deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-22 13:53:39 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

updated links

Browse Source
This commit is contained in:
Beth Levin
2020-02-07 13:20:54 -08:00
parent 71011a274e
commit 728d5d42f6
17 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
windows/security/threat-protection/auditing/event-4624.md
View File

@ -158,7 +158,7 @@ This event generates when a logon session is created (on destination machine). I
- **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.
Reference: <http://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx>. Reference: <https://blogs.technet.com/b/kfalde/archive/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2.aspx>.
If not a **RemoteInteractive** logon, then this will be "-" string. If not a **RemoteInteractive** logon, then this will be "-" string.

2
windows/security/threat-protection/auditing/event-4793.md
View File

@ -30,7 +30,7 @@ This event generates each time the [Password Policy Checking API](https://msdn.m
The Password Policy Checking API allows an application to check password compliance against an application-provided account database or single account and verify that passwords meet the complexity, aging, minimum length, and history reuse requirements of a password policy. The Password Policy Checking API allows an application to check password compliance against an application-provided account database or single account and verify that passwords meet the complexity, aging, minimum length, and history reuse requirements of a password policy.
This event, for example, generates during Directory Services Restore Mode ([DSRM](http://blogs.technet.com/b/askds/archive/2009/03/11/ds-restore-mode-password-maintenance.aspx)) account password reset procedure to check new DSRM password. This event, for example, generates during Directory Services Restore Mode ([DSRM](https://blogs.technet.com/b/askds/archive/2009/03/11/ds-restore-mode-password-maintenance.aspx)) account password reset procedure to check new DSRM password.
This event generates on the computer where Password Policy Checking API was called. This event generates on the computer where Password Policy Checking API was called.

2
windows/security/threat-protection/auditing/event-4908.md
View File

@ -34,7 +34,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category
More information about Special Groups auditing can be found here: More information about Special Groups auditing can be found here:
<http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx> <https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx>
<https://support.microsoft.com/kb/947223> <https://support.microsoft.com/kb/947223>

2
windows/security/threat-protection/auditing/event-4911.md
View File

@ -26,7 +26,7 @@ ms.author: dansimp
***Event Description:*** ***Event Description:***
This event generates when [resource attributes](http://blogs.technet.com/b/canitpro/archive/2013/05/07/step-by-step-protecting-your-information-with-dynamic-access-control.aspx) of the file system object were changed. This event generates when [resource attributes](https://blogs.technet.com/b/canitpro/archive/2013/05/07/step-by-step-protecting-your-information-with-dynamic-access-control.aspx) of the file system object were changed.
Resource attributes for file or folder can be changed, for example, using Windows File Explorer (object’s Properties-&gt;Classification tab). Resource attributes for file or folder can be changed, for example, using Windows File Explorer (object’s Properties-&gt;Classification tab).

4
windows/security/threat-protection/auditing/event-4964.md
View File

@ -26,7 +26,7 @@ ms.author: dansimp
***Event Description:*** ***Event Description:***
This event occurs when an account that is a member of any defined [Special Group](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) logs in. This event occurs when an account that is a member of any defined [Special Group](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) logs in.
> **Note**&nbsp;&nbsp;For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. > **Note**&nbsp;&nbsp;For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
@ -94,7 +94,7 @@ This event occurs when an account that is a member of any defined [Special Group
&gt; S-1-5-32-544;S-1-5-32-123-54-65 &gt; S-1-5-32-544;S-1-5-32-123-54-65
&gt; For more information see: <http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx> &gt; For more information see: <https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx>
***Field Descriptions:*** ***Field Descriptions:***

4
windows/security/threat-protection/auditing/event-5056.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/bb204775(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/bb204775(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5057.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/bb204775(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/bb204775(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5060.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/bb204775(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/bb204775(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5063.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5064.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5065.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5066.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5067.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5068.md
View File

@ -26,9 +26,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5069.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

4
windows/security/threat-protection/auditing/event-5070.md
View File

@ -28,9 +28,9 @@ For more information about Cryptographic Next Generation (CNG) visit these pages
- <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx> - <https://msdn.microsoft.com/library/windows/desktop/aa376214(v=vs.85).aspx>
- <http://www.microsoft.com/en-us/download/details.aspx?id=1251> - <https://www.microsoft.com/download/details.aspx?id=1251>
- <http://www.microsoft.com/en-us/download/details.aspx?id=30688> - <https://www.microsoft.com/download/details.aspx?id=30688>
This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting.

2
windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md
View File

@ -77,7 +77,7 @@ You can use existing System Center Configuration Manager functionality to create
> >
> This can be accomplished by creating a detection rule checking if the "OnboardingState" registry value (of type REG_DWORD) = 1. > This can be accomplished by creating a detection rule checking if the "OnboardingState" registry value (of type REG_DWORD) = 1.
> This registry value is located under "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status". > This registry value is located under "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status".
Refer to the following ConfigMgr article for more information: https://docs.microsoft.com/en-us/configmgr/apps/deploy-use/create-applications#bkmk_detect-rule Refer to the following ConfigMgr article for more information: https://docs.microsoft.com/configmgr/apps/deploy-use/create-applications#bkmk_detect-rule
### Configure sample collection settings ### Configure sample collection settings