||||
|
||||
## 100.86.91
|
||||
|
||||
> [!CAUTION]
|
||||
> To ensure the most complete protection for your macOS devices and in alignment with Apple stopping delivery of macOS native security updates to OS versions older than [current – 2], MDATP for Mac deployment and updates will no longer be supported on macOS Sierra [10.12]. MDATP for Mac updates and enhancements will be delivered to devices running versions Catalina [10.15], Mojave [10.14], and High Sierra [10.13].
|
||||
>
|
||||
> If you already have MDATP for Mac deployed to your Sierra [10.12] devices, please upgrade to the latest macOS version to eliminate risks of losing protection.
|
||||
|
||||
- Performance improvements & bug fixes
|
||||
|
||||
## 100.83.73
|
||||
|
||||
- Added more controls for IT administrators around [management of exclusions](mac-preferences.md#exclusion-merge-policy), [management of threat type settings](mac-preferences.md#threat-type-settings-merge-policy), and [disallowed threat actions](mac-preferences.md#disallowed-threat-actions)
|
||||
@ -37,9 +53,9 @@ ms.topic: conceptual
|
||||
|
||||
- Fixed an issue where Microsoft Defender ATP for Mac was sometimes interfering with Time Machine
|
||||
- Added a new switch to the command-line utility for testing the connectivity with the backend service
|
||||
```bash
|
||||
$ mdatp --connectivity-test
|
||||
```
|
||||
```bash
|
||||
$ mdatp --connectivity-test
|
||||
```
|
||||
- Added ability to view the full threat history in the user interface (can be accessed from the **Protection history** view)
|
||||
- Performance improvements & bug fixes
|
||||
|
||||
@ -60,12 +76,12 @@ $ mdatp --connectivity-test
|
||||
|
||||
- Added support for macOS Catalina
|
||||
|
||||
> [!CAUTION]
|
||||
> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device.
|
||||
>
|
||||
> The mechanism for granting this consent depends on how you deployed Microsoft Defender ATP:
|
||||
>
|
||||
> - For manual deployments, see the updated instructions in the [Manual deployment](mac-install-manually.md#how-to-allow-full-disk-access) topic.
|
||||
> - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics.
|
||||
> [!CAUTION]
|
||||
> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device.
|
||||
>
|
||||
> The mechanism for granting this consent depends on how you deployed Microsoft Defender ATP:
|
||||
>
|
||||
> - For manual deployments, see the updated instructions in the [Manual deployment](mac-install-manually.md#how-to-allow-full-disk-access) topic.
|
||||
> - For managed deployments, see the updated instructions in the [JAMF-based deployment](mac-install-with-jamf.md#privacy-preferences-policy-control) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics.
|
||||
|
||||
- Performance improvements & bug fixes
|
||||
|
||||
@ -22,11 +22,16 @@ ms.topic: conceptual
|
||||
|
||||
This topic describes how to install, configure, update, and use Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4q3yP]
|
||||
|
||||
<p></p>
|
||||
|
||||
> [!CAUTION]
|
||||
> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to cause performance problems and unpredictable system errors.
|
||||
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4q3yP]
|
||||
|
||||
|
||||
|
||||
## How to install Microsoft Defender ATP for Linux
|
||||
|
||||
@ -57,7 +62,7 @@ In general you need to take the following steps:
|
||||
- [Manual deployment](linux-install-manually.md)
|
||||
- Third-party management tools:
|
||||
- [Deploy using Puppet configuration management tool](linux-install-with-puppet.md)
|
||||
- [Deploy using Ansbile configuration management tool](linux-install-with-ansible.md)
|
||||
- [Deploy using Ansible configuration management tool](linux-install-with-ansible.md)
|
||||
|
||||
### System requirements
|
||||
|
||||
@ -87,6 +92,9 @@ The following table lists the services and their associated URLs that your netwo
|
||||
| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com <br/> uk-v20.events.data.microsoft.com |
|
||||
| United States | unitedstates.x.cp.wd.microsoft.com <br/> us-v20.events.data.microsoft.com |
|
||||
|
||||
> [!NOTE]
|
||||
> For a more specific URL list, see [Configure proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server)
|
||||
|
||||
Microsoft Defender ATP can discover a proxy server by using the following discovery methods:
|
||||
- Transparent proxy
|
||||
- Manual static proxy configuration
|
||||
|
||||
@ -114,6 +114,10 @@ Microsoft regularly publishes software updates to improve performance, security,
|
||||
|
||||
Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](mac-preferences.md).
|
||||
|
||||
## macOS kernel and system extensions
|
||||
|
||||
In alignment with macOS evolution, we are preparing a Microsoft Defender ATP for Mac update that leverages system extensions instead of kernel extensions. Visit [What's new in Microsoft Defender Advanced Threat Protection for Mac](mac-whatsnew.md) for relevant details.
|
||||
|
||||
## Resources
|
||||
|
||||
- For more information about logging, uninstalling, or other topics, see the [Resources](mac-resources.md) page.
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Microsoft Threat Experts is a managed detection and response (MDR) service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed.
|
||||
Microsoft Threat Experts is a managed threat hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed.
|
||||
|
||||
This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand.
|
||||
|
||||
|
||||
@ -58,7 +58,7 @@ The following is in scope for this project:
|
||||
capabilities including automatic investigation and remediation
|
||||
|
||||
- Enabling Microsoft Defender ATP threat and vulnerability management (TVM)
|
||||
- Use of System Center Configuration Manager to onboard endpoints into the service.
|
||||
- Use of Microsoft Endpoint Configuration Manager to onboard endpoints into the service.
|
||||
|
||||
### Out of scope
|
||||
|
||||
|
||||
@ -25,13 +25,13 @@ ms.topic: article
|
||||
Proper planning is the foundation of a successful deployment. In this deployment scenario, you'll be guided through the steps on:
|
||||
- Tenant configuration
|
||||
- Network configuration
|
||||
- Onboarding using System Center Configuration Manager
|
||||
- Onboarding using Microsoft Endpoint Configuration Manager
|
||||
- Endpoint detection and response
|
||||
- Next generation protection
|
||||
- Attack surface reduction
|
||||
|
||||
>[!NOTE]
|
||||
>For the purpose of guiding you through a typical deployment, this scenario will only cover the use of System Center Configuration Manager. Microsoft Defnder ATP supports the use of other onboarding tools but will not cover those scenarios in the deployment guide. For more information, see [Onboard machines to Microsoft Defender ATP](onboard-configure.md).
|
||||
>For the purpose of guiding you through a typical deployment, this scenario will only cover the use of Microsoft Endpoint Configuration Manager. Microsoft Defender ATP supports the use of other onboarding tools but will not cover those scenarios in the deployment guide. For more information, see [Onboard machines to Microsoft Defender ATP](onboard-configure.md).
|
||||
|
||||
## Tenant Configuration
|
||||
|
||||
@ -111,7 +111,7 @@ under:
|
||||
Preview Builds \> Configure Authenticated Proxy usage for the Connected User
|
||||
Experience and Telemetry Service
|
||||
|
||||
- Set it to **Enabled** and select<63>**Disable Authenticated Proxy usage**
|
||||
- Set it to **Enabled** and select<63>**Disable Authenticated Proxy usage**
|
||||
|
||||
1. Open the Group Policy Management Console.
|
||||
2. Create a policy or edit an existing policy based off the organizational practices.
|
||||
@ -205,9 +205,9 @@ You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https:
|
||||
> [!NOTE]
|
||||
> As a cloud-based solution, the IP range can change. It's recommended you move to DNS resolving setting.
|
||||
|
||||
## Onboarding using System Center Configuration Manager
|
||||
## Onboarding using Microsoft Endpoint Configuration Manager
|
||||
### Collection creation
|
||||
To onboard Windows 10 devices with System Center Configuration Manager, the
|
||||
To onboard Windows 10 devices with Microsoft Endpoint Configuration Manager, the
|
||||
deployment can target either and existing collection or a new collection can be
|
||||
created for testing. The onboarding like group policy or manual method does
|
||||
not install any agent on the system. Within the Configuration Manager console
|
||||
@ -217,55 +217,54 @@ maintain that configuration for as long as the Configuration Manager client
|
||||
continues to receive this policy from the management point. Follow the steps
|
||||
below to onboard systems with Configuration Manager.
|
||||
|
||||
1. In System Center Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Device Collections**.
|
||||
1. In the Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Device Collections**.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Right Click **Device Collection** and select **Create Device Collection**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. Provide a **Name** and **Limiting Collection**, then select **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Select **Add Rule** and choose **Query Rule**.
|
||||
|
||||
|
||||
|
||||
|
||||
5. Click **Next** on the **Direct Membership Wizard** and click on **Edit Query Statement**.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Select **Criteria** and then choose the star icon.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Keep criterion type as **simple value**, choose where as **Operating System - build number**, operator as **is equal to** and value **10240** and click on **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
8. Select **Next** and **Close**.
|
||||
|
||||
|
||||
|
||||
|
||||
9. Select **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
After completing this task, you now have a device collection with all the Windows 10 endpoints in the environment.
|
||||
|
||||
## Endpoint detection and response
|
||||
### Windows 10
|
||||
From within the Microsoft Defender Security Center it is possible to download
|
||||
the '.onboarding' policy that can be used to create the policy in System Center Configuration
|
||||
Manager and deploy that policy to Windows 10 devices.
|
||||
the '.onboarding' policy that can be used to create the policy in Microsoft Endpoint Configuration Manager and deploy that policy to Windows 10 devices.
|
||||
|
||||
1. From a Microsoft Defender Security Center Portal, select [Settings and then Onboarding](https://securitycenter.windows.com/preferences2/onboarding).
|
||||
|
||||
|
||||
|
||||
2. Under Deployment method select the supported version of **System Center Configuration Manager**.
|
||||
2. Under Deployment method select the supported version of **Configuration Manager**.
|
||||
|
||||
|
||||
|
||||
@ -274,15 +273,15 @@ Manager and deploy that policy to Windows 10 devices.
|
||||
|
||||
|
||||
4. Save the package to an accessible location.
|
||||
5. In System Center Configuration Manager, navigate to: **Assets and Compliance > Overview > Endpoint Protection > Microsoft Defender ATP Policies**.
|
||||
5. In Configuration Manager, navigate to: **Assets and Compliance > Overview > Endpoint Protection > Microsoft Defender ATP Policies**.
|
||||
|
||||
6. Right-click **Microsoft Defender ATP Policies** and select **Create Microsoft Defender ATP Policy**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Enter the name and description, verify **Onboarding** is selected, then select **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
8. Click **Browse**.
|
||||
|
||||
@ -305,7 +304,7 @@ Manager and deploy that policy to Windows 10 devices.
|
||||
|
||||
15. Click **Close** when the Wizard completes.
|
||||
|
||||
16. In the System Center Configuration Manager console, right-click the Microsoft Defender ATP policy you just created and select **Deploy**.
|
||||
16. In the Configuration Manager console, right-click the Microsoft Defender ATP policy you just created and select **Deploy**.
|
||||
|
||||
|
||||
|
||||
@ -371,14 +370,14 @@ Specifically, for Windows 7 SP1, the following patches must be installed:
|
||||
[KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework).
|
||||
Do not install both on the same system.
|
||||
|
||||
To deploy the MMA with System Center Configuration Manager, follow the steps
|
||||
To deploy the MMA with Microsoft Endpoint Configuration Manager, follow the steps
|
||||
below to utilize the provided batch files to onboard the systems. The CMD file
|
||||
when executed, will require the system to copy files from a network share by the
|
||||
System, the System will install MMA, Install the DependencyAgent, and configure
|
||||
MMA for enrollment into the workspace.
|
||||
|
||||
|
||||
1. In System Center Configuration Manager console, navigate to **Software
|
||||
1. In the Configuration Manager console, navigate to **Software
|
||||
Library**.
|
||||
|
||||
2. Expand **Application Management**.
|
||||
@ -387,15 +386,15 @@ MMA for enrollment into the workspace.
|
||||
|
||||
4. Provide a Name for the package, then click **Next**
|
||||
|
||||
|
||||
|
||||
|
||||
5. Verify **Standard Program** is selected.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Enter a program name.
|
||||
|
||||
@ -411,17 +410,17 @@ MMA for enrollment into the workspace.
|
||||
|
||||
13. Click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
14. Verify the configuration, then click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
15. Click **Next**.
|
||||
|
||||
16. Click **Close**.
|
||||
|
||||
17. In the System Center Configuration Manager console, right-click the Microsoft Defender ATP
|
||||
17. In the Configuration Manager console, right-click the Microsoft Defender ATP
|
||||
Onboarding Package just created and select **Deploy**.
|
||||
|
||||
18. On the right panel select the appropriate collection.
|
||||
@ -431,7 +430,7 @@ MMA for enrollment into the workspace.
|
||||
## Next generation protection
|
||||
Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers.
|
||||
|
||||
1. In the System Center Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Antimalware Polices** and choose **Create Antimalware Policy**.
|
||||
1. In the Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Antimalware Polices** and choose **Create Antimalware Policy**.
|
||||
|
||||
|
||||
|
||||
@ -481,9 +480,9 @@ Protection. All these features provide an audit mode and a block mode. In audit
|
||||
|
||||
To set ASR rules in Audit mode:
|
||||
|
||||
1. In the System Center Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
|
||||
1. In the Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2. Select **Attack Surface Reduction**.
|
||||
@ -491,26 +490,26 @@ To set ASR rules in Audit mode:
|
||||
|
||||
3. Set rules to **Audit** and click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Confirm the new Exploit Guard policy by clicking on **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
5. Once the policy is created click **Close**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
6. Right-click on the newly created policy and choose **Deploy**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Target the policy to the newly created Windows 10 collection and click **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
After completing this task, you now have successfully configured ASR rules in audit mode.
|
||||
|
||||
@ -541,15 +540,15 @@ detections](https://docs.microsoft.com/windows/security/threat-protection/micros
|
||||
|
||||
|
||||
### To set Network Protection rules in Audit mode:
|
||||
1. In the System Center Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
|
||||
1. In the Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Select **Network protection**.
|
||||
|
||||
3. Set the setting to **Audit** and click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Confirm the new Exploit Guard Policy by clicking **Next**.
|
||||
|
||||
@ -561,42 +560,42 @@ detections](https://docs.microsoft.com/windows/security/threat-protection/micros
|
||||
|
||||
6. Right-click on the newly created policy and choose **Deploy**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Select the policy to the newly created Windows 10 collection and choose **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
After completing this task, you now have successfully configured Network
|
||||
Protection in audit mode.
|
||||
|
||||
### To set Controlled Folder Access rules in Audit mode:
|
||||
|
||||
1. In the System Center Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
|
||||
1. In the Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Select **Controlled folder access**.
|
||||
|
||||
3. Set the configuration to **Audit** and click **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Confirm the new Exploit Guard Policy by clicking on **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
5. Once the policy is created click on **Close**.
|
||||
|
||||
|
||||
|
||||
|
||||
6. Right-click on the newly created policy and choose **Deploy**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Target the policy to the newly created Windows 10 collection and click **OK**.
|
||||
|
||||
|
||||
|
||||
|
||||
After completing this task, you now have successfully configured Controlled folder access in audit mode.
|
||||
|
||||
|
||||
@ -8,8 +8,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
@ -18,15 +18,19 @@ ms.topic: article
|
||||
---
|
||||
|
||||
# Threat & Vulnerability Management scenarios
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## Before you begin
|
||||
|
||||
Ensure that your machines:
|
||||
|
||||
- Are onboarded to Microsoft Defender Advanced Threat Protection
|
||||
- Run with Windows 10 1709 (Fall Creators Update) or later
|
||||
|
||||
@ -47,15 +51,18 @@ Ensure that your machines:
|
||||
- Are tagged or marked as co-managed
|
||||
|
||||
## Reduce your threat and vulnerability exposure
|
||||
|
||||
Threat & Vulnerability Management introduces a new exposure score metric, which visually represents how exposed your machines are to imminent threats.
|
||||
|
||||
The exposure score is continuously calculated on each device in the organization and influenced by the following factors:
|
||||
|
||||
- Weaknesses, such as vulnerabilities discovered on the device
|
||||
- External and internal threats such as public exploit code and security alerts
|
||||
- Likelihood of the device to get breached given its current security posture
|
||||
- Value of the device to the organization given its role and content
|
||||
|
||||
The exposure score is broken down into the following levels:
|
||||
|
||||
- 0–29: low exposure score
|
||||
- 30–69: medium exposure score
|
||||
- 70–100: high exposure score
|
||||
@ -65,15 +72,19 @@ You can remediate the issues based on prioritized security recommendations to re
|
||||
To lower down your threat and vulnerability exposure:
|
||||
|
||||
1. Review the **Top security recommendations** from your **Threat & Vulnerability Management dashboard**, and select the first item on the list. The **Security recommendation** page opens.
|
||||
|
||||
>>
|
||||
|
||||
>[!NOTE]
|
||||
> There are two types of recommendations:
|
||||
> - <i>Security update</i> which refers to recommendations that require a package installation
|
||||
> - <i>Configuration</i> change which refers to recommendations that require a registry or GPO modification
|
||||
> Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight  icon and possible active alert  icon.
|
||||
|
||||
There are two types of recommendations:
|
||||
|
||||
- *Security update* which refers to recommendations that require a package installation
|
||||
- *Configuration change* which refers to recommendations that require a registry or GPO modification
|
||||
|
||||
Always prioritize recommendations that are associated with ongoing threats:
|
||||
|
||||
-  Threat insight icon
|
||||
-  Active alert icon
|
||||
|
||||
>
|
||||
|
||||
2. The **Security recommendations** page shows the list of items to remediate. Select the security recommendation that you need to investigate. When you select a recommendation from the list, a fly-out panel will display a description of what you need to remediate, number of vulnerabilities, associated exploits in machines, number of exposed machines and their machine names, business impact, and a list of CVEs. Click **Open software page** option from the flyout panel. 
|
||||
|
||||
3. Click **Installed machines** and select the affected machine from the list to open the flyout panel with the relevant machine details, exposure and risk levels, alert and incident activities. 
|
||||
@ -81,13 +92,13 @@ To lower down your threat and vulnerability exposure:
|
||||
4. Click **Open machine page** to connect to the machine and apply the selected recommendation. See [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) for details. 
|
||||
|
||||
5. Allow a few hours for the changes to propagate in the system.
|
||||
|
||||
|
||||
6. Review the machine **Security recommendation** tab again. The recommendation you've chosen to remediate is removed from the security recommendation list, and the exposure score decreases.
|
||||
|
||||
## Improve your security configuration
|
||||
|
||||
>[!NOTE]
|
||||
> Secure score is now part of Threat & Vulnerability Management as [configuration score](configuration-score.md).
|
||||
> Secure score is now part of Threat & Vulnerability Management as [Configuration score](configuration-score.md).
|
||||
|
||||
You can improve your security configuration when you remediate issues from the security recommendations list. As you do so, your configuration score improves, which means your organization becomes more resilient against cybersecurity threats and vulnerabilities.
|
||||
|
||||
@ -95,14 +106,15 @@ You can improve your security configuration when you remediate issues from the s
|
||||
|
||||
>
|
||||
|
||||
2. Select the first item on the list. The flyout panel will open with a description of the security controls issue, a short description of the potential risk, insights, configuration ID, exposed machines, and business impact. Click **Remediation options**.
|
||||
2. Select the first item on the list. The flyout panel will open with a description of the security controls issue, a short description of the potential risk, insights, configuration ID, exposed machines, and business impact. Click **Remediation options**.
|
||||
|
||||
|
||||
|
||||
3. Read the description to understand the context of the issue and what to do next. Select a due date, add notes, and select **Export all remediation activity data to CSV** so you can attach it to the email that you can send to your IT Administrator for follow-up.
|
||||
|
||||
>.
|
||||
>.
|
||||
|
||||
>You will see a confirmation message that the remediation task has been created.
|
||||
You will see a confirmation message that the remediation task has been created.
|
||||
>
|
||||
|
||||
4. Save your CSV file.
|
||||
@ -113,6 +125,7 @@ You can improve your security configuration when you remediate issues from the s
|
||||
6. Review the machine **Configuration score** widget again. The number of the security controls issues will decrease. When you click **Security controls** to go back to the **Security recommendations** page, the item that you have addressed will not be listed there anymore, and your configuration score should increase.
|
||||
|
||||
## Request a remediation
|
||||
|
||||
>[!NOTE]
|
||||
>To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on.
|
||||
|
||||
@ -134,6 +147,7 @@ See [Use Intune to remediate vulnerabilities identified by Microsoft Defender AT
|
||||
>If your request involves remediating more than 10,000 machines, we can only send 10,000 machines for remediation to Intune.
|
||||
|
||||
## File for exception
|
||||
|
||||
With Threat & Vulnerability Management, you can create exceptions for recommendations, as an alternative to a remediation request.
|
||||
|
||||
There are many reasons why organizations create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides as much protection than the recommendation would, a false positive, among other reasons.
|
||||
@ -142,7 +156,6 @@ Exceptions can be created for both *Security update* and *Configuration change*
|
||||
|
||||
When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list.
|
||||
|
||||
|
||||
1. Navigate to the **Security recommendations** page under the **Threat & Vulnerability Management** section menu.
|
||||
|
||||
2. Click the top-most recommendation. A flyout panel opens with the recommendation details.
|
||||
@ -157,10 +170,10 @@ When an exception is created for a recommendation, the recommendation is no long
|
||||
5. Click **Submit**. A confirmation message at the top of the page indicates that the exception has been created.
|
||||
|
||||
|
||||
6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past).
|
||||
|
||||
6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past).
|
||||
|
||||
|
||||
## Use advanced hunting query to search for machines with High active alerts or critical CVE public exploit
|
||||
## Use advanced hunting query to search for machines with High active alerts or critical CVE public exploit
|
||||
|
||||
1. Go to **Advanced hunting** from the left-hand navigation pane.
|
||||
|
||||
@ -169,38 +182,41 @@ When an exception is created for a recommendation, the recommendation is no long
|
||||
3. Enter the following queries:
|
||||
|
||||
```kusto
|
||||
// Search for machines with High active alerts or Critical CVE public exploit
|
||||
DeviceTvmSoftwareInventoryVulnerabilities
|
||||
| join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId
|
||||
// Search for machines with High active alerts or Critical CVE public exploit
|
||||
DeviceTvmSoftwareInventoryVulnerabilities
|
||||
| join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId
|
||||
| where IsExploitAvailable == 1 and CvssScore >= 7
|
||||
| summarize NumOfVulnerabilities=dcount(CveId),
|
||||
DeviceName=any(DeviceName) by DeviceId
|
||||
| summarize NumOfVulnerabilities=dcount(CveId),
|
||||
DeviceName=any(DeviceName) by DeviceId
|
||||
| join kind =inner(DeviceAlertEvents) on DeviceId
|
||||
| summarize NumOfVulnerabilities=any(NumOfVulnerabilities),
|
||||
DeviceName=any(DeviceName) by DeviceId, AlertId
|
||||
| summarize NumOfVulnerabilities=any(NumOfVulnerabilities),
|
||||
DeviceName=any(DeviceName) by DeviceId, AlertId
|
||||
| project DeviceName, NumOfVulnerabilities, AlertId
|
||||
| order by NumOfVulnerabilities desc
|
||||
| order by NumOfVulnerabilities desc
|
||||
|
||||
```
|
||||
|
||||
## Conduct an inventory of software or software versions which have reached their end-of-life
|
||||
End-of-life for software or software versions means that they will no longer be supported nor serviced. When you use software or software versions which have reached their end-of-life, you're exposing your organization to security vulnerabilities, legal, and financial risks.
|
||||
## Conduct an inventory of software or software versions which have reached end-of-support (EOS)
|
||||
|
||||
It is crucial for you as Security and IT Administrators to work together and ensure that your organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem.
|
||||
End-of-support (otherwise known as end-of-life) for software or software versions means that they will no longer be supported or serviced. When you use software or software versions which have reached end-of-support, you're exposing your organization to security vulnerabilities, legal, and financial risks.
|
||||
|
||||
It is crucial for Security and IT Administrators to work together and ensure that the organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem.
|
||||
|
||||
To conduct an inventory of software or software versions which have reached end-of-support:
|
||||
|
||||
To conduct an inventory of software or software versions which have reached their end of life:
|
||||
1. From the Threat & Vulnerability Management menu, navigate to **Security recommendations**.
|
||||
2. Go to the **Filters** panel and select **Software uninstall** from **Remediation Type** options if you want to see the list of software recommendations associated with software which have reached their end-of-life (tagged as **EOL software**). Select **Software update** from **Remediation Type** options if you want to see the list of software recommendations associated with software and software versions which have reached their end-of-life (tagged as **EOL versions installed**).
|
||||
3. Select a software that you'd like to investigate. A fly-out screen opens where you can select **Open software page**.
|
||||
|
||||
2. Go to the **Filters** panel and select **Software uninstall** from **Remediation Type** options to see the list of software recommendations associated with software which have reached end of support (tagged as **EOS software**).
|
||||
3. Select **Software update** from **Remediation Type** options to see the list of software recommendations associated with software and software versions which have reached end-of-support (tagged as **EOS versions installed**).
|
||||
4. Select software that you'd like to investigate. A fly-out screen opens where you can select **Open software page**.
|
||||
|
||||
|
||||
4. In the **Software page** select the **Version distribution** tab to know which versions of the software have reached their end-of-life, and how many vulnerabilities were discovered in it.
|
||||
|
||||
|
||||
After you have identified which software and software versions are vulnerable due to its end-of-life status, remediate them to lower your organizations exposure to vulnerabilities and advanced persistent threats. See [Remediation and exception](tvm-remediation.md) for details.
|
||||
5. In the **Software page** select the **Version distribution** tab to know which versions of the software have reached their end-of-support, and how many vulnerabilities were discovered in it.
|
||||
|
||||
|
||||
After you have identified which software and software versions are vulnerable due to its end-of-support status, remediate them to lower your organizations exposure to vulnerabilities and advanced persistent threats. See [Remediation and exception](tvm-remediation.md) for details.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
|
||||
@ -81,7 +81,10 @@ Learn more at https://www.cyren.com/products/url-filtering.
|
||||
|
||||
### Signing up for a Cyren License
|
||||
|
||||
Cyren is offering a 60-day free trial for all Microsoft Defender ATP customers. To sign up, please follow the steps below from the portal.
|
||||
Cyren is offering a 60-day free trial for all Microsoft Defender ATP customers. To sign up, please follow the steps below from the portal.
|
||||
|
||||
>[!NOTE]
|
||||
>Make sure to add the URL you get redirected to by the signup process to the list of approved domains.
|
||||
|
||||
>[!NOTE]
|
||||
>A user with AAD app admin/global admin permissions is required to complete these steps.
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Configure Windows Defender Antivirus exclusions on Windows Server 2016
|
||||
title: Configure Windows Defender Antivirus exclusions on Windows Server 2016 or 2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
description: Windows Server 2016 includes automatic exclusions, based on server role. You can also add custom exclusions.
|
||||
description: Windows Servers 2016 and 2019 include automatic exclusions, based on server role. You can also add custom exclusions.
|
||||
keywords: exclusions, server, auto-exclusions, automatic, custom, scans, Windows Defender Antivirus
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -22,48 +22,47 @@ ms.custom: nextgen
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Windows Defender Antivirus on Windows Server 2016 computers automatically enrolls you in certain exclusions, as defined by your specified server role. See [the end of this topic](#list-of-automatic-exclusions) for a list of these exclusions.
|
||||
Windows Defender Antivirus on Windows Server 2016 and 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. See the [list of automatic exclusions](#list-of-automatic-exclusions) (in this article). These exclusions do not appear in the standard exclusion lists that are shown in the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
|
||||
|
||||
These exclusions will not appear in the standard exclusion lists shown in the [Windows Security app](windows-defender-security-center-antivirus.md#exclusions).
|
||||
|
||||
You can still add or remove custom exclusions (in addition to the server role-defined automatic exclusions) as described in these exclusion-related topics:
|
||||
> [!NOTE]
|
||||
> Automatic exclusions only apply to Real-time protection (RTP) scanning. Automatic exclusions are not honored during a Full/Quick or On-demand scan.
|
||||
|
||||
In addition to server role-defined automatic exclusions, you can add or remove custom exclusions. To do that, refer to these articles:
|
||||
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
|
||||
|
||||
Custom exclusions take precedence over automatic exclusions.
|
||||
## A few points to keep in mind
|
||||
|
||||
> [!TIP]
|
||||
> Custom and duplicate exclusions do not conflict with automatic exclusions.
|
||||
- Custom exclusions take precedence over automatic exclusions.
|
||||
|
||||
Windows Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer.
|
||||
- Automatic exclusions only apply to Real-time protection (RTP) scanning. Automatic exclusions are not honored during a Full/Quick or On-demand scan.
|
||||
|
||||
- Custom and duplicate exclusions do not conflict with automatic exclusions.
|
||||
|
||||
- Windows Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer.
|
||||
|
||||
## Opt out of automatic exclusions
|
||||
|
||||
In Windows Server 2016, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, you need to opt out of the automatic exclusions delivered in Security intelligence updates.
|
||||
In Windows Server 2016 and 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles.
|
||||
|
||||
> [!WARNING]
|
||||
> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 roles.
|
||||
> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles.
|
||||
|
||||
> [!NOTE]
|
||||
> This setting is only supported on Windows Server 2016. While this setting exists in Windows 10, it doesn't have an effect on exclusions.
|
||||
|
||||
> [!TIP]
|
||||
> Since the predefined exclusions only exclude **default paths**, if you move NTDS and SYSVOL to another drive or path *different than the original one*, you would have to manually add the exclusions using the information [here](configure-extension-file-exclusions-windows-defender-antivirus.md#configure-the-list-of-exclusions-based-on-folder-name-or-file-extension) .
|
||||
Because predefined exclusions only exclude **default paths**, if you move NTDS and SYSVOL to another drive or path that is *different from the original path*, you must add exclusions manually using the information [here](configure-extension-file-exclusions-windows-defender-antivirus.md#configure-the-list-of-exclusions-based-on-folder-name-or-file-extension) .
|
||||
|
||||
You can disable the automatic exclusion lists with Group Policy, PowerShell cmdlets, and WMI.
|
||||
|
||||
### Use Group Policy to disable the auto-exclusions list on Windows Server 2016
|
||||
### Use Group Policy to disable the auto-exclusions list on Windows Server 2016 and 2019
|
||||
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx). Right-click the Group Policy Object you want to configure, and then click **Edit**.
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration**, and then click **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
|
||||
3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Exclusions**.
|
||||
|
||||
4. Double-click **Turn off Auto Exclusions** and set the option to **Enabled**. Click **OK**.
|
||||
4. Double-click **Turn off Auto Exclusions**, and set the option to **Enabled**. Then click **OK**.
|
||||
|
||||
**Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:**
|
||||
### Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016 and 2019
|
||||
|
||||
Use the following cmdlets:
|
||||
|
||||
@ -71,11 +70,13 @@ Use the following cmdlets:
|
||||
Set-MpPreference -DisableAutoExclusions $true
|
||||
```
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
|
||||
[Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md).
|
||||
|
||||
### Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016
|
||||
[Use PowerShell with Windows Defender Antivirus](https://technet.microsoft.com/itpro/powershell/windows/defender/index).
|
||||
|
||||
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
|
||||
### Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016 and 2019
|
||||
|
||||
Use the **Set** method of the [MSFT_MpPreference](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
|
||||
|
||||
```WMI
|
||||
DisableAutoExclusions
|
||||
@ -85,212 +86,221 @@ See the following for more information and allowed parameters:
|
||||
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
|
||||
|
||||
## List of automatic exclusions
|
||||
|
||||
The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types.
|
||||
|
||||
### Default exclusions for all roles
|
||||
This section lists the default exclusions for all Windows Server 2016 roles.
|
||||
|
||||
- Windows "temp.edb" files:
|
||||
This section lists the default exclusions for all Windows Server 2016 and 2019 roles.
|
||||
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb
|
||||
#### Windows "temp.edb" files
|
||||
|
||||
- *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb
|
||||
|
||||
- Windows Update files or Automatic Update files:
|
||||
- *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log
|
||||
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb
|
||||
#### Windows Update files or Automatic Update files
|
||||
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb
|
||||
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk
|
||||
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log
|
||||
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs
|
||||
|
||||
- Windows Security files:
|
||||
- *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log
|
||||
|
||||
- *%windir%*\Security\database\\*.chk
|
||||
#### Windows Security files
|
||||
|
||||
- *%windir%*\Security\database\\*.edb
|
||||
- *%windir%*\Security\database\\*.chk
|
||||
|
||||
- *%windir%*\Security\database\\*.jrs
|
||||
- *%windir%*\Security\database\\*.edb
|
||||
|
||||
- *%windir%*\Security\database\\*.log
|
||||
- *%windir%*\Security\database\\*.jrs
|
||||
|
||||
- *%windir%*\Security\database\\*.sdb
|
||||
- *%windir%*\Security\database\\*.log
|
||||
|
||||
- Group Policy files:
|
||||
- *%windir%*\Security\database\\*.sdb
|
||||
|
||||
- *%allusersprofile%*\NTUser.pol
|
||||
#### Group Policy files
|
||||
|
||||
- *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol
|
||||
- *%allusersprofile%*\NTUser.pol
|
||||
|
||||
- *%SystemRoot%*\System32\GroupPolicy\User\registry.pol
|
||||
- *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol
|
||||
|
||||
- WINS files:
|
||||
- *%SystemRoot%*\System32\GroupPolicy\User\registry.pol
|
||||
|
||||
- *%systemroot%*\System32\Wins\\*\\\*.chk
|
||||
#### WINS files
|
||||
|
||||
- *%systemroot%*\System32\Wins\\*\\\*.log
|
||||
- *%systemroot%*\System32\Wins\\*\\\*.chk
|
||||
|
||||
- *%systemroot%*\System32\Wins\\*\\\*.mdb
|
||||
- *%systemroot%*\System32\Wins\\*\\\*.log
|
||||
|
||||
- *%systemroot%*\System32\LogFiles\
|
||||
- *%systemroot%*\System32\Wins\\*\\\*.mdb
|
||||
|
||||
- *%systemroot%*\SysWow64\LogFiles\
|
||||
- *%systemroot%*\System32\LogFiles\
|
||||
|
||||
- File Replication Service (FRS) exclusions:
|
||||
- *%systemroot%*\SysWow64\LogFiles\
|
||||
|
||||
- Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory`
|
||||
#### File Replication Service (FRS) exclusions
|
||||
|
||||
- *%windir%*\Ntfrs\jet\sys\\*\edb.chk
|
||||
- Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory`
|
||||
|
||||
- *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb
|
||||
- *%windir%*\Ntfrs\jet\sys\\*\edb.chk
|
||||
|
||||
- *%windir%*\Ntfrs\jet\log\\*\\\*.log
|
||||
- *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb
|
||||
|
||||
- FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory`
|
||||
- *%windir%*\Ntfrs\jet\log\\*\\\*.log
|
||||
|
||||
-*%windir%*\Ntfrs\\*\Edb\*.log
|
||||
- FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory`
|
||||
|
||||
- The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage`
|
||||
- *%windir%*\Ntfrs\\*\Edb\*.log
|
||||
|
||||
- *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\
|
||||
- The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage`
|
||||
|
||||
- The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory`
|
||||
- *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\
|
||||
|
||||
- *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\
|
||||
- The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory`
|
||||
|
||||
- The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File`
|
||||
- *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\
|
||||
|
||||
> [!NOTE]
|
||||
> For custom locations, see [Opt out of automatic exclusions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus#opt-out-of-automatic-exclusions).
|
||||
- The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File`
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_normal$
|
||||
> [!NOTE]
|
||||
> For custom locations, see [Opt out of automatic exclusions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus#opt-out-of-automatic-exclusions).
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\FileIDTable_*
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_normal$
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_*
|
||||
- *%systemdrive%*\System Volume Information\DFSR\FileIDTable_*
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\*.XML
|
||||
- *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_*
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\*.XML
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_clean$
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_clean$
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\Dfsr.db
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\*.frx
|
||||
- *%systemdrive%*\System Volume Information\DFSR\Dfsr.db
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\*.log
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\*.frx
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs
|
||||
- *%systemdrive%*\System Volume Information\DFSR\\*.log
|
||||
|
||||
- *%systemdrive%*\System Volume Information\DFSR\Tmp.edb
|
||||
- *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs
|
||||
|
||||
- Process exclusions
|
||||
- *%systemdrive%*\System Volume Information\DFSR\Tmp.edb
|
||||
|
||||
- *%systemroot%*\System32\dfsr.exe
|
||||
#### Process exclusions
|
||||
|
||||
- *%systemroot%*\System32\dfsrs.exe
|
||||
- *%systemroot%*\System32\dfsr.exe
|
||||
|
||||
- Hyper-V exclusions:
|
||||
- *%systemroot%*\System32\dfsrs.exe
|
||||
|
||||
- This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role
|
||||
#### Hyper-V exclusions
|
||||
|
||||
- File type exclusions:
|
||||
This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role
|
||||
|
||||
- *.vhd
|
||||
- File type exclusions:
|
||||
|
||||
- *.vhdx
|
||||
- *.vhd
|
||||
|
||||
- *.avhd
|
||||
- *.vhdx
|
||||
|
||||
- *.avhdx
|
||||
- *.avhd
|
||||
|
||||
- *.vsv
|
||||
- *.avhdx
|
||||
|
||||
- *.iso
|
||||
- *.vsv
|
||||
|
||||
- *.rct
|
||||
- *.iso
|
||||
|
||||
- *.vmcx
|
||||
- *.rct
|
||||
|
||||
- *.vmrs
|
||||
- *.vmcx
|
||||
|
||||
- Folder exclusions:
|
||||
- *.vmrs
|
||||
|
||||
- *%ProgramData%*\Microsoft\Windows\Hyper-V
|
||||
- Folder exclusions:
|
||||
|
||||
- *%ProgramFiles%*\Hyper-V
|
||||
- *%ProgramData%*\Microsoft\Windows\Hyper-V
|
||||
|
||||
- *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots
|
||||
- *%ProgramFiles%*\Hyper-V
|
||||
|
||||
- *%Public%*\Documents\Hyper-V\Virtual Hard Disks
|
||||
- *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots
|
||||
|
||||
- Process exclusions:
|
||||
- *%Public%*\Documents\Hyper-V\Virtual Hard Disks
|
||||
|
||||
- *%systemroot%*\System32\Vmms.exe
|
||||
- Process exclusions:
|
||||
|
||||
- *%systemroot%*\System32\Vmwp.exe
|
||||
- *%systemroot%*\System32\Vmms.exe
|
||||
|
||||
- SYSVOL files:
|
||||
- *%systemroot%*\System32\Vmwp.exe
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.adm
|
||||
#### SYSVOL files
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.admx
|
||||
- *%systemroot%*\Sysvol\Domain\\*.adm
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.adml
|
||||
- *%systemroot%*\Sysvol\Domain\\*.admx
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\Registry.pol
|
||||
- *%systemroot%*\Sysvol\Domain\\*.adml
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.aas
|
||||
- *%systemroot%*\Sysvol\Domain\Registry.pol
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.inf
|
||||
- *%systemroot%*\Sysvol\Domain\\*.aas
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.Scripts.ini
|
||||
- *%systemroot%*\Sysvol\Domain\\*.inf
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\\*.ins
|
||||
- *%systemroot%*\Sysvol\Domain\\*.Scripts.ini
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\Oscfilter.ini
|
||||
- *%systemroot%*\Sysvol\Domain\\*.ins
|
||||
|
||||
- *%systemroot%*\Sysvol\Domain\Oscfilter.ini
|
||||
|
||||
### Active Directory exclusions
|
||||
|
||||
This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services.
|
||||
|
||||
- NTDS database files. The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File`
|
||||
#### NTDS database files
|
||||
|
||||
- %windir%\Ntds\ntds.dit
|
||||
The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File`
|
||||
|
||||
- %windir%\Ntds\ntds.pat
|
||||
- %windir%\Ntds\ntds.dit
|
||||
|
||||
- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path`
|
||||
- %windir%\Ntds\ntds.pat
|
||||
|
||||
- %windir%\Ntds\EDB*.log
|
||||
#### The AD DS transaction log files
|
||||
|
||||
- %windir%\Ntds\Res*.log
|
||||
The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path`
|
||||
|
||||
- %windir%\Ntds\Edb*.jrs
|
||||
- %windir%\Ntds\EDB*.log
|
||||
|
||||
- %windir%\Ntds\Ntds*.pat
|
||||
- %windir%\Ntds\Res*.log
|
||||
|
||||
- %windir%\Ntds\EDB*.log
|
||||
- %windir%\Ntds\Edb*.jrs
|
||||
|
||||
- %windir%\Ntds\TEMP.edb
|
||||
- %windir%\Ntds\Ntds*.pat
|
||||
|
||||
- The NTDS working folder. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory`
|
||||
- %windir%\Ntds\EDB*.log
|
||||
|
||||
- %windir%\Ntds\Temp.edb
|
||||
- %windir%\Ntds\TEMP.edb
|
||||
|
||||
- %windir%\Ntds\Edb.chk
|
||||
#### The NTDS working folder
|
||||
|
||||
- Process exclusions for AD DS and AD DS-related support files:
|
||||
This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory`
|
||||
|
||||
- %systemroot%\System32\ntfrs.exe
|
||||
- %windir%\Ntds\Temp.edb
|
||||
|
||||
- %systemroot%\System32\lsass.exe
|
||||
- %windir%\Ntds\Edb.chk
|
||||
|
||||
#### Process exclusions for AD DS and AD DS-related support files
|
||||
|
||||
- %systemroot%\System32\ntfrs.exe
|
||||
|
||||
- %systemroot%\System32\lsass.exe
|
||||
|
||||
### DHCP Server exclusions
|
||||
|
||||
@ -310,19 +320,19 @@ This section lists the exclusions that are delivered automatically when you inst
|
||||
|
||||
This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role.
|
||||
|
||||
- File and folder exclusions for the DNS Server role:
|
||||
#### File and folder exclusions for the DNS Server role
|
||||
|
||||
- *%systemroot%*\System32\Dns\\*\\\*.log
|
||||
- *%systemroot%*\System32\Dns\\*\\\*.log
|
||||
|
||||
- *%systemroot%*\System32\Dns\\*\\\*.dns
|
||||
- *%systemroot%*\System32\Dns\\*\\\*.dns
|
||||
|
||||
- *%systemroot%*\System32\Dns\\*\\\*.scc
|
||||
- *%systemroot%*\System32\Dns\\*\\\*.scc
|
||||
|
||||
- *%systemroot%*\System32\Dns\\*\BOOT
|
||||
- *%systemroot%*\System32\Dns\\*\BOOT
|
||||
|
||||
- Process exclusions for the DNS Server role:
|
||||
#### Process exclusions for the DNS Server role
|
||||
|
||||
- *%systemroot%*\System32\dns.exe
|
||||
- *%systemroot%*\System32\dns.exe
|
||||
|
||||
### File and Storage Services exclusions
|
||||
|
||||
@ -338,43 +348,45 @@ This section lists the file and folder exclusions that are delivered automatical
|
||||
|
||||
This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role.
|
||||
|
||||
- File type exclusions:
|
||||
#### File type exclusions
|
||||
|
||||
- *.shd
|
||||
- *.shd
|
||||
|
||||
- *.spl
|
||||
- *.spl
|
||||
|
||||
- Folder exclusions. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory`
|
||||
#### Folder exclusions
|
||||
|
||||
- *%system32%*\spool\printers\\*
|
||||
This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory`
|
||||
|
||||
- Process exclusions:
|
||||
- *%system32%*\spool\printers\\*
|
||||
|
||||
- spoolsv.exe
|
||||
#### Process exclusions
|
||||
|
||||
- spoolsv.exe
|
||||
|
||||
### Web Server exclusions
|
||||
|
||||
This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role.
|
||||
|
||||
- Folder exclusions:
|
||||
#### Folder exclusions
|
||||
|
||||
- *%SystemRoot%*\IIS Temporary Compressed Files
|
||||
- *%SystemRoot%*\IIS Temporary Compressed Files
|
||||
|
||||
- *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files
|
||||
- *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files
|
||||
|
||||
- *%SystemDrive%*\inetpub\temp\ASP Compiled Templates
|
||||
- *%SystemDrive%*\inetpub\temp\ASP Compiled Templates
|
||||
|
||||
- *%systemDrive%*\inetpub\logs
|
||||
- *%systemDrive%*\inetpub\logs
|
||||
|
||||
- *%systemDrive%*\inetpub\wwwroot
|
||||
- *%systemDrive%*\inetpub\wwwroot
|
||||
|
||||
- Process exclusions:
|
||||
#### Process exclusions
|
||||
|
||||
- *%SystemRoot%*\system32\inetsrv\w3wp.exe
|
||||
- *%SystemRoot%*\system32\inetsrv\w3wp.exe
|
||||
|
||||
- *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe
|
||||
- *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe
|
||||
|
||||
- *%SystemDrive%*\PHP5433\php-cgi.exe
|
||||
- *%SystemDrive%*\PHP5433\php-cgi.exe
|
||||
|
||||
### Windows Server Update Services exclusions
|
||||
|
||||
@ -391,7 +403,11 @@ This section lists the folder exclusions that are delivered automatically when y
|
||||
## Related articles
|
||||
|
||||
- [Configure and validate exclusions for Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
|
||||
|
||||
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
|
||||
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
|
||||
|
||||
- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
||||
|
||||
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 60 KiB After Width: | Height: | Size: 114 KiB |
@ -0,0 +1,87 @@
|
||||
---
|
||||
title: "Better together - Windows Defender Antivirus and Office 365 (including OneDrive) - better protection from ransomware and cyberthreats"
|
||||
description: "Office 365, which includes OneDrive, goes together wonderfully with Windows Defender Antivirus. Read this article to learn more."
|
||||
keywords: windows defender, antivirus, office 365, onedrive, restore, ransomware
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 03/04/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Better together: Windows Defender Antivirus and Office 365
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Antivirus
|
||||
- Office 365
|
||||
|
||||
You might already know that:
|
||||
|
||||
- **Windows Defender Antivirus protects your Windows 10 device from software threats, such as viruses, malware, and spyware**. Windows Defender Antivirus is your complete, ongoing protection, built into Windows 10 and ready to go. [Windows Defender Antivirus is your next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
|
||||
- **Office 365 includes antiphishing, antispam, and antimalware protection**. With your Office 365 subscription, you get premium email and calendars, Office apps, 1 TB of cloud storage (via OneDrive), and advanced security across all your devices. This is true for home and business users. And if you're a business user, and your organization is using Office 365 E5, you get even more protection through Office 365 Advanced Threat Protection. [Protect against threats with Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/protect-against-threats).
|
||||
|
||||
- **OneDrive, included in Office 365, enables you to store your files and folders online, and share them as you see fit**. You can work together with people (for work or fun), and coauthor files that are stored in OneDrive. You can also access your files across all your devices (your PC, phone, and tablet). [Manage sharing in OneDrive](https://docs.microsoft.com/OneDrive/manage-sharing).
|
||||
|
||||
**But did you know there are good security reasons to use Windows Defender Antivirus together with Office 365**? Here are two:
|
||||
|
||||
1. [You get ransomware protection and recovery](#ransomware-protection-and-recovery).
|
||||
|
||||
2. [Integration means better protection](#integration-means-better-protection).
|
||||
|
||||
Read the following sections to learn more.
|
||||
|
||||
## Ransomware protection and recovery
|
||||
|
||||
When you save your files to [OneDrive](https://docs.microsoft.com/onedrive), and [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) detects a ransomware threat on your device, the following things occur:
|
||||
|
||||
1. **You are told about the threat**. (If your organization is using [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (ATP), your security operations team is notified, too.)
|
||||
|
||||
2. **Windows Defender Antivirus helps you (and your organization's security team) remove the ransomware** from your device(s). (If your organization is using Microsoft Defender ATP, your security operations team can determine whether other devices are infected and take appropriate action, too.)
|
||||
|
||||
3. **You get the option to recover your files in OneDrive**. With the OneDrive Files Restore feature, you can recover your files in OneDrive to the state they were in before the ransomware attack occurred. See [Ransomware detection and recovering your files](https://support.office.com/article/0d90ec50-6bfd-40f4-acc7-b8c12c73637f).
|
||||
|
||||
Think of the time and hassle this can save.
|
||||
|
||||
## Integration means better protection
|
||||
|
||||
Office 365 Advanced Threat Protection integrated with Microsoft Defender Advanced Threat Protection means better protection for your organization. Here's how:
|
||||
|
||||
- [Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp) safeguards your organization against malicious threats posed in email messages, email attachments, and links (URLs) in Office documents.
|
||||
|
||||
AND
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) protects your devices from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves your security posture.
|
||||
|
||||
SO
|
||||
|
||||
- Once integration is enabled, your security operations team can see a list of devices that are used by the recipients of any detected URLs or email messages, along with recent alerts for those devices, in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)).
|
||||
|
||||
If you haven't already done so, [integrate Office 365 Advanced Threat Protection with Microsoft Defender ATP](https://docs.microsoft.com/microsoft-365/security/office-365-security/integrate-office-365-ti-with-wdatp).
|
||||
|
||||
## More good reasons to use OneDrive
|
||||
|
||||
Protection from ransomware is one great reason to put your files in OneDrive. And there are several more good reasons, summarized in this video: <br/><br/>
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/70b4d256-46fb-481f-ad9b-921ef5fd7bed]
|
||||
|
||||
## Want to learn more?
|
||||
|
||||
[OneDrive](https://docs.microsoft.com/onedrive)
|
||||
|
||||
[Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp?view=o365-worldwide)
|
||||
|
||||
[Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/)
|
||||
|
||||
|
||||
@ -87,9 +87,9 @@ If you are part of your organization's security team, and your subscription incl
|
||||
|
||||
You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task.
|
||||
|
||||
1. Make sure your organization meets all of the following requirements:
|
||||
1. Make sure your organization meets all of the following requirements to manage tamper protection using Intune:
|
||||
|
||||
- Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in [Microsoft 365 E5](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview)).
|
||||
- Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in [Microsoft 365 E5](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview)).
|
||||
- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; this is included in Microsoft 365 E5.)
|
||||
- Your Windows machines must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later. (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) for more details about releases.)
|
||||
- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Why you should use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection
|
||||
description: For best results, use Windows Defender Antivirus together with your other Microsoft offerings.
|
||||
title: "Why you should use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection"
|
||||
description: "For best results, use Windows Defender Antivirus together with your other Microsoft offerings."
|
||||
keywords: windows defender, antivirus, third party av
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
|
||||
@ -57,8 +57,14 @@ By default, Windows Defender Antivirus is installed and functional on Windows Se
|
||||
|
||||
2. When you get to the **Features** step of the wizard, under **Windows Defender Features**, select the **GUI for Windows Defender** option.
|
||||
|
||||
In Windows Server 2016, the **Add Roles and Features Wizard** looks like this:
|
||||
|
||||
|
||||
|
||||
In Windows Server 2019, the **Add Roles and Feature Wizard** looks like this:
|
||||
|
||||
|
||||
|
||||
### Turn on the GUI using PowerShell
|
||||
|
||||
The following PowerShell cmdlet will enable the interface:
|
||||
@ -69,7 +75,7 @@ Install-WindowsFeature -Name Windows-Defender-GUI
|
||||
|
||||
## Install Windows Defender Antivirus on Windows Server 2016 or 2019
|
||||
|
||||
You can use the **Add Roles and Features Wizard** or PowerShell to install Windows Defender Antivirus.
|
||||
You can use either the **Add Roles and Features Wizard** or PowerShell to install Windows Defender Antivirus.
|
||||
|
||||
### Use the Add Roles and Features Wizard
|
||||
|
||||
@ -79,12 +85,13 @@ You can use the **Add Roles and Features Wizard** or PowerShell to install Windo
|
||||
|
||||
### Use PowerShell
|
||||
|
||||
To use PowerShell to install Windows Defender Antivirus, run the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Install-WindowsFeature -Name Windows-Defender
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> Event messages for the antimalware engine included with Windows Defender Antivirus can be found in [Windows Defender AV Events](troubleshoot-windows-defender-antivirus.md).
|
||||
Event messages for the antimalware engine included with Windows Defender Antivirus can be found in [Windows Defender AV Events](troubleshoot-windows-defender-antivirus.md).
|
||||
|
||||
|
||||
## Verify Windows Defender Antivirus is running
|
||||
@ -132,17 +139,22 @@ The following table lists the services for Windows Defender Antivirus and the de
|
||||
|
||||
|Service Name|File Location|Description|
|
||||
|--------|---------|--------|
|
||||
|Windows Defender Service (Windefend)|`C:\Program Files\Windows Defender\MsMpEng.exe`|This is the main Windows Defender Antivirus service that needs to be running at all times.|
|
||||
|Windows Defender Service (WinDefend)|`C:\Program Files\Windows Defender\MsMpEng.exe`|This is the main Windows Defender Antivirus service that needs to be running at all times.|
|
||||
|Windows Error Reporting Service (Wersvc)|`C:\WINDOWS\System32\svchost.exe -k WerSvcGroup`|This service sends error reports back to Microsoft.|
|
||||
|Windows Defender Firewall (MpsSvc)|`C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork`|We recommend leaving the Windows Defender Firewall service enabled.|
|
||||
|Windows Update (Wuauserv)|`C:\WINDOWS\system32\svchost.exe -k netsvcs`|Windows Update is needed to get Security intelligence updates and antimalware engine updates|
|
||||
|
||||
## Submit samples
|
||||
|
||||
To submit a file, review the [submission guide](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide), and then visit the [sample submission portal](https://www.microsoft.com/wdsi/filesubmission)
|
||||
|
||||
Sample submission allows Microsoft to collect samples of potentially malicious software. To help provide continued and up-to-date protection, Microsoft researchers use these samples to analyze suspicious activities and produce updated antimalware Security intelligence. We collect program executable files, such as .exe files and .dll files. We do not collect files that contain personal data, like Microsoft Word documents and PDF files.
|
||||
|
||||
### Submit a file
|
||||
|
||||
1. Review the [submission guide](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide).
|
||||
|
||||
2. Visit the [sample submission portal](https://www.microsoft.com/wdsi/filesubmission), and submit your file.
|
||||
|
||||
|
||||
### Enable automatic sample submission
|
||||
|
||||
To enable automatic sample submission, start a Windows PowerShell console as an administrator, and set the **SubmitSamplesConsent** value data according to one of the following settings:
|
||||
@ -158,7 +170,7 @@ To enable automatic sample submission, start a Windows PowerShell console as an
|
||||
|
||||
To help ensure security and performance, certain exclusions are automatically added based on the roles and features you install when using Windows Defender Antivirus on Windows Server 2016 or 2019.
|
||||
|
||||
See [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md).
|
||||
See [Configure exclusions in Windows Defender Antivirus on Windows Server](configure-server-exclusions-windows-defender-antivirus.md).
|
||||
|
||||
## Need to uninstall Windows Defender Antivirus?
|
||||
|
||||
|
||||
@ -219,7 +219,7 @@ Before you begin testing the deployed catalog file, make sure that the catalog s
|
||||
|
||||
## Deploy catalog files with Microsoft Endpoint Configuration Manager
|
||||
|
||||
As an alternative to Group Policy, you can use Microsoft Endpoint Configuration Manager to deploy catalog files to the managed computers in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, Microsoft Endpoint Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files:
|
||||
As an alternative to Group Policy, you can use Configuration Manager to deploy catalog files to the managed computers in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files:
|
||||
|
||||
>[!NOTE]
|
||||
>The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization.
|
||||
@ -294,7 +294,7 @@ Before you begin testing the deployed catalog file, make sure that the catalog s
|
||||
|
||||
## Inventory catalog files with Microsoft Endpoint Configuration Manager
|
||||
|
||||
When catalog files have been deployed to the computers within your environment, whether by using Group Policy or Microsoft Endpoint Configuration Manager, you can inventory them with the software inventory feature of Microsoft Endpoint Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy.
|
||||
When catalog files have been deployed to the computers within your environment, whether by using Group Policy or Configuration Manager, you can inventory them with the software inventory feature of Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy.
|
||||
|
||||
>[!NOTE]
|
||||
>A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names.
|
||||
@ -332,7 +332,7 @@ When catalog files have been deployed to the computers within your environment,
|
||||
|
||||
9. Now that you have created the client settings policy, right-click the new policy, click **Deploy**, and then choose the collection on which you would like to inventory the catalog files.
|
||||
|
||||
At the time of the next software inventory cycle, when the targeted clients receive the new client settings policy, you will be able to view the inventoried files in the built-in Microsoft Endpoint Configuration Manager reports or Resource Explorer. To view the inventoried files on a client within Resource Explorer, complete the following steps:
|
||||
At the time of the next software inventory cycle, when the targeted clients receive the new client settings policy, you will be able to view the inventoried files in the built-in Configuration Manager reports or Resource Explorer. To view the inventoried files on a client within Resource Explorer, complete the following steps:
|
||||
|
||||
1. Open the Configuration Manager console, and select the Assets and Compliance workspace.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user