`0"; (the null-terminator (`0) must be included in the string hash)
$hashObj = [System.Security.Cryptography.HashAlgorithm]::Create('sha256') ; $dig = $hashObj.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($text)) ; $digB64 = [System.Convert]::ToBase64String($dig) ; Write-Host "$text ==> $digB64"
```
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md
index ea38090b1d..c3c3acaa55 100644
--- a/windows/deployment/upgrade/windows-10-edition-upgrades.md
+++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md
@@ -22,7 +22,6 @@ ms.date: 10/28/2022
With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page.
-For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf).
The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer.
diff --git a/windows/deployment/volume-activation/volume-activation-windows-10.md b/windows/deployment/volume-activation/volume-activation-windows-10.md
index 29dfd02ddc..3c213a2a45 100644
--- a/windows/deployment/volume-activation/volume-activation-windows-10.md
+++ b/windows/deployment/volume-activation/volume-activation-windows-10.md
@@ -27,7 +27,7 @@ ms.technology: itpro-fundamentals
> [!TIP]
> Are you looking for volume licensing information?
>
-> - [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104)
+> - [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://www.microsoft.com/download/details.aspx?id=11091)
> [!TIP]
> Are you looking for information on retail activation?
diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md
index 3dab9cc693..f511e6481b 100644
--- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md
+++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md
@@ -1,7 +1,7 @@
---
title: Device registration overview
description: This article provides an overview on how to register devices in Autopatch
-ms.date: 05/02/2023
+ms.date: 05/08/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: conceptual
@@ -141,6 +141,9 @@ If your Autopatch groups have more than five deployment rings, and you must move
If you want to move devices to different deployment rings (either service or software update-based), after Windows Autopatch's deployment ring assignment, you can repeat the following steps for one or more devices from the **Registered** tab.
+> [!IMPORTANT]
+> You can only move devices in between deployment rings within the **same** Autopatch group. You can't move devices in between deployment rings across different Autopatch groups. If you try to select a device that belongs to one Autopatch group, and another device that belongs to a different Autopatch group, you'll receive the following error message on the top right corner of the Microsoft Intune portal: "**An error occurred. Please select devices within the same Autopatch group**.
+
**To move devices in between deployment rings:**
> [!NOTE]
@@ -150,7 +153,7 @@ If you want to move devices to different deployment rings (either service or sof
1. In the **Windows Autopatch** section, select **Devices**.
1. In the **Registered** tab, select one or more devices you want to assign. All selected devices will be assigned to the deployment ring you specify.
1. Select **Device actions** from the menu.
-1. Select **Assign device group**. A fly-in opens.
+1. Select **Assign ring**. A fly-in opens.
1. Use the dropdown menu to select the deployment ring to move devices to, and then select Save. The Ring assigned by column will change to Pending.
1. When the assignment is complete, the **Ring assigned by** column changes to Admin (which indicates that you made the change) and the **Ring** column shows the new deployment ring assignment.
diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md
index 2eed6eee26..9831d4850d 100644
--- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md
+++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md
@@ -1,7 +1,7 @@
---
title: Manage Windows Autopatch groups
description: This article explains how to manage Autopatch groups
-ms.date: 05/05/2023
+ms.date: 05/11/2023
ms.prod: windows-client
ms.technology: itpro-updates
ms.topic: how-to
@@ -127,7 +127,7 @@ You **can’t** delete the Default Autopatch group. However, you can delete a Cu
> [!IMPORTANT]
> The Windows Autopatch groups functionaliy is in **public preview**. This feature is being actively developed and not all device conflict detection and resolution scenarios are working as expected.
-> Fore more information on what to expect for this scenario during public preview, see [Known issues](#known-issues).
+> For more information on what to expect for this scenario during public preview, see [Known issues](#known-issues).
Overlap in device membership is a common scenario when working with device-based Azure AD groups since sometimes dynamic queries can be large in scope or the same assigned device membership can be used across different Azure AD groups.
@@ -188,7 +188,13 @@ The Windows Autopatch team is aware that all device conflict scenarios listed be
- Default to Custom Autopatch device conflict detection and resolution.
- Device conflict detection and resolution within an Autopatch group.
-- Custom to Cstom Autopatch group device conflict detection.
+- Custom to Custom Autopatch group device conflict detection.
+
+> [!TIP]
+> Use the following two best practices to help minimize device conflict scenarios when using Autopatch groups during the public preview:
+>
+> - Review your software update deployment requirements thoroughly. If your deployment requirements allow, try using the Default Autopatch group as much as possible, instead of start creating Custom Autopatch groups. You can customize the Default Autopatch to have up to 15 deployment rings, and you can use your existing device-based Azure AD groups with custom update deployment cadences.
+> - If creating Custom Autopatch groups, try to avoid using device-based Azure AD groups that have device membership overlaps with the devices that are already registered with Windows Autopatch, and already belong to the Default Autopatch group.
### Autopatch group Azure AD group remediator
@@ -213,3 +219,12 @@ The Windows Autopatch team is currently developing the Autopatch group Azure AD
> - Modern Workplace Devices-Windows Autopatch-Broad
>
> Use the [Policy health feature](../operate/windows-autopatch-policy-health-and-remediation.md) to restore these groups, if needed. For more information, see [restore deployment groups](../operate/windows-autopatch-policy-health-and-remediation.md#restore-deployment-groups).
+
+### Rename an Autopatch group
+
+- **Status: Active**
+
+You can't rename an Autopatch group yet. The Autopatch group name is appended to all deployment ring names in the Autopatch group. Windows Autopatch is currently developing the rename feature.
+
+> [!IMPORTANT]
+> During the public preview, if you try to rename either the [Update rings](/mem/intune/protect/windows-10-update-rings) or [feature updates](/mem/intune/protect/windows-10-feature-updates) for Windows 10 and later policies directly in the Microsoft Intune end-user experience, the policy names are reverted back to the name defined by the Autopatch group end-user experience interface.
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md
index 789a3b23e3..fe0551604d 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-device-alerts.md
@@ -58,12 +58,12 @@ Alert resolutions are provided through the Windows Update service and provide th
| `DeviceRegistrationInvalidGlobalDeviceId` | The device isn't able to register or authenticate properly with Windows Update because of an invalid Global Device ID. |The Windows Update service has reported that the MSA Service may be disabled preventing Global Device ID assignment.Check that the MSA Service is running or able to run on device.
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
| `DeviceRegistrationIssue` | The device isn't able to register or authenticate properly with Windows Update. | The Windows Update service has reported a device registration issue.For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
| `DeviceRegistrationNoTrustType` | The device isn't able to register or authenticate properly with Windows Update because it can't establish Trust. | The Windows Update service has reported a device registration issue.For more information, see [Windows Autopatch post-device registration readiness checks](../deploy/windows-autopatch-post-reg-readiness-checks.md).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
-| `DiskFull` | The installation couldn't be completed because the Windows partition is full. | The Windows Update service has reported there's insufficient disk space to perform the update. Free up disk space on the Windows partition and retry the installation.For more information, see [Free up space for Windows Updates](/windows/free-up-space-for-windows-updates-429b12ba-f514-be0b-4924-ca6d16fa1d65#:~:text=Here%E2%80%99s%20how%20to%20get%20more%20storage%20space%20on,to%20Windows%20needs%20space%20to%20update.%20More%20items).
|
+| `DiskFull` | The installation couldn't be completed because the Windows partition is full. | The Windows Update service has reported there's insufficient disk space to perform the update. Free up disk space on the Windows partition and retry the installation.For more information, see [Free up space for Windows Updates](https://support.microsoft.com/windows/free-up-space-for-windows-updates-429b12ba-f514-be0b-4924-ca6d16fa1d65).
|
| `DownloadCancelled` | Windows Update couldn't download the update because the update server stopped the connection. | The Windows Update service has reported an issue with your update server. Validate your network is working and retry the download. If the alert persists, review your network configuration to make sure that this computer can access the internet.For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).
|
| `DownloadConnectionIssue` | Windows Update couldn't connect to the update server and the update couldn't download. | The Windows Update service has reported an issue connecting to Windows Update. Review your network configuration, and to make sure that this computer can access the internet and Windows Update Online.For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
-| `DownloadCredentialsIssue` | Windows Update couldn't download the file because the Background Intelligent Transfer Service (BITS) couldn't connect to the internet. A proxy server or firewall on your network might require credentials. | The Windows Update service Windows has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client. Retry the download.Review your network configuration to make sure that this computer can access the internet. Validate and/or allowlist Windows Update and Delivery Optimization endpoint.
For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DownloadCredentialsIssue` | Windows Update couldn't download the file because the Background Intelligent Transfer Service ([BITS](/windows/win32/bits/about-bits)) couldn't connect to the internet. A proxy server or firewall on your network might require credentials. | The Windows Update service Windows has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client. Retry the download.Review your network configuration to make sure that this computer can access the internet. Validate and/or allowlist Windows Update and Delivery Optimization endpoint.
For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
| `DownloadIssue` | There was an issue downloading the update. | The Windows Update service has reported it failed to connect to Windows Updates. This can often be an issue with an Application Gateway or HTTP proxy, or an issue on the client.For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5).and [Endpoints for Delivery Optimization and Windows Update](/windows/deployment/do/waas-delivery-optimization-faq#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization).
If the alert persists, [submit a support request](../operate/windows-autopatch-support-request.md).
|
-| `DownloadIssueServiceDisabled` | There was a problem with the Background Intelligent Transfer Service (BITS). The BITS service or a service it depends on might be disabled. | The Windows Updates service has reported that the BITS service is disabled. In the local client services, make sure that the Background Intelligent Transfer Service is enabled. If the service isn't running, try starting it manually. For more information, see [Issues with BITS](/security-updates/WindowsUpdateServices/18127392).If it will not start, check the event log for errors or [submit a support request](../operate/windows-autopatch-support-request.md).
|
+| `DownloadIssueServiceDisabled` | There was a problem with the Background Intelligent Transfer Service (BITS). The BITS service or a service it depends on might be disabled. | The Windows Updates service has reported that the BITS service is disabled. In the local client services, make sure that the Background Intelligent Transfer Service is enabled. If the service isn't running, try starting it manually. For more information, see [Issues with BITS](/windows/win32/bits/about-bits).If it will not start, check the event log for errors or [submit a support request](../operate/windows-autopatch-support-request.md).
|
| `DownloadTimeout` | A timeout occurred while Windows tried to contact the update service or the server containing the update's payload. | The Windows Update service has reported it attempted to download the payload and the connection timed out.Retry downloading the payload. If not successful, review your network configuration to make sure that this computer can access the internet.
For more information, see [Check your network connection status](https://support.microsoft.com/windows/check-your-network-connection-status-efb4fb41-f751-567a-f60f-aac9114659a5). |
| `EndOfService` | The device is on a version of Windows that has passed its end of service date. | Windows Update service has reported the current version is past End of Service. Update device to a version that is currently serviced in [Feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).For more information on OS versioning, see [Windows 10 release information](/windows/release-health/release-information).
|
| `EndOfServiceApproaching` | The device is on a version of Windows that is approaching its end of service date. | Update device to a version that is currently serviced in [Feature update overview](../operate/windows-autopatch-groups-windows-feature-update-overview.md).For more information on OS versioning, see [Windows 10 release information](/windows/release-health/release-information).
|
diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml
index d71b135f49..0c78b4dfbe 100644
--- a/windows/security/TOC.yml
+++ b/windows/security/TOC.yml
@@ -1,450 +1,28 @@
- name: Windows security
href: index.yml
-- name: Zero Trust and Windows
- href: zero-trust-windows-device-health.md
expanded: true
+- name: Introduction
+ items:
+ - name: Windows security overview
+ href: introduction/index.md
+ - name: Zero Trust and Windows
+ href: zero-trust-windows-device-health.md
+ - name: Security features and edition requirements
+ href: introduction/security-features-edition-requirements.md
+ - name: Security features and licensing requirements
+ href: introduction/security-features-licensing-requirements.md
- name: Hardware security
- items:
- - name: Overview
- href: hardware.md
- - name: Microsoft Pluton security processor
- items:
- - name: Microsoft Pluton overview
- href: information-protection/pluton/microsoft-pluton-security-processor.md
- - name: Microsoft Pluton as TPM
- href: information-protection/pluton/pluton-as-tpm.md
- - name: Trusted Platform Module
- href: information-protection/tpm/trusted-platform-module-top-node.md
- items:
- - name: Trusted Platform Module overview
- href: information-protection/tpm/trusted-platform-module-overview.md
- - name: TPM fundamentals
- href: information-protection/tpm/tpm-fundamentals.md
- - name: How Windows uses the TPM
- href: information-protection/tpm/how-windows-uses-the-tpm.md
- - name: Manage TPM commands
- href: information-protection/tpm/manage-tpm-commands.md
- - name: Manager TPM Lockout
- href: information-protection/tpm/manage-tpm-lockout.md
- - name: Change the TPM password
- href: information-protection/tpm/change-the-tpm-owner-password.md
- - name: TPM Group Policy settings
- href: information-protection/tpm/trusted-platform-module-services-group-policy-settings.md
- - name: Back up the TPM recovery information to AD DS
- href: information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md
- - name: View status, clear, or troubleshoot the TPM
- href: information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md
- - name: Understanding PCR banks on TPM 2.0 devices
- href: information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
- - name: TPM recommendations
- href: information-protection/tpm/tpm-recommendations.md
-
- - name: Hardware-based root of trust
- href: threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md
- - name: System Guard Secure Launch and SMM protection
- href: threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md
- - name: Enable virtualization-based protection of code integrity
- href: threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md
- - name: Kernel DMA Protection
- href: information-protection/kernel-dma-protection-for-thunderbolt.md
- - name: Windows secured-core devices
- href: /windows-hardware/design/device-experiences/oem-highly-secure
+ href: hardware-security/toc.yml
- name: Operating system security
- items:
- - name: Overview
- href: operating-system.md
- - name: System security
- items:
- - name: Secure the Windows boot process
- href: information-protection/secure-the-windows-10-boot-process.md
- - name: Trusted Boot
- href: trusted-boot.md
- - name: Cryptography and certificate management
- href: cryptography-certificate-mgmt.md
- - name: The Windows Security app
- href: threat-protection/windows-defender-security-center/windows-defender-security-center.md
- items:
- - name: Virus & threat protection
- href: threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md
- - name: Account protection
- href: threat-protection\windows-defender-security-center\wdsc-account-protection.md
- - name: Firewall & network protection
- href: threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md
- - name: App & browser control
- href: threat-protection\windows-defender-security-center\wdsc-app-browser-control.md
- - name: Device security
- href: threat-protection\windows-defender-security-center\wdsc-device-security.md
- - name: Device performance & health
- href: threat-protection\windows-defender-security-center\wdsc-device-performance-health.md
- - name: Family options
- href: threat-protection\windows-defender-security-center\wdsc-family-options.md
- - name: Security policy settings
- href: threat-protection/security-policy-settings/security-policy-settings.md
- - name: Security auditing
- href: threat-protection/auditing/security-auditing-overview.md
- - name: Encryption and data protection
- href: encryption-data-protection.md
- items:
- - name: Encrypted Hard Drive
- href: information-protection/encrypted-hard-drive.md
- - name: BitLocker
- href: information-protection/bitlocker/bitlocker-overview.md
- items:
- - name: Overview of BitLocker Device Encryption in Windows
- href: information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md
- - name: BitLocker frequently asked questions (FAQ)
- href: information-protection/bitlocker/bitlocker-frequently-asked-questions.yml
- items:
- - name: Overview and requirements
- href: information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml
- - name: Upgrading
- href: information-protection/bitlocker/bitlocker-upgrading-faq.yml
- - name: Deployment and administration
- href: information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml
- - name: Key management
- href: information-protection/bitlocker/bitlocker-key-management-faq.yml
- - name: BitLocker To Go
- href: information-protection/bitlocker/bitlocker-to-go-faq.yml
- - name: Active Directory Domain Services
- href: information-protection/bitlocker/bitlocker-and-adds-faq.yml
- - name: Security
- href: information-protection/bitlocker/bitlocker-security-faq.yml
- - name: BitLocker Network Unlock
- href: information-protection/bitlocker/bitlocker-network-unlock-faq.yml
- - name: General
- href: information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml
- - name: "Prepare your organization for BitLocker: Planning and policies"
- href: information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
- - name: BitLocker deployment comparison
- href: information-protection/bitlocker/bitlocker-deployment-comparison.md
- - name: BitLocker basic deployment
- href: information-protection/bitlocker/bitlocker-basic-deployment.md
- - name: Deploy BitLocker on Windows Server 2012 and later
- href: information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
- - name: BitLocker management for enterprises
- href: information-protection/bitlocker/bitlocker-management-for-enterprises.md
- - name: Enable Network Unlock with BitLocker
- href: information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
- - name: Use BitLocker Drive Encryption Tools to manage BitLocker
- href: information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
- - name: Use BitLocker Recovery Password Viewer
- href: information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
- - name: BitLocker Group Policy settings
- href: information-protection/bitlocker/bitlocker-group-policy-settings.md
- - name: BCD settings and BitLocker
- href: information-protection/bitlocker/bcd-settings-and-bitlocker.md
- - name: BitLocker Recovery Guide
- href: information-protection/bitlocker/bitlocker-recovery-guide-plan.md
- - name: BitLocker Countermeasures
- href: information-protection/bitlocker/bitlocker-countermeasures.md
- - name: Protecting cluster shared volumes and storage area networks with BitLocker
- href: information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
- - name: Troubleshoot BitLocker
- items:
- - name: Troubleshoot BitLocker
- href: /troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting
- - name: "BitLocker cannot encrypt a drive: known issues"
- href: /troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-issues
- - name: "Enforcing BitLocker policies by using Intune: known issues"
- href: /troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues
- - name: "BitLocker Network Unlock: known issues"
- href: /troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues
- - name: "BitLocker recovery: known issues"
- href: /troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues
- - name: "BitLocker configuration: known issues"
- href: /troubleshoot/windows-client/windows-security/bitlocker-configuration-known-issues
- - name: Troubleshoot BitLocker and TPM issues
- items:
- - name: "BitLocker cannot encrypt a drive: known TPM issues"
- href: /troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-tpm-issues
- - name: "BitLocker and TPM: other known issues"
- href: /troubleshoot/windows-client/windows-security/bitlocker-and-tpm-other-known-issues
- - name: Decode Measured Boot logs to track PCR changes
- href: /troubleshoot/windows-client/windows-security/decode-measured-boot-logs-to-track-pcr-changes
- - name: Personal Data Encryption (PDE)
- items:
- - name: Personal Data Encryption (PDE) overview
- href: information-protection/personal-data-encryption/overview-pde.md
- - name: Personal Data Encryption (PDE) frequently asked questions (FAQ)
- href: information-protection/personal-data-encryption/faq-pde.yml
- - name: Configure Personal Data Encryption (PDE) in Intune
- items:
- - name: Configure Personal Data Encryption (PDE) in Intune
- href: information-protection/personal-data-encryption/configure-pde-in-intune.md
- - name: Enable Personal Data Encryption (PDE)
- href: information-protection/personal-data-encryption/pde-in-intune/intune-enable-pde.md
- - name: Disable Winlogon automatic restart sign-on (ARSO) for PDE
- href: information-protection/personal-data-encryption/pde-in-intune/intune-disable-arso.md
- - name: Disable kernel-mode crash dumps and live dumps for PDE
- href: information-protection/personal-data-encryption/pde-in-intune/intune-disable-memory-dumps.md
- - name: Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE
- href: information-protection/personal-data-encryption/pde-in-intune/intune-disable-wer.md
- - name: Disable hibernation for PDE
- href: information-protection/personal-data-encryption/pde-in-intune/intune-disable-hibernation.md
- - name: Disable allowing users to select when a password is required when resuming from connected standby for PDE
- href: information-protection/personal-data-encryption/pde-in-intune/intune-disable-password-connected-standby.md
- - name: Configure S/MIME for Windows
- href: identity-protection/configure-s-mime.md
- - name: Network security
- items:
- - name: VPN technical guide
- href: identity-protection/vpn/vpn-guide.md
- items:
- - name: VPN connection types
- href: identity-protection/vpn/vpn-connection-type.md
- - name: VPN routing decisions
- href: identity-protection/vpn/vpn-routing.md
- - name: VPN authentication options
- href: identity-protection/vpn/vpn-authentication.md
- - name: VPN and conditional access
- href: identity-protection/vpn/vpn-conditional-access.md
- - name: VPN name resolution
- href: identity-protection/vpn/vpn-name-resolution.md
- - name: VPN auto-triggered profile options
- href: identity-protection/vpn/vpn-auto-trigger-profile.md
- - name: VPN security features
- href: identity-protection/vpn/vpn-security-features.md
- - name: VPN profile options
- href: identity-protection/vpn/vpn-profile-options.md
- - name: How to configure Diffie Hellman protocol over IKEv2 VPN connections
- href: identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
- - name: How to use single sign-on (SSO) over VPN and Wi-Fi connections
- href: identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
- - name: Optimizing Office 365 traffic with the Windows VPN client
- href: identity-protection/vpn/vpn-office-365-optimization.md
- - name: Windows Defender Firewall
- href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
- - name: Windows security baselines
- href: threat-protection/windows-security-configuration-framework/windows-security-baselines.md
- items:
- - name: Security Compliance Toolkit
- href: threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md
- - name: Get support
- href: threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md
- - name: Guide to removing Microsoft Baseline Security Analyzer (MBSA)
- href: threat-protection/mbsa-removal-and-guidance.md
- - name: Virus & threat protection
- items:
- - name: Overview
- href: threat-protection/index.md
- - name: Microsoft Defender Antivirus
- href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows
- - name: Attack surface reduction rules
- href: /microsoft-365/security/defender-endpoint/attack-surface-reduction
- - name: Tamper protection
- href: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection
- - name: Network protection
- href: /microsoft-365/security/defender-endpoint/network-protection
- - name: Controlled folder access
- href: /microsoft-365/security/defender-endpoint/controlled-folders
- - name: Exploit protection
- href: /microsoft-365/security/defender-endpoint/exploit-protection
- - name: Microsoft Defender for Endpoint
- href: /microsoft-365/security/defender-endpoint
- - name: More Windows security
- items:
- - name: Override Process Mitigation Options to help enforce app-related security policies
- href: threat-protection/override-mitigation-options-for-app-related-security-policies.md
- - name: Use Windows Event Forwarding to help with intrusion detection
- href: threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
- - name: Block untrusted fonts in an enterprise
- href: threat-protection/block-untrusted-fonts-in-enterprise.md
- - name: Windows Information Protection (WIP)
- href: information-protection/windows-information-protection/protect-enterprise-data-using-wip.md
- items:
- - name: Create a WIP policy using Microsoft Intune
- href: information-protection/windows-information-protection/overview-create-wip-policy.md
- items:
- - name: Create a WIP policy in Microsoft Intune
- href: information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
- items:
- - name: Deploy your WIP policy in Microsoft Intune
- href: information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
- - name: Associate and deploy a VPN policy for WIP in Microsoft Intune
- href: information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
- - name: Create and verify an EFS Data Recovery Agent (DRA) certificate
- href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
- - name: Determine the enterprise context of an app running in WIP
- href: information-protection/windows-information-protection/wip-app-enterprise-context.md
- - name: Create a WIP policy using Microsoft Configuration Manager
- href: information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md
- items:
- - name: Create and deploy a WIP policy in Configuration Manager
- href: information-protection/windows-information-protection/create-wip-policy-using-configmgr.md
- - name: Create and verify an EFS Data Recovery Agent (DRA) certificate
- href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
- - name: Determine the enterprise context of an app running in WIP
- href: information-protection/windows-information-protection/wip-app-enterprise-context.md
- - name: Mandatory tasks and settings required to turn on WIP
- href: information-protection/windows-information-protection/mandatory-settings-for-wip.md
- - name: Testing scenarios for WIP
- href: information-protection/windows-information-protection/testing-scenarios-for-wip.md
- - name: Limitations while using WIP
- href: information-protection/windows-information-protection/limitations-with-wip.md
- - name: How to collect WIP audit event logs
- href: information-protection/windows-information-protection/collect-wip-audit-event-logs.md
- - name: General guidance and best practices for WIP
- href: information-protection/windows-information-protection/guidance-and-best-practices-wip.md
- items:
- - name: Enlightened apps for use with WIP
- href: information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
- - name: Unenlightened and enlightened app behavior while using WIP
- href: information-protection/windows-information-protection/app-behavior-with-wip.md
- - name: Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP
- href: information-protection/windows-information-protection/recommended-network-definitions-for-wip.md
- - name: Using Outlook Web Access with WIP
- href: information-protection/windows-information-protection/using-owa-with-wip.md
- - name: Fine-tune WIP Learning
- href: information-protection/windows-information-protection/wip-learning.md
- - name: Disable WIP
- href: information-protection/windows-information-protection/how-to-disable-wip.md
+ href: operating-system-security/toc.yml
- name: Application security
- items:
- - name: Overview
- href: apps.md
- - name: Windows Defender Application Control and virtualization-based protection of code integrity
- href: threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
- - name: Windows Defender Application Control
- href: threat-protection\windows-defender-application-control\windows-defender-application-control.md
- - name: Microsoft Defender Application Guard
- href: threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md
- - name: Windows Sandbox
- href: threat-protection/windows-sandbox/windows-sandbox-overview.md
- items:
- - name: Windows Sandbox architecture
- href: threat-protection/windows-sandbox/windows-sandbox-architecture.md
- - name: Windows Sandbox configuration
- href: threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
- - name: Microsoft Defender SmartScreen overview
- href: threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
- items:
- - name: Enhanced Phishing Protection in Microsoft Defender SmartScreen
- href: threat-protection\microsoft-defender-smartscreen\phishing-protection-microsoft-defender-smartscreen.md
- - name: Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings
- href: threat-protection\microsoft-defender-smartscreen\microsoft-defender-smartscreen-available-settings.md
- - name: Configure S/MIME for Windows
- href: identity-protection\configure-s-mime.md
- - name: Windows Credential Theft Mitigation Guide Abstract
- href: identity-protection\windows-credential-theft-mitigation-guide-abstract.md
-- name: User security and secured identity
- items:
- - name: Overview
- href: identity.md
- - name: Windows credential theft mitigation guide
- href: identity-protection/windows-credential-theft-mitigation-guide-abstract.md
- - name: Passwordless
- items:
- - name: Windows Hello for Business ⇒
- href: identity-protection/hello-for-business/index.yml
- - name: FIDO 2 security keys
- href: /azure/active-directory/authentication/howto-authentication-passwordless-security-key?context=/windows/security/context/context
- - name: Local Administrator Password Solution (LAPS)
- href: /windows-server/identity/laps/laps-overview?context=/windows/security/context/context
- - name: Enterprise Certificate Pinning
- href: identity-protection/enterprise-certificate-pinning.md
- - name: Credential Guard
- items:
- - name: Protect derived domain credentials with Credential Guard
- href: identity-protection/credential-guard/credential-guard.md
- - name: How Credential Guard works
- href: identity-protection/credential-guard/credential-guard-how-it-works.md
- - name: Requirements
- href: identity-protection/credential-guard/credential-guard-requirements.md
- - name: Manage Credential Guard
- href: identity-protection/credential-guard/credential-guard-manage.md
- - name: Credential Guard protection limits
- href: identity-protection/credential-guard/credential-guard-protection-limits.md
- - name: Considerations when using Credential Guard
- href: identity-protection/credential-guard/credential-guard-considerations.md
- - name: Additional mitigations
- href: identity-protection/credential-guard/additional-mitigations.md
- - name: Known issues
- href: identity-protection/credential-guard/credential-guard-known-issues.md
- - name: Remote Credential Guard
- href: identity-protection/remote-credential-guard.md
- - name: Configuring LSA Protection
- href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json
- - name: Technical support policy for lost or forgotten passwords
- href: identity-protection/password-support-policy.md
- - name: Access Control
- items:
- - name: Overview
- href: identity-protection/access-control/access-control.md
- - name: Local Accounts
- href: identity-protection/access-control/local-accounts.md
- - name: User Account Control (UAC)
- items:
- - name: Overview
- href: identity-protection/user-account-control/user-account-control-overview.md
- - name: How User Account Control works
- href: identity-protection/user-account-control/how-user-account-control-works.md
- - name: User Account Control security policy settings
- href: identity-protection/user-account-control/user-account-control-security-policy-settings.md
- - name: User Account Control Group Policy and registry key settings
- href: identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
- - name: Smart Cards
- href: identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md
- items:
- - name: How Smart Card Sign-in Works in Windows
- href: identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
- items:
- - name: Smart Card Architecture
- href: identity-protection/smart-cards/smart-card-architecture.md
- - name: Certificate Requirements and Enumeration
- href: identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md
- - name: Smart Card and Remote Desktop Services
- href: identity-protection/smart-cards/smart-card-and-remote-desktop-services.md
- - name: Smart Cards for Windows Service
- href: identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md
- - name: Certificate Propagation Service
- href: identity-protection/smart-cards/smart-card-certificate-propagation-service.md
- - name: Smart Card Removal Policy Service
- href: identity-protection/smart-cards/smart-card-removal-policy-service.md
- - name: Smart Card Tools and Settings
- href: identity-protection/smart-cards/smart-card-tools-and-settings.md
- items:
- - name: Smart Cards Debugging Information
- href: identity-protection/smart-cards/smart-card-debugging-information.md
- - name: Smart Card Group Policy and Registry Settings
- href: identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md
- - name: Smart Card Events
- href: identity-protection/smart-cards/smart-card-events.md
- - name: Virtual smart cards
- href: identity-protection/virtual-smart-cards/virtual-smart-card-overview.md
- items:
- - name: Understand and evaluate virtual smart cards
- href: identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md
- items:
- - name: Get started with virtual smart cards
- href: identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md
- - name: Use virtual smart cards
- href: identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md
- - name: Deploy virtual smart cards
- href: identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md
- - name: Evaluate virtual smart card security
- href: identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md
- - name: Tpmvscmgr
- href: identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md
-- name: Cloud services
- items:
- - name: Overview
- href: cloud.md
- - name: Mobile device management
- href: /windows/client-management/mdm/
- - name: Windows 365 Cloud PCs
- href: /windows-365/overview
- - name: Azure Virtual Desktop
- href: /azure/virtual-desktop/
+ href: application-security/toc.yml
+- name: Identity protection
+ href: identity-protection/toc.yml
+- name: Windows Privacy 🔗
+ href: /windows/privacy
- name: Security foundations
- items:
- - name: Overview
- href: security-foundations.md
- - name: Microsoft Security Development Lifecycle
- href: threat-protection/msft-security-dev-lifecycle.md
- - name: FIPS 140-2 Validation
- href: threat-protection/fips-140-validation.md
- - name: Common Criteria Certifications
- href: threat-protection/windows-platform-common-criteria.md
-- name: Windows Privacy
- href: /windows/privacy/windows-10-and-privacy-compliance
+ href: security-foundations/toc.yml
+- name: Cloud security
+ href: cloud-security/toc.yml
\ No newline at end of file
diff --git a/windows/security/application-security/application-control/toc.yml b/windows/security/application-security/application-control/toc.yml
new file mode 100644
index 0000000000..5cea979d61
--- /dev/null
+++ b/windows/security/application-security/application-control/toc.yml
@@ -0,0 +1,17 @@
+items:
+- name: User Account Control (UAC)
+ items:
+ - name: Overview
+ href: ../../identity-protection/user-account-control/user-account-control-overview.md
+ - name: How User Account Control works
+ href: ../../identity-protection/user-account-control/how-user-account-control-works.md
+ - name: User Account Control security policy settings
+ href: ../../identity-protection/user-account-control/user-account-control-security-policy-settings.md
+ - name: User Account Control Group Policy and registry key settings
+ href: ../../identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
+- name: Windows Defender Application Control and virtualization-based protection of code integrity
+ href: ../../threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
+- name: Windows Defender Application Control
+ href: ../../threat-protection/windows-defender-application-control/windows-defender-application-control.md
+- name: Smart App Control
+ href: ../../threat-protection/windows-defender-application-control/windows-defender-application-control.md
\ No newline at end of file
diff --git a/windows/security/application-security/application-isolation/toc.yml b/windows/security/application-security/application-isolation/toc.yml
new file mode 100644
index 0000000000..8c17971749
--- /dev/null
+++ b/windows/security/application-security/application-isolation/toc.yml
@@ -0,0 +1,20 @@
+items:
+- name: Microsoft Defender Application Guard (MDAG)
+ href: ../../threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md
+- name: MDAG for Edge standalone mode
+ href: ../../threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
+- name: MDAG for Edge enterprise mode and enterprise management 🔗
+ href: /deployedge/microsoft-edge-security-windows-defender-application-guard
+- name: MDAG for Microsoft Office
+ href: https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46
+- name: MDAG configure via MDM 🔗
+ href: /windows/client-management/mdm/windowsdefenderapplicationguard-csp
+- name: Windows containers 🔗
+ href: /virtualization/windowscontainers/about
+- name: Windows Sandbox
+ href: ../../threat-protection/windows-sandbox/windows-sandbox-overview.md
+ items:
+ - name: Windows Sandbox architecture
+ href: ../../threat-protection/windows-sandbox/windows-sandbox-architecture.md
+ - name: Windows Sandbox configuration
+ href: ../../threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md
\ No newline at end of file
diff --git a/windows/security/application-security/toc.yml b/windows/security/application-security/toc.yml
new file mode 100644
index 0000000000..5e2bd70284
--- /dev/null
+++ b/windows/security/application-security/toc.yml
@@ -0,0 +1,8 @@
+items:
+- name: Overview
+ href: ../apps.md
+- name: Application Control
+ href: application-control/toc.yml
+- name: Application Isolation
+ href: application-isolation/toc.yml
+
diff --git a/windows/security/cloud-security/toc.yml b/windows/security/cloud-security/toc.yml
new file mode 100644
index 0000000000..a927cf5384
--- /dev/null
+++ b/windows/security/cloud-security/toc.yml
@@ -0,0 +1,18 @@
+items:
+- name: Overview
+ href: ../cloud.md
+- name: Join Active Directory and Azure AD with single sign-on (SSO) 🔗
+ href: /azure/active-directory/devices/concept-azure-ad-join
+- name: Security baselines with Intune 🔗
+ href: /mem/intune/protect/security-baselines
+- name: Remote wipe (Autopilot reset) 🔗
+ href: /windows/client-management/mdm/remotewipe-csp
+- name: Mobile Device Management (MDM) 🔗
+ href: /windows/client-management/mdm/
+- name: Universal Print 🔗
+ href: /universal-print
+- name: Windows Autopatch 🔗
+ href: /windows/deployment/windows-autopatch
+- name: Windows Autopilot 🔗
+ href: /windows/deployment/windows-autopilot
+
diff --git a/windows/security/hardware-security/toc.yml b/windows/security/hardware-security/toc.yml
new file mode 100644
index 0000000000..6cd5d10c39
--- /dev/null
+++ b/windows/security/hardware-security/toc.yml
@@ -0,0 +1,54 @@
+items:
+ - name: Overview
+ href: ../hardware.md
+ - name: Hardware root of trust
+ items:
+ - name: Windows Defender System Guard
+ href: ../threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md
+ - name: Trusted Platform Module
+ href: ../information-protection/tpm/trusted-platform-module-top-node.md
+ items:
+ - name: Trusted Platform Module overview
+ href: ../information-protection/tpm/trusted-platform-module-overview.md
+ - name: TPM fundamentals
+ href: ../information-protection/tpm/tpm-fundamentals.md
+ - name: How Windows uses the TPM
+ href: ../information-protection/tpm/how-windows-uses-the-tpm.md
+ - name: Manage TPM commands
+ href: ../information-protection/tpm/manage-tpm-commands.md
+ - name: Manager TPM Lockout
+ href: ../information-protection/tpm/manage-tpm-lockout.md
+ - name: Change the TPM password
+ href: ../information-protection/tpm/change-the-tpm-owner-password.md
+ - name: TPM Group Policy settings
+ href: ../information-protection/tpm/trusted-platform-module-services-group-policy-settings.md
+ - name: Back up the TPM recovery information to AD DS
+ href: ../information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md
+ - name: View status, clear, or troubleshoot the TPM
+ href: ../information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md
+ - name: Understanding PCR banks on TPM 2.0 devices
+ href: ../information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md
+ - name: TPM recommendations
+ href: ../information-protection/tpm/tpm-recommendations.md
+ - name: Microsoft Pluton security processor
+ items:
+ - name: Microsoft Pluton overview
+ href: ../information-protection/pluton/microsoft-pluton-security-processor.md
+ - name: Microsoft Pluton as TPM
+ href: ../information-protection/pluton/pluton-as-tpm.md
+ - name: Silicon assisted security
+ items:
+ - name: Virtualization-based security (VBS)
+ href: /windows-hardware/design/device-experiences/oem-vbs
+ - name: Memory integrity (HVCI)
+ href: ../threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md
+ - name: Memory integrity and VBS enablement 🔗
+ href: /windows-hardware/design/device-experiences/oem-hvci-enablement
+ - name: Hardware-enforced stack protection
+ href: https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815
+ - name: Secured-core PC 🔗
+ href: /windows-hardware/design/device-experiences/oem-highly-secure-11
+ - name: Kernel Direct Memory Access (DMA) protection
+ href: ../information-protection/kernel-dma-protection-for-thunderbolt.md
+ - name: System Guard Secure Launch
+ href: ../threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md
\ No newline at end of file
diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md
index 6bec9ee14c..b1ca0e2e0f 100644
--- a/windows/security/identity-protection/access-control/access-control.md
+++ b/windows/security/identity-protection/access-control/access-control.md
@@ -39,6 +39,8 @@ This content set contains:
- [Service Accounts](/windows-server/identity/ad-ds/manage/understand-service-accounts)
- [Active Directory Security Groups](/windows-server/identity/ad-ds/manage/understand-security-groups)
+[!INCLUDE [access-control-aclsscals](../../../../includes/licensing/access-control-aclsscals.md)]
+
## Practical applications
Administrators who use the supported version of Windows can refine the application and management of access control to objects and subjects to provide the following security:
diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md
index 317ef89a50..510e690593 100644
--- a/windows/security/identity-protection/configure-s-mime.md
+++ b/windows/security/identity-protection/configure-s-mime.md
@@ -20,6 +20,8 @@ Encrypted messages can be read only by recipients who have a certificate. If you
A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they're using an email client that supports S/MIME.
+[!INCLUDE [email-encryption-smime](../../../includes/licensing/email-encryption-smime.md)]
+
## Prerequisites
- [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can't use S/MIME signing and encryption with a personal account such as Outlook.com.
diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md
index ca9c7acd52..32967fd8b7 100644
--- a/windows/security/identity-protection/credential-guard/additional-mitigations.md
+++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md
@@ -18,7 +18,6 @@ Credential theft attacks allow the attacker to steal secrets from one device and
Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks.
**To enable Kerberos armoring for restricting domain users to specific domain-joined devices**
-
- Users need to be in domains that are running Windows Server 2012 R2 or higher
- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**.
- All the devices with Windows Defender Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**.
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
index ea7bf02bae..2afb9f4a6a 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
@@ -66,6 +66,8 @@ Applications may cause performance issues when they attempt to hook the isolated
Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard.
+[!INCLUDE [windows-defender-credential-guard](../../../../includes/licensing/windows-defender-credential-guard.md)]
+
## Security considerations
All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard.
@@ -96,7 +98,7 @@ The following tables describe baseline protections, plus protections for improve
|Protections for Improved Security|Description|
|---|---|
|Hardware: **IOMMU** (input/output memory management unit)|**Requirement**: - VT-D or AMD Vi IOMMU **Security benefits**: - An IOMMU can enhance system resiliency against memory attacks. For more information, see [Advanced Configuration and Power Interface (ACPI) description tables](/windows-hardware/drivers/bringup/acpi-system-description-tables)|
-|Firmware: **Securing Boot Configuration and Management**|**Requirements**: - BIOS password or stronger authentication must be supported. - In the BIOS configuration, BIOS authentication must be set. - There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system. - In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.|
+|Firmware: **Securing Boot Configuration and Management**|**Requirements**: - BIOS password or stronger authentication must be supported. - In the BIOS configuration, BIOS authentication must be set. - There must be support for protected BIOS option to configure list of permitted boot devices (for example, "Boot only from internal hard drive") and boot device order, overriding BOOTORDER modification made by operating system. - In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.|
|Firmware: **Secure MOR, revision 2 implementation**|**Requirement**: - Secure MOR, revision 2 implementation|
### 2016 Additional security qualifications starting with Windows 10, version 1607, and Windows Server 2016
diff --git a/windows/security/identity-protection/credential-guard/toc.yml b/windows/security/identity-protection/credential-guard/toc.yml
new file mode 100644
index 0000000000..3661af7b0e
--- /dev/null
+++ b/windows/security/identity-protection/credential-guard/toc.yml
@@ -0,0 +1,17 @@
+items:
+- name: Protect derived domain credentials with Credential Guard
+ href: credential-guard.md
+- name: How Credential Guard works
+ href: credential-guard-how-it-works.md
+- name: Requirements
+ href: credential-guard-requirements.md
+- name: Manage Credential Guard
+ href: credential-guard-manage.md
+- name: Credential Guard protection limits
+ href: credential-guard-protection-limits.md
+- name: Considerations when using Credential Guard
+ href: credential-guard-considerations.md
+- name: Additional mitigations
+ href: additional-mitigations.md
+- name: Known issues
+ href: credential-guard-known-issues.md
\ No newline at end of file
diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md
index c4e5d43423..cf9c8484b0 100644
--- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md
+++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md
@@ -29,6 +29,9 @@ The policy setting has three components:
## Configure unlock factors
+> [!CAUTION]
+> On Windows 11, when the [DontDisplayLastUserName](/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name) security policy is enabled, it is known to interfere with the ability to use multi factor unlock.
+
The **First unlock factor credential providers** and **Second unlock factor credential providers** portion of the policy setting each contain a comma separated list of credential providers.
Supported credential providers include:
@@ -40,8 +43,8 @@ Supported credential providers include:
|Facial Recognition| `{8AF662BF-65A0-4D0A-A540-A338A999D36F}`|
|Trusted Signal
(Phone proximity, Network location) | `{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}`|
->[!NOTE]
->Multifactor unlock does not support third-party credential providers or credential providers not listed in the above table.
+> [!NOTE]
+> Multifactor unlock does not support third-party credential providers or credential providers not listed in the above table.
The default credential providers for the **First unlock factor credential provider** include:
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md
index 629d9c561e..934a3f70de 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md
@@ -139,7 +139,7 @@ To configure Windows Hello for Business using an *account protection* policy:
1. Under *Block Windows Hello for Business*, select **Disabled** and multiple policies become available
- These policies are optional to configure, but it's recommended to configure *Enable to use a Trusted Platform Module (TPM)* to **Yes**
- For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business)
-1. Under *Enable to certificate for on-premises resources*, select **Disabled** and multiple policies become available
+1. Under *Enable to certificate for on-premises resources*, select **YES**
1. Select **Next**
1. Optionally, add *scope tags* > **Next**
1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next**
@@ -195,4 +195,4 @@ The certificate authority validates the certificate was signed by the registrati
[MEM-3]: /mem/intune/configuration/custom-settings-configure
[MEM-4]: /windows/client-management/mdm/passportforwork-csp
[MEM-5]: /mem/intune/protect/endpoint-security-account-protection-policy
-[MEM-6]: /mem/intune/protect/identity-protection-configure
\ No newline at end of file
+[MEM-6]: /mem/intune/protect/identity-protection-configure
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md
index 1367cb8301..9cd071eac6 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md
@@ -67,7 +67,7 @@ To configure Windows Hello for Business using an account protection policy:
1. Under **Block Windows Hello for Business**, select **Disabled** and multiple policies become available.
- These policies are optional to configure, but it's recommended to configure **Enable to use a Trusted Platform Module (TPM)** to **Yes**.
- For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business).
-1. Under **Enable to certificate for on-premises resources**, select **Disabled** and multiple policies become available.
+1. Under **Enable to certificate for on-premises resources**, select **Not configured**
1. Select **Next**.
1. Optionally, add **scope tags** and select **Next**.
1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next**.
@@ -138,7 +138,7 @@ You can configure Windows Hello for Business cloud Kerberos trust using a Group
---
> [!IMPORTANT]
-> If the **Use certificate for on-premises authentication** policy is enabled, certificate trust will take precedence over cloud Kerberos trust. Ensure that the machines that you want to enable cloud Kerberos trust have this policy **not configured** or **disabled**.
+> If the **Use certificate for on-premises authentication** policy is enabled, certificate trust will take precedence over cloud Kerberos trust. Ensure that the machines that you want to enable cloud Kerberos trust have this policy **not configured**.
## Provision Windows Hello for Business
diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md
index 005fb6c685..84acf6b19c 100644
--- a/windows/security/identity-protection/hello-for-business/hello-overview.md
+++ b/windows/security/identity-protection/hello-for-business/hello-overview.md
@@ -1,11 +1,11 @@
---
-title: Windows Hello for Business Overview (Windows)
-description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices in Windows 10 and Windows 11.
+title: Windows Hello for Business Overview
+description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices.
ms.collection:
- highpri
- tier1
ms.topic: conceptual
-ms.date: 12/31/2017
+ms.date: 04/24/2023
---
# Windows Hello for Business Overview
@@ -65,6 +65,8 @@ Imagine that someone is looking over your shoulder as you get money from an ATM
Windows Hello helps protect user identities and user credentials. Because the user doesn't enter a password (except during provisioning), it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Windows Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs.
+[!INCLUDE [windows-hello-for-business](../../../../includes/licensing/windows-hello-for-business.md)]
+
## How Windows Hello for Business works: key points
- Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device.
diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md
index 64e9869d2a..c492d78079 100644
--- a/windows/security/identity-protection/remote-credential-guard.md
+++ b/windows/security/identity-protection/remote-credential-guard.md
@@ -20,9 +20,7 @@ Introduced in Windows 10, version 1607, Windows Defender Remote Credential Guard
Administrator credentials are highly privileged and must be protected. By using Windows Defender Remote Credential Guard to connect during Remote Desktop sessions, if the target device is compromised, your credentials are not exposed because both credential and credential derivatives are never passed over the network to the target device.
> [!IMPORTANT]
-> For information on Remote Desktop connection scenarios involving helpdesk support, see [Remote Desktop connections and helpdesk support scenarios](#helpdesk) in this article.
-
-
+> For information on Remote Desktop connection scenarios involving helpdesk support, see [Remote Desktop connections and helpdesk support scenarios](#remote-desktop-connections-and-helpdesk-support-scenarios) in this article.
## Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options
@@ -30,43 +28,28 @@ The following diagram helps you to understand how a standard Remote Desktop sess
-
-
The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) option:
-
As illustrated, Windows Defender Remote Credential Guard blocks NTLM (allowing only Kerberos), prevents Pass-the-Hash (PtH) attacks, and also prevents use of credentials after disconnection.
-
-
Use the following table to compare different Remote Desktop connection security options:
-
-
-
-
| Feature | Remote Desktop | Windows Defender Remote Credential Guard | Restricted Admin mode |
-|--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the "domain user". Any attack is local to the server |
-| **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.
For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](/security-updates/SecurityAdvisories/2016/2871997). |
-| **Helps prevent** | N/A | - Pass-the-Hash
- Use of a credential after disconnection
| - Pass-the-Hash
- Use of domain identity during connection
|
-| **Credentials supported from the remote desktop client device** | - Signed on credentials
- Supplied credentials
- Saved credentials
| - Signed on credentials only |
- Signed on credentials
- Supplied credentials
- Saved credentials
|
-| **Access** | **Users allowed**, that is, members of Remote Desktop Users group of remote host. | **Users allowed**, that is, members of Remote Desktop Users of remote host. | **Administrators only**, that is, only members of Administrators group of remote host. |
-| **Network identity** | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as remote host's identity**. |
-| **Multi-hop** | From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**. | Not allowed for user as the session is running as a local host account |
-| **Supported authentication** | Any negotiable protocol. | Kerberos only. | Any negotiable protocol |
-
-
+|--|--|--|--|
+| **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the "domain user". Any attack is local to the server |
+| **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.
For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](/security-updates/SecurityAdvisories/2016/2871997). |
+| **Helps prevent** | N/A | - Pass-the-Hash
- Use of a credential after disconnection
| - Pass-the-Hash
- Use of domain identity during connection
|
+| **Credentials supported from the remote desktop client device** | - Signed on credentials
- Supplied credentials
- Saved credentials
| - Signed on credentials only |
- Signed on credentials
- Supplied credentials
- Saved credentials
|
+| **Access** | **Users allowed**, that is, members of Remote Desktop Users group of remote host. | **Users allowed**, that is, members of Remote Desktop Users of remote host. | **Administrators only**, that is, only members of Administrators group of remote host. |
+| **Network identity** | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as remote host's identity**. |
+| **Multi-hop** | From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**. | Not allowed for user as the session is running as a local host account |
+| **Supported authentication** | Any negotiable protocol. | Kerberos only. | Any negotiable protocol |
For further technical information, see [Remote Desktop Protocol](/windows/win32/termserv/remote-desktop-protocol)
and [How Kerberos works](/previous-versions/windows/it-pro/windows-2000-server/cc961963(v=technet.10)).
-
-
-
-
## Remote Desktop connections and helpdesk support scenarios
For helpdesk support scenarios in which personnel require administrative access to provide remote assistance to computer users via Remote Desktop sessions, Microsoft recommends that Windows Defender Remote Credential Guard should not be used in that context. This is because if an RDP session is initiated to a compromised client that an attacker already controls, the attacker could use that open channel to create sessions on the user's behalf (without compromising credentials) to access any of the user's resources for a limited time (a few hours) after the session disconnects.
@@ -77,8 +60,7 @@ To further harden security, we also recommend that you implement Local Administr
For further information on LAPS, see [Microsoft Security Advisory 3062591](https://technet.microsoft.com/library/security/3062591.aspx).
-
-
+[!INCLUDE [windows-defender-remote-credential-guard](../../../includes/licensing/windows-defender-remote-credential-guard.md)]
## Remote Credential Guard requirements
@@ -86,20 +68,17 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r
The Remote Desktop client device:
-- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine.
-
-- Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user's signed-in credentials. This requires the user's account be able to sign in to both the client device and the remote host.
-
-- Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard.
-
-- Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk.
+- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine
+- Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user's signed-in credentials. This requires the user's account be able to sign in to both the client device and the remote host
+- Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard
+- Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk
The Remote Desktop remote host:
-- Must be running at least Windows 10, version 1607 or Windows Server 2016.
-- Must allow Restricted Admin connections.
-- Must allow the client's domain user to access Remote Desktop connections.
-- Must allow delegation of non-exportable credentials.
+- Must be running at least Windows 10, version 1607 or Windows Server 2016.
+- Must allow Restricted Admin connections.
+- Must allow the client's domain user to access Remote Desktop connections.
+- Must allow delegation of non-exportable credentials.
There are no hardware requirements for Windows Defender Remote Credential Guard.
@@ -109,31 +88,26 @@ There are no hardware requirements for Windows Defender Remote Credential Guard.
> GPO [Remote host allows delegation of non-exportable credentials](/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials.
- For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication.
-
- The remote host must be running at least Windows 10 version 1607, or Windows Server 2016.
-
- The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Windows Defender Remote Credential Guard.
## Enable Windows Defender Remote Credential Guard
You must enable Restricted Admin or Windows Defender Remote Credential Guard on the remote host by using the Registry.
-1. Open Registry Editor on the remote host.
+1. Open Registry Editor on the remote host
+1. Enable Restricted Admin and Windows Defender Remote Credential Guard:
-2. Enable Restricted Admin and Windows Defender Remote Credential Guard:
+ - Go to `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa`
+ - Add a new DWORD value named **DisableRestrictedAdmin**
+ - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0
- - Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa.
-
- - Add a new DWORD value named **DisableRestrictedAdmin**.
-
- - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0.
-
-3. Close Registry Editor.
+1. Close Registry Editor
You can add this by running the following command from an elevated command prompt:
-```console
-reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD
+```cmd
+reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD
```
## Using Windows Defender Remote Credential Guard
@@ -142,36 +116,28 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C
### Turn on Windows Defender Remote Credential Guard by using Group Policy
-1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Credentials Delegation**.
-
-2. Double-click **Restrict delegation of credentials to remote servers**.
-
+1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Credentials Delegation**
+1. Double-click **Restrict delegation of credentials to remote servers**
-
-3. Under **Use the following restricted mode**:
-
- - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used.
+1. Under **Use the following restricted mode**:
+ - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used
> [!NOTE]
> Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server.
- > When **Restrict Credential Delegation** is enabled, the /restrictedAdmin switch will be ignored. Windows will enforce the policy configuration instead and will use Windows Defender Remote Credential Guard.
+ > When **Restrict Credential Delegation** is enabled, the /restrictedAdmin switch will be ignored. Windows will enforce the policy configuration instead and will use Windows Defender Remote Credential Guard.
- - If you want to require Windows Defender Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic.
-
- - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic.
-
-4. Click **OK**.
-
-5. Close the Group Policy Management Console.
-
-6. From a command prompt, run **gpupdate.exe /force** to ensure that the Group Policy object is applied.
+ - If you want to require Windows Defender Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#remote-credential-guard-requirements) listed earlier in this topic.
+ - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-windows-defender-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic.
+1. Click **OK**
+1. Close the Group Policy Management Console
+1. From a command prompt, run **gpupdate.exe /force** to ensure that the Group Policy object is applied
### Use Windows Defender Remote Credential Guard with a parameter to Remote Desktop Connection
If you don't use Group Policy in your organization, or if not all your remote hosts support Remote Credential Guard, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Windows Defender Remote Credential Guard for that connection.
-```console
+```cmd
mstsc.exe /remoteGuard
```
@@ -180,12 +146,8 @@ mstsc.exe /remoteGuard
## Considerations when using Windows Defender Remote Credential Guard
-- Windows Defender Remote Credential Guard does not support compound authentication. For example, if you're trying to access a file server from a remote host that requires a device claim, access will be denied.
-
-- Windows Defender Remote Credential Guard can be used only when connecting to a device that is joined to a Windows Server Active Directory domain, including AD domain-joined servers that run as Azure virtual machines (VMs). Windows Defender Remote Credential Guard cannot be used when connecting to remote devices joined to Azure Active Directory.
-
-- Remote Desktop Credential Guard only works with the RDP protocol.
-
-- No credentials are sent to the target device, but the target device still acquires Kerberos Service Tickets on its own.
-
-- The server and client must authenticate using Kerberos.
+- Windows Defender Remote Credential Guard does not support compound authentication. For example, if you're trying to access a file server from a remote host that requires a device claim, access will be denied
+- Windows Defender Remote Credential Guard can be used only when connecting to a device that is joined to a Windows Server Active Directory domain, including AD domain-joined servers that run as Azure virtual machines (VMs). Windows Defender Remote Credential Guard cannot be used when connecting to remote devices joined to Azure Active Directory
+- Remote Desktop Credential Guard only works with the RDP protocol
+- No credentials are sent to the target device, but the target device still acquires Kerberos Service Tickets on its own
+- The server and client must authenticate using Kerberos
diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
index a44e2533fc..5d498cb152 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md
@@ -21,3 +21,5 @@ This topic for IT professional provides links to resources about the implementat
- [Certificate Propagation Service](smart-card-certificate-propagation-service.md): Learn about how the certificate propagation service works when a smart card is inserted into a computer.
- [Smart Card Removal Policy Service](smart-card-removal-policy-service.md): Learn about using Group Policy to control what happens when a user removes a smart card.
+
+[!INCLUDE [smart-cards-for-windows-service](../../../../includes/licensing/smart-cards-for-windows-service.md)]
\ No newline at end of file
diff --git a/windows/security/identity-protection/smart-cards/toc.yml b/windows/security/identity-protection/smart-cards/toc.yml
new file mode 100644
index 0000000000..0d82f8c3a7
--- /dev/null
+++ b/windows/security/identity-protection/smart-cards/toc.yml
@@ -0,0 +1,28 @@
+items:
+- name: Smart Card Technical Reference
+ href: smart-card-windows-smart-card-technical-reference.md
+ items:
+ - name: How Smart Card Sign-in Works in Windows
+ href: smart-card-how-smart-card-sign-in-works-in-windows.md
+ items:
+ - name: Smart Card Architecture
+ href: smart-card-architecture.md
+ - name: Certificate Requirements and Enumeration
+ href: smart-card-certificate-requirements-and-enumeration.md
+ - name: Smart Card and Remote Desktop Services
+ href: smart-card-and-remote-desktop-services.md
+ - name: Smart Cards for Windows Service
+ href: smart-card-smart-cards-for-windows-service.md
+ - name: Certificate Propagation Service
+ href: smart-card-certificate-propagation-service.md
+ - name: Smart Card Removal Policy Service
+ href: smart-card-removal-policy-service.md
+ - name: Smart Card Tools and Settings
+ href: smart-card-tools-and-settings.md
+ items:
+ - name: Smart Cards Debugging Information
+ href: smart-card-debugging-information.md
+ - name: Smart Card Group Policy and Registry Settings
+ href: smart-card-group-policy-and-registry-settings.md
+ - name: Smart Card Events
+ href: smart-card-events.md
\ No newline at end of file
diff --git a/windows/security/identity-protection/toc.yml b/windows/security/identity-protection/toc.yml
new file mode 100644
index 0000000000..c90f5b2316
--- /dev/null
+++ b/windows/security/identity-protection/toc.yml
@@ -0,0 +1,49 @@
+items:
+ - name: Overview
+ href: ../identity.md
+ - name: Windows credential theft mitigation guide
+ href: windows-credential-theft-mitigation-guide-abstract.md
+ - name: Passwordless sign-in
+ items:
+ - name: Windows Hello for Business 🔗
+ href: hello-for-business/index.yml
+ - name: Windows presence sensing
+ href: https://support.microsoft.com/windows/wake-your-windows-11-pc-when-you-approach-82285c93-440c-4e15-9081-c9e38c1290bb
+ - name: Windows Hello for Business Enhanced Security Sign-in (ESS) 🔗
+ href: /windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security
+ - name: FIDO 2 security key 🔗
+ href: /azure/active-directory/authentication/howto-authentication-passwordless-security-key
+ - name: Federated sign-in 🔗
+ href: /education/windows/federated-sign-in
+ - name: Smart Cards
+ href: smart-cards/toc.yml
+ - name: Virtual smart cards
+ href: virtual-smart-cards/toc.yml
+ displayName: VSC
+ - name: Enterprise Certificate Pinning
+ href: enterprise-certificate-pinning.md
+ - name: Advanced credential protection
+ items:
+ - name: Account Lockout Policy 🔗
+ href: ../threat-protection/security-policy-settings/account-lockout-policy.md
+ - name: Technical support policy for lost or forgotten passwords
+ href: password-support-policy.md
+ - name: Windows LAPS (Local Administrator Password Solution) 🔗
+ displayName: LAPS
+ href: /windows-server/identity/laps/laps-overview
+ - name: Enhanced Phishing Protection in Microsoft Defender SmartScreen
+ href: ../threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen.md
+ displayName: EPP
+ - name: Access Control
+ items:
+ - name: Overview
+ href: access-control/access-control.md
+ displayName: ACL
+ - name: Local Accounts
+ href: access-control/local-accounts.md
+ - name: Security policy settings 🔗
+ href: ../threat-protection/security-policy-settings/security-policy-settings.md
+ - name: Windows Defender Credential Guard
+ href: credential-guard/toc.yml
+ - name: Windows Defender Remote Credential Guard
+ href: remote-credential-guard.md
\ No newline at end of file
diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md
index e85aae3ab9..ad89a60ec7 100644
--- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md
+++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md
@@ -18,6 +18,8 @@ Other apps, especially those that were not specifically designed with security s
When an app needs to run with more than standard user rights, UAC allows users to run apps with their administrator token (with administrative groups and privileges) instead of their default, standard user access token. Users continue to operate in the standard user security context, while enabling certain apps to run with elevated privileges, if needed.
+[!INCLUDE [user-account-control-uac](../../../../includes/licensing/user-account-control-uac.md)]
+
## Practical applications
Admin Approval Mode in UAC helps prevent malware from silently installing without an administrator's knowledge. It also helps protect from inadvertent system-wide changes. Lastly, it can be used to enforce a higher level of compliance where administrators must actively consent or provide credentials for each administrative process.
diff --git a/windows/security/identity-protection/virtual-smart-cards/toc.yml b/windows/security/identity-protection/virtual-smart-cards/toc.yml
new file mode 100644
index 0000000000..68842b6001
--- /dev/null
+++ b/windows/security/identity-protection/virtual-smart-cards/toc.yml
@@ -0,0 +1,17 @@
+items:
+- name: Virtual Smart Card overview
+ href: virtual-smart-card-overview.md
+ items:
+ - name: Understand and evaluate virtual smart cards
+ href: virtual-smart-card-understanding-and-evaluating.md
+ items:
+ - name: Get started with virtual smart cards
+ href: virtual-smart-card-get-started.md
+ - name: Use virtual smart cards
+ href: virtual-smart-card-use-virtual-smart-cards.md
+ - name: Deploy virtual smart cards
+ href: virtual-smart-card-deploy-virtual-smart-cards.md
+ - name: Evaluate virtual smart card security
+ href: virtual-smart-card-evaluate-security.md
+ - name: Tpmvscmgr
+ href: virtual-smart-card-tpmvscmgr.md
\ No newline at end of file
diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md
index 15f788082b..8a775eea81 100644
--- a/windows/security/identity-protection/vpn/vpn-guide.md
+++ b/windows/security/identity-protection/vpn/vpn-guide.md
@@ -14,6 +14,8 @@ To create a Windows 10 VPN device configuration profile see: [Windows 10 and Win
> [!NOTE]
> This guide does not explain server deployment.
+[!INCLUDE [virtual-private-network-vpn](../../../../includes/licensing/virtual-private-network-vpn.md)]
+
## In this guide
| Article | Description |
diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md
index a3b7a72ca1..d6c02185e3 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-overview.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md
@@ -52,6 +52,8 @@ BitLocker control panel, and they're appropriate to be used for automated deploy
To find out what's new in BitLocker for Windows, such as support for the XTS-AES encryption algorithm, see [What's new in Windows 10, versions 1507 and 1511 for IT Pros: BitLocker](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker).
+[!INCLUDE [bitlocker](../../../../includes/licensing/bitlocker.md)]
+
## System requirements
BitLocker has the following hardware requirements:
diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md
index 4523cd4552..035d511240 100644
--- a/windows/security/information-protection/encrypted-hard-drive.md
+++ b/windows/security/information-protection/encrypted-hard-drive.md
@@ -48,6 +48,8 @@ Encrypted hard drives are supported natively in the operating system through the
If you're a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](/previous-versions/windows/hardware/design/dn653989(v=vs.85)).
+[!INCLUDE [encrypted-hard-drive](../../../includes/licensing/encrypted-hard-drive.md)]
+
## System Requirements
To use encrypted hard drives, the following system requirements apply:
diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md
deleted file mode 100644
index f84702dd1c..0000000000
--- a/windows/security/information-protection/index.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: Information protection (Windows 10)
-description: Learn more about how to protect sensitive data across your organization.
-ms.prod: windows-client
-author: paolomatarazzo
-ms.author: paoloma
-manager: aaroncz
-ms.topic: conceptual
-ms.date: 03/09/2023
-ms.technology: itpro-security
----
-
-# Information protection
-
-Learn more about how to secure documents and other data across your organization.
-
-| Section | Description |
-|-|-|
-| [BitLocker](bitlocker/bitlocker-overview.md)| Provides information about BitLocker, which is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. |
-| [Encrypted Hard Drive](encrypted-hard-drive.md)| Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. |
-| [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to PCI accessible ports, such as Thunderbolt™ 3 ports. |
-| [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection/protect-enterprise-data-using-wip.md)|Provides info about how to create a Windows Information Protection policy that can help protect against potential corporate data leakage.|
-| [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)| Windows 10 supports features to help prevent rootkits and bootkits from loading during the startup process. |
-| [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. |
diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
index eb8db70020..f0503ef3a9 100644
--- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
+++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
@@ -41,6 +41,8 @@ When Kernel DMA Protection is enabled:
- Peripherals with DMA Remapping-compatible device drivers will be automatically enumerated and started
- Peripherals with DMA Remapping-incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or signs out of the system.
+[!INCLUDE [kernel-direct-memory-access-dma-protection](../../../includes/licensing/kernel-direct-memory-access-dma-protection.md)]
+
## System compatibility
Kernel DMA Protection requires UEFI firmware support, and Virtualization-based Security (VBS) isn't required.
diff --git a/windows/security/information-protection/personal-data-encryption/overview-pde.md b/windows/security/information-protection/personal-data-encryption/overview-pde.md
index a88c9d276a..c7efa3d342 100644
--- a/windows/security/information-protection/personal-data-encryption/overview-pde.md
+++ b/windows/security/information-protection/personal-data-encryption/overview-pde.md
@@ -23,6 +23,8 @@ ms.date: 03/13/2023
[!INCLUDE [Personal Data Encryption (PDE) description](includes/pde-description.md)]
+[!INCLUDE [personal-data-encryption-pde](../../../../includes/licensing/personal-data-encryption-pde.md)]
+
## Prerequisites
### Required
diff --git a/windows/security/information-protection/pluton/microsoft-pluton-security-processor.md b/windows/security/information-protection/pluton/microsoft-pluton-security-processor.md
index 5274334565..d2d8321257 100644
--- a/windows/security/information-protection/pluton/microsoft-pluton-security-processor.md
+++ b/windows/security/information-protection/pluton/microsoft-pluton-security-processor.md
@@ -18,7 +18,7 @@ ms.technology: itpro-security
Microsoft Pluton security processor is a chip-to-cloud security technology built with [Zero Trust](/security/zero-trust/zero-trust-overview) principles at the core. Microsoft Pluton provides hardware-based root of trust, secure identity, secure attestation, and cryptographic services. Pluton technology is a combination of a secure subsystem which is part of the System on Chip (SoC) and Microsoft authored software that runs on this integrated secure subsystem.
-Microsoft Pluton is currently available on devices with Ryzen 6000 and Qualcomm Snapdragon® 8cx Gen 3 series processors. Microsoft Pluton can be enabled on devices with Pluton capable processors running Windows 11, version 22H2.
+Microsoft Pluton is currently available on devices with Ryzen 6000 and Qualcomm Snapdragon® 8cx Gen 3 series processors. Microsoft Pluton can be enabled on devices with Pluton capable processors running Windows 11, version 22H2.
## What is Microsoft Pluton?
@@ -46,6 +46,8 @@ When the system boots, Pluton hardware initialization is performed by loading th
+[!INCLUDE [microsoft-pluton-security-processor](../../../../includes/licensing/microsoft-pluton-security-processor.md)]
+
## Related topics
[Microsoft Pluton as TPM](pluton-as-tpm.md)
diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md
index 2c2f23d5cb..d3a0a6e2b7 100644
--- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md
+++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md
@@ -50,6 +50,8 @@ Anti-malware software can use the boot measurements of the operating system star
The TPM has several Group Policy settings that might be useful in certain enterprise scenarios. For more info, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md).
+[!INCLUDE [trusted-platform-module-tpm-20](../../../../includes/licensing/trusted-platform-module-tpm-20.md)]
+
## New and changed functionality
For more info on new and changed functionality for Trusted Platform Module in Windows, see [What's new in Trusted Platform Module?](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module)
diff --git a/windows/security/introduction/index.md b/windows/security/introduction/index.md
new file mode 100644
index 0000000000..f051acac9f
--- /dev/null
+++ b/windows/security/introduction/index.md
@@ -0,0 +1,57 @@
+---
+title: Introduction to Windows security
+description: System security book.
+ms.date: 04/24/2023
+ms.topic: tutorial
+ms.author: paoloma
+ms.custom: ai-gen-docs
+author: paolomatarazzo
+appliesto:
+ - ✅ Windows 11
+---
+
+# Introduction to Windows security
+
+The acceleration of digital transformation and the expansion of both remote and hybrid work brings new opportunities to organizations, communities, and individuals. This expansion introduces new threats and risks.
+
+Organizations worldwide are adopting a **Zero Trust** security model based on the premise that no person or device anywhere can have access until safety and integrity is proven. Windows 11 is built on Zero Trust principles to enable hybrid productivity and new experiences anywhere, without compromising security. Windows 11 raises the [security baselines](../threat-protection/windows-security-configuration-framework/windows-security-baselines.md) with new requirements for advanced hardware and software protection that extends from chip to cloud.
+
+## How Windows 11 enables Zero Trust protection
+
+A Zero Trust security model gives the right people the right access at the right time. Zero Trust security is based on three principles:
+
+1. Reduce risk by explicitly verifying data points such as user identity, location, and device health for every access request, without exception
+1. When verified, give people and devices access to only necessary resources for the necessary amount of time
+1. Use continuous analytics to drive threat detection and improve defenses
+
+For Windows 11, the Zero Trust principle of *verify explicitly* applies to risks introduced by both devices and people. Windows 11 provides *chip-to-cloud security*, enabling IT administrators to implement strong authorization and authentication processes with features like [Windows Hello for Business](../identity-protection/hello-for-business/hello-overview.md). IT administrators also gain attestation and measurements for determining if a device meets requirements and can be trusted. Windows 11 works out-of-the-box with Microsoft Intune and Azure Active Directory, which enable timely and seamless access decisions. Furthermore, IT administrators can easily customize Windows to meet specific user and policy requirements for access, privacy, compliance, and more.
+
+### Security, by default
+
+Windows 11 is a natural evolution of its predecessor, Windows 10. We have collaborated with our manufacturer and silicon partners to incorporate extra hardware security measures that address the increasingly complex security threats of today. These measures not only enable the hybrid work and learning that many organizations now embrace but also help bolster our already strong foundation and resilience against attacks.
+
+### Enhanced hardware and operating system security
+
+With hardware-based isolation security that begins at the chip, Windows 11 stores sensitive data behind other barriers separated from the operating system. As a result, information including encryption keys and user credentials are protected from unauthorized access and tampering.
+
+In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](../trusted-boot.md) built-in and enabled by default to contain and limit malware exploits.
+
+### Robust application security and privacy controls
+
+To help keep personal and business information protected and private, Windows 11 has multiple layers of application security that safeguard critical data and code integrity. Application isolation and controls, code integrity, privacy controls, and least-privilege principles enable developers to build in security and privacy from the ground up. This integrated security protects against breaches and malware, helps keep data private, and gives IT administrators the controls they need.
+
+In Windows 11, [Microsoft Defender Application Guard](/windows-hardware/design/device-experiences/oem-app-guard) uses Hyper-V virtualization technology to isolate untrusted websites and Microsoft Office files in containers, separate from and unable to access the host operating system and enterprise data. To protect privacy, Windows 11 also provides more controls over which apps and features can collect and use data such as the device's location, or access resources like camera and microphone.
+
+### Secured identities
+
+Passwords have been an important part of digital security for a long time, and they're also a top target for cybercriminals. Windows 11 provides powerful protection against credential theft with chip-level hardware security. Credentials are protected by layers of hardware and software security such as [TPM 2.0](../information-protection/tpm/trusted-platform-module-overview.md), [VBS](/windows-hardware/design/device-experiences/oem-vbs), and/or [Windows Defender Credential Guard](../identity-protection/credential-guard/credential-guard.md), making it harder for attackers to steal credentials from a device. With [Windows Hello for Business](../identity-protection/hello-for-business/hello-overview.md), users can quickly sign in with face, fingerprint, or PIN for passwordless protection. Windows 11 also supports [FIDO2 security keys](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) for passwordless authentication.
+
+### Connecting to cloud services
+
+Microsoft offers comprehensive cloud services for identity, storage, and access management in addition to the tools needed to attest that Windows devices connecting to your network are trustworthy. You can also enforce compliance and conditional access with a modern device management (MDM) service such as Microsoft Intune, which works with Azure Active Directory and Microsoft Azure Attestation to control access to applications and data through the cloud.
+
+## Next steps
+
+To learn more about the security features included in Windows 11, download the [Windows 11 Security Book: Powerful security from chip to cloud](https://aka.ms/Windows11SecurityBook).
+
+[!INCLUDE [ai-disclaimer-generic](../../../includes/ai-disclaimer-generic.md)]
\ No newline at end of file
diff --git a/windows/security/introduction/security-features-edition-requirements.md b/windows/security/introduction/security-features-edition-requirements.md
new file mode 100644
index 0000000000..0cffb54f8f
--- /dev/null
+++ b/windows/security/introduction/security-features-edition-requirements.md
@@ -0,0 +1,26 @@
+---
+title: Windows security features and edition requirements
+description: Learn about Windows edition requirements for the feature included in Windows.
+ms.prod: windows-client
+author: paolomatarazzo
+ms.author: paoloma
+manager: aaroncz
+ms.collection:
+- tier3
+ms.topic: conceptual
+ms.date: 05/04/2023
+appliesto:
+- ✅ Windows 11
+ms.technology: itpro-security
+---
+
+# Windows security features and edition requirements
+
+This article lists the security features that are available in Windows, and the Windows editions that support them.
+
+> [!NOTE]
+> The **Windows edition** requirements listed in the following table may be different from the **licensing** requirements. If you're looking for licensing requirements, see [Windows security features and licensing requirements](security-features-licensing-requirements.md).
+
+[!INCLUDE [_edition-requirements](../../../includes/licensing/_edition-requirements.md)]
+
+For more information about Windows licensing, see [Windows Commercial Licensing overview](/windows/whats-new/windows-licensing).
diff --git a/windows/security/introduction/security-features-licensing-requirements.md b/windows/security/introduction/security-features-licensing-requirements.md
new file mode 100644
index 0000000000..df7e5bdcec
--- /dev/null
+++ b/windows/security/introduction/security-features-licensing-requirements.md
@@ -0,0 +1,26 @@
+---
+title: Windows security features and licensing requirements
+description: Learn about Windows features and licensing requirements for the feature included in Windows.
+ms.prod: windows-client
+author: paolomatarazzo
+ms.author: paoloma
+manager: aaroncz
+ms.collection:
+- tier3
+ms.topic: conceptual
+ms.date: 04/24/2023
+appliesto:
+- ✅ Windows 11
+ms.technology: itpro-security
+---
+
+# Windows security features and licensing requirements
+
+This article lists the security features that are available in Windows, and the licensing requirements to use them.
+
+> [!NOTE]
+> The **licensing** requirements listed in the following table may be different from the **Windows edition** requirements. If you're looking for Windows edition requirements, see [Windows security features and edition requirements](security-features-edition-requirements.md).
+
+[!INCLUDE [_licensing-requirements](../../../includes/licensing/_licensing-requirements.md)]
+
+For more information about Windows licensing, see [Windows Commercial Licensing overview](/windows/whats-new/windows-licensing).
diff --git a/windows/security/operating-system-security/data-protection/toc.yml b/windows/security/operating-system-security/data-protection/toc.yml
new file mode 100644
index 0000000000..56500215a0
--- /dev/null
+++ b/windows/security/operating-system-security/data-protection/toc.yml
@@ -0,0 +1,152 @@
+items:
+- name: Overview
+ href: ../../encryption-data-protection.md
+- name: BitLocker
+ href: ../../information-protection/bitlocker/bitlocker-overview.md
+ items:
+ - name: Overview of BitLocker Device Encryption in Windows
+ href: ../../information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md
+ - name: BitLocker frequently asked questions (FAQ)
+ href: ../../information-protection/bitlocker/bitlocker-frequently-asked-questions.yml
+ items:
+ - name: Overview and requirements
+ href: ../../information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml
+ - name: Upgrading
+ href: ../../information-protection/bitlocker/bitlocker-upgrading-faq.yml
+ - name: Deployment and administration
+ href: ../../information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml
+ - name: Key management
+ href: ../../information-protection/bitlocker/bitlocker-key-management-faq.yml
+ - name: BitLocker To Go
+ href: ../../information-protection/bitlocker/bitlocker-to-go-faq.yml
+ - name: Active Directory Domain Services
+ href: ../../information-protection/bitlocker/bitlocker-and-adds-faq.yml
+ - name: Security
+ href: ../../information-protection/bitlocker/bitlocker-security-faq.yml
+ - name: BitLocker Network Unlock
+ href: ../../information-protection/bitlocker/bitlocker-network-unlock-faq.yml
+ - name: General
+ href: ../../information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml
+ - name: "Prepare your organization for BitLocker: Planning and policies"
+ href: ../../information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
+ - name: BitLocker deployment comparison
+ href: ../../information-protection/bitlocker/bitlocker-deployment-comparison.md
+ - name: BitLocker basic deployment
+ href: ../../information-protection/bitlocker/bitlocker-basic-deployment.md
+ - name: Deploy BitLocker on Windows Server 2012 and later
+ href: ../../information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
+ - name: BitLocker management for enterprises
+ href: ../../information-protection/bitlocker/bitlocker-management-for-enterprises.md
+ - name: Enable Network Unlock with BitLocker
+ href: ../../information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
+ - name: Use BitLocker Drive Encryption Tools to manage BitLocker
+ href: ../../information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
+ - name: Use BitLocker Recovery Password Viewer
+ href: ../../information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
+ - name: BitLocker Group Policy settings
+ href: ../../information-protection/bitlocker/bitlocker-group-policy-settings.md
+ - name: BCD settings and BitLocker
+ href: ../../information-protection/bitlocker/bcd-settings-and-bitlocker.md
+ - name: BitLocker Recovery Guide
+ href: ../../information-protection/bitlocker/bitlocker-recovery-guide-plan.md
+ - name: BitLocker Countermeasures
+ href: ../../information-protection/bitlocker/bitlocker-countermeasures.md
+ - name: Protecting cluster shared volumes and storage area networks with BitLocker
+ href: ../../information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
+ - name: Troubleshoot BitLocker
+ items:
+ - name: Troubleshoot BitLocker
+ href: /troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting
+ - name: "BitLocker cannot encrypt a drive: known issues"
+ href: /troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-issues
+ - name: "Enforcing BitLocker policies by using Intune: known issues"
+ href: /troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues
+ - name: "BitLocker Network Unlock: known issues"
+ href: /troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues
+ - name: "BitLocker recovery: known issues"
+ href: /troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues
+ - name: "BitLocker configuration: known issues"
+ href: /troubleshoot/windows-client/windows-security/bitlocker-configuration-known-issues
+ - name: Troubleshoot BitLocker and TPM issues
+ items:
+ - name: "BitLocker cannot encrypt a drive: known TPM issues"
+ href: /troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-tpm-issues
+ - name: "BitLocker and TPM: other known issues"
+ href: /troubleshoot/windows-client/windows-security/bitlocker-and-tpm-other-known-issues
+ - name: Decode Measured Boot logs to track PCR changes
+ href: /troubleshoot/windows-client/windows-security/decode-measured-boot-logs-to-track-pcr-changes
+- name: Encrypted Hard Drive
+ href: ../../information-protection/encrypted-hard-drive.md
+- name: Personal Data Encryption (PDE)
+ items:
+ - name: Personal Data Encryption (PDE) overview
+ href: ../../information-protection/personal-data-encryption/overview-pde.md
+ - name: Personal Data Encryption (PDE) frequently asked questions (FAQ)
+ href: ../../information-protection/personal-data-encryption/faq-pde.yml
+ - name: Configure Personal Data Encryption (PDE) in Intune
+ items:
+ - name: Configure Personal Data Encryption (PDE) in Intune
+ href: ../../information-protection/personal-data-encryption/configure-pde-in-intune.md
+ - name: Enable Personal Data Encryption (PDE)
+ href: ../../information-protection/personal-data-encryption/pde-in-intune/intune-enable-pde.md
+ - name: Disable Winlogon automatic restart sign-on (ARSO) for PDE
+ href: ../../information-protection/personal-data-encryption/pde-in-intune/intune-disable-arso.md
+ - name: Disable kernel-mode crash dumps and live dumps for PDE
+ href: ../../information-protection/personal-data-encryption/pde-in-intune/intune-disable-memory-dumps.md
+ - name: Disable Windows Error Reporting (WER)/user-mode crash dumps for PDE
+ href: ../../information-protection/personal-data-encryption/pde-in-intune/intune-disable-wer.md
+ - name: Disable hibernation for PDE
+ href: ../../information-protection/personal-data-encryption/pde-in-intune/intune-disable-hibernation.md
+ - name: Disable allowing users to select when a password is required when resuming from connected standby for PDE
+ href: ../../information-protection/personal-data-encryption/pde-in-intune/intune-disable-password-connected-standby.md
+- name: Configure S/MIME for Windows
+ href: ../../identity-protection/configure-s-mime.md
+- name: Windows Information Protection (WIP)
+ href: ../../information-protection/windows-information-protection/protect-enterprise-data-using-wip.md
+ items:
+ - name: Create a WIP policy using Microsoft Intune
+ href: ../../information-protection/windows-information-protection/overview-create-wip-policy.md
+ items:
+ - name: Create a WIP policy in Microsoft Intune
+ href: ../../information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
+ items:
+ - name: Deploy your WIP policy in Microsoft Intune
+ href: ../../information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
+ - name: Associate and deploy a VPN policy for WIP in Microsoft Intune
+ href: ../../information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
+ - name: Create and verify an EFS Data Recovery Agent (DRA) certificate
+ href: ../../information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
+ - name: Determine the enterprise context of an app running in WIP
+ href: ../../information-protection/windows-information-protection/wip-app-enterprise-context.md
+ - name: Create a WIP policy using Microsoft Configuration Manager
+ href: ../../information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md
+ items:
+ - name: Create and deploy a WIP policy in Configuration Manager
+ href: ../../information-protection/windows-information-protection/create-wip-policy-using-configmgr.md
+ - name: Create and verify an EFS Data Recovery Agent (DRA) certificate
+ href: ../../information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
+ - name: Determine the enterprise context of an app running in WIP
+ href: ../../information-protection/windows-information-protection/wip-app-enterprise-context.md
+ - name: Mandatory tasks and settings required to turn on WIP
+ href: ../../information-protection/windows-information-protection/mandatory-settings-for-wip.md
+ - name: Testing scenarios for WIP
+ href: ../../information-protection/windows-information-protection/testing-scenarios-for-wip.md
+ - name: Limitations while using WIP
+ href: ../../information-protection/windows-information-protection/limitations-with-wip.md
+ - name: How to collect WIP audit event logs
+ href: ../../information-protection/windows-information-protection/collect-wip-audit-event-logs.md
+ - name: General guidance and best practices for WIP
+ href: ../../information-protection/windows-information-protection/guidance-and-best-practices-wip.md
+ items:
+ - name: Enlightened apps for use with WIP
+ href: ../../information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
+ - name: Unenlightened and enlightened app behavior while using WIP
+ href: ../../information-protection/windows-information-protection/app-behavior-with-wip.md
+ - name: Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP
+ href: ../../information-protection/windows-information-protection/recommended-network-definitions-for-wip.md
+ - name: Using Outlook Web Access with WIP
+ href: ../../information-protection/windows-information-protection/using-owa-with-wip.md
+ - name: Fine-tune WIP Learning
+ href: ../../information-protection/windows-information-protection/wip-learning.md
+ - name: Disable WIP
+ href: ../../information-protection/windows-information-protection/how-to-disable-wip.md
\ No newline at end of file
diff --git a/windows/security/operating-system-security/device-management/toc.yml b/windows/security/operating-system-security/device-management/toc.yml
new file mode 100644
index 0000000000..239b2eb2a6
--- /dev/null
+++ b/windows/security/operating-system-security/device-management/toc.yml
@@ -0,0 +1,26 @@
+items:
+ - name: Security policy settings
+ href: ../../threat-protection/security-policy-settings/security-policy-settings.md
+ - name: Security auditing
+ href: ../../threat-protection/auditing/security-auditing-overview.md
+ - name: Secured-core configuration lock
+ href: /windows/client-management/config-lock
+ - name: Assigned Access (kiosk mode)
+ href: /windows/configuration/kiosk-methods
+ - name: Security baselines
+ href: ../../threat-protection/windows-security-configuration-framework/windows-security-baselines.md
+ items:
+ - name: Security Compliance Toolkit
+ href: ../../threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md
+ - name: Get support
+ href: ../../threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md
+ - name: Guide to removing Microsoft Baseline Security Analyzer (MBSA)
+ href: ../../threat-protection/mbsa-removal-and-guidance.md
+ - name: More Windows security
+ items:
+ - name: Override Process Mitigation Options to help enforce app-related security policies
+ href: ../../threat-protection/override-mitigation-options-for-app-related-security-policies.md
+ - name: Use Windows Event Forwarding to help with intrusion detection
+ href: ../../threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
+ - name: Block untrusted fonts in an enterprise
+ href: ../../threat-protection/block-untrusted-fonts-in-enterprise.md
\ No newline at end of file
diff --git a/windows/security/operating-system-security/network-security/toc.yml b/windows/security/operating-system-security/network-security/toc.yml
new file mode 100644
index 0000000000..af372280a4
--- /dev/null
+++ b/windows/security/operating-system-security/network-security/toc.yml
@@ -0,0 +1,40 @@
+items:
+- name: Transport layer security (TLS)
+ href: /windows-server/security/tls/tls-ssl-schannel-ssp-overview
+- name: WiFi Security
+ href: https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09
+- name: Windows Firewall
+ href: ../../threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
+- name: Virtual Private Network (VPN)
+ href: ../../identity-protection/vpn/vpn-guide.md
+ items:
+ - name: VPN connection types
+ href: ../../identity-protection/vpn/vpn-connection-type.md
+ - name: VPN routing decisions
+ href: ../../identity-protection/vpn/vpn-routing.md
+ - name: VPN authentication options
+ href: ../../identity-protection/vpn/vpn-authentication.md
+ - name: VPN and conditional access
+ href: ../../identity-protection/vpn/vpn-conditional-access.md
+ - name: VPN name resolution
+ href: ../../identity-protection/vpn/vpn-name-resolution.md
+ - name: VPN auto-triggered profile options
+ href: ../../identity-protection/vpn/vpn-auto-trigger-profile.md
+ - name: VPN security features
+ href: ../../identity-protection/vpn/vpn-security-features.md
+ - name: VPN profile options
+ href: ../../identity-protection/vpn/vpn-profile-options.md
+ - name: How to configure Diffie Hellman protocol over IKEv2 VPN connections
+ href: ../../identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md
+ - name: How to use single sign-on (SSO) over VPN and Wi-Fi connections
+ href: ../../identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md
+ - name: Optimizing Office 365 traffic with the Windows VPN client
+ href: ../../identity-protection/vpn/vpn-office-365-optimization.md
+- name: Always On VPN
+ href: /windows-server/remote/remote-access/vpn/always-on-vpn/
+- name: Direct Access
+ href: /windows-server/remote/remote-access/directaccess/directaccess
+- name: Server Message Block (SMB) file service
+ href: /windows-server/storage/file-server/file-server-smb-overview
+- name: Server Message Block Direct (SMB Direct)
+ href: /windows-server/storage/file-server/smb-direct
\ No newline at end of file
diff --git a/windows/security/operating-system-security/system-security/toc.yml b/windows/security/operating-system-security/system-security/toc.yml
new file mode 100644
index 0000000000..86abf54e55
--- /dev/null
+++ b/windows/security/operating-system-security/system-security/toc.yml
@@ -0,0 +1,28 @@
+items:
+- name: Secure the Windows boot process
+ href: ../../information-protection/secure-the-windows-10-boot-process.md
+- name: Secure Boot and Trusted Boot
+ href: ../../trusted-boot.md
+- name: Measured Boot
+ href: /windows/compatibility/measured-boot
+- name: Device health attestation service
+ href: ../../threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
+- name: Cryptography and certificate management
+ href: ../../cryptography-certificate-mgmt.md
+- name: The Windows Security app
+ href: ../../threat-protection/windows-defender-security-center/windows-defender-security-center.md
+ items:
+ - name: Virus & threat protection
+ href: ../../threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md
+ - name: Account protection
+ href: ../../threat-protection\windows-defender-security-center\wdsc-account-protection.md
+ - name: Firewall & network protection
+ href: ../../threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md
+ - name: App & browser control
+ href: ../../threat-protection\windows-defender-security-center\wdsc-app-browser-control.md
+ - name: Device security
+ href: ../../threat-protection\windows-defender-security-center\wdsc-device-security.md
+ - name: Device performance & health
+ href: ../../threat-protection\windows-defender-security-center\wdsc-device-performance-health.md
+ - name: Family options
+ href: ../../threat-protection\windows-defender-security-center\wdsc-family-options.md
\ No newline at end of file
diff --git a/windows/security/operating-system-security/toc.yml b/windows/security/operating-system-security/toc.yml
new file mode 100644
index 0000000000..a0ee50c4bb
--- /dev/null
+++ b/windows/security/operating-system-security/toc.yml
@@ -0,0 +1,13 @@
+items:
+- name: Overview
+ href: ../operating-system.md
+- name: System security
+ href: system-security/toc.yml
+- name: Virus and threat protection
+ href: virus-and-threat-protection/toc.yml
+- name: Network security
+ href: network-security/toc.yml
+- name: Data protection
+ href: data-protection/toc.yml
+- name: Device management
+ href: device-management/toc.yml
\ No newline at end of file
diff --git a/windows/security/operating-system-security/virus-and-threat-protection/toc.yml b/windows/security/operating-system-security/virus-and-threat-protection/toc.yml
new file mode 100644
index 0000000000..a8c5cdf1e5
--- /dev/null
+++ b/windows/security/operating-system-security/virus-and-threat-protection/toc.yml
@@ -0,0 +1,21 @@
+items:
+- name: Overview
+ href: ../../threat-protection/index.md
+- name: Microsoft Defender Antivirus
+ href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows
+- name: Configuring LSA Protection
+ href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json
+- name: Attack surface reduction (ASR)
+ href: /microsoft-365/security/defender-endpoint/attack-surface-reduction
+- name: Tamper protection for MDE
+ href: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection
+- name: Microsoft Vulnerable Driver Blocklist
+ href: ../../threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
+- name: Controlled folder access
+ href: /microsoft-365/security/defender-endpoint/controlled-folders
+- name: Exploit protection
+ href: /microsoft-365/security/defender-endpoint/exploit-protection
+- name: Microsoft Defender SmartScreen
+ href: ../../threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
+- name: Microsoft Defender for Endpoint
+ href: /microsoft-365/security/defender-endpoint
\ No newline at end of file
diff --git a/windows/security/security-foundations/certification/toc.yml b/windows/security/security-foundations/certification/toc.yml
new file mode 100644
index 0000000000..70d9d800b8
--- /dev/null
+++ b/windows/security/security-foundations/certification/toc.yml
@@ -0,0 +1,5 @@
+items:
+- name: FIPS 140-2 Validation
+ href: ../../threat-protection/fips-140-validation.md
+- name: Common Criteria Certifications
+ href: ../../threat-protection/windows-platform-common-criteria.md
\ No newline at end of file
diff --git a/windows/security/security-foundations/toc.yml b/windows/security/security-foundations/toc.yml
new file mode 100644
index 0000000000..d52c477387
--- /dev/null
+++ b/windows/security/security-foundations/toc.yml
@@ -0,0 +1,7 @@
+items:
+- name: Overview
+ href: ../security-foundations.md
+- name: Microsoft Security Development Lifecycle
+ href: ../threat-protection/msft-security-dev-lifecycle.md
+- name: Certification
+ href: certification/toc.yml
\ No newline at end of file
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
index afc6aaef79..f6a9150ebc 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
@@ -8,7 +8,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: vinaypamnani-msft
ms.author: vinpa
-ms.date: 09/09/2021
+ms.date: 05/01/2023
ms.reviewer:
manager: aaroncz
ms.custom: asr
@@ -49,6 +49,8 @@ Application Guard has been created to target several types of devices:
- **Personal devices**. These personally owned desktops or mobile laptops aren't domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside.
+[!INCLUDE [microsoft-defender-application-guard-mdag-for-edge-standalone-mode](../../../../includes/licensing/microsoft-defender-application-guard-mdag-for-edge-standalone-mode.md)]
+
## Related articles
|Article |Description |
diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
index e7f02d821d..b58a2be3ac 100644
--- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
+++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md
@@ -48,6 +48,8 @@ Microsoft Defender SmartScreen provide an early warning system against websites
> [!IMPORTANT]
> SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares.
+[!INCLUDE [microsoft-defender-smartscreen](../../../../includes/licensing/microsoft-defender-smartscreen.md)]
+
## Submit files to Microsoft Defender SmartScreen for review
If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/wdsi/filesubmission/) to Microsoft for review. For more information, see [Submit files for analysis](/microsoft-365/security/intelligence/submission-guide).
diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen.md b/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen.md
index aa2ffc3b9d..7ca1ed702c 100644
--- a/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen.md
+++ b/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen.md
@@ -37,6 +37,8 @@ Enhanced Phishing Protection provides robust phishing protections for work or sc
- **Easy management through Group Policy and Microsoft Intune:** Enhanced Phishing Protection works with Group Policy and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Enhanced Phishing Protection, you can customize which phishing protection scenarios show users warning dialogs. For example, the Service Enabled setting determines whether the Enhanced Phishing Protection service is on or off. The feature is in audit mode if the other settings, which correspond to notification policies, aren't enabled.
+[!INCLUDE [enhanced-phishing-protection-with-smartscreen](../../../../includes/licensing/enhanced-phishing-protection-with-smartscreen.md)]
+
## Configure Enhanced Phishing Protection for your organization
Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. Follow these instructions to configure your devices using either Microsoft Intune, GPO or CSP.
diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
index b6fcd28bd2..a29c0cb634 100644
--- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
+++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
@@ -1,5 +1,5 @@
---
-title: Control the health of Windows 10-based devices (Windows 10)
+title: Control the health of Windows devices
description: This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices.
ms.prod: windows-client
ms.date: 10/13/2017
@@ -11,7 +11,7 @@ manager: dougeby
ms.topic: conceptual
---
-# Control the health of Windows 10-based devices
+# Control the health of Windows devices
**Applies to**
@@ -327,6 +327,8 @@ For Windows 10-based devices, Microsoft introduces a new public API that will al
For more information on device health attestation, see the [Detect an unhealthy Windows 10-based device](#detect-unhealthy) section.
+[!INCLUDE [device-health-attestation-service](../../../includes/licensing/device-health-attestation-service.md)]
+
### Hardware requirements
The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview).
diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md
index 03d4f6bba0..301d74416d 100644
--- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md
+++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md
@@ -32,6 +32,8 @@ The following topics provide a discussion of each policy setting's implementatio
>[!NOTE]
>Account lockout settings for remote access clients can be configured separately by editing the Registry on the server that manages the remote access. For more information, see [How to configure remote access client account lockout](/troubleshoot/windows-server/networking/configure-remote-access-client-account-lockout).
+[!INCLUDE [account-lockout-policy](../../../../includes/licensing/account-lockout-policy.md)]
+
## In this section
| Topic | Description |
diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md
index e5a2bba1d9..5cac6b5f49 100644
--- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md
+++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md
@@ -71,6 +71,8 @@ The Security Settings extension of the Local Group Policy Editor includes the fo
- **IP Security Policies on Local Computer.** Specify settings to ensure private, secure communications over IP networks by using cryptographic security services. IPsec establishes trust and security from a source IP address to a destination IP address.
- **Advanced Audit Policy Configuration.** Specify settings that control the logging of security events into the security log on the device. The settings under Advanced Audit Policy Configuration provide finer control over which activities to monitor as opposed to the Audit Policy settings under Local Policies.
+[!INCLUDE [windows-security-policy-settings-and-auditing](../../../../includes/licensing/windows-security-policy-settings-and-auditing.md)]
+
## Policy-based security settings management
The Security Settings extension to Group Policy provides an integrated policy-based management infrastructure to help you manage and enforce your security policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
index 04be400ff9..cc7b86329f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
+++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md
@@ -13,7 +13,7 @@ author: jsuther1974
ms.reviewer: jogeurte
ms.author: vinpa
manager: aaroncz
-ms.date: 03/24/2023
+ms.date: 05/09/2023
ms.technology: itpro-security
ms.topic: article
---
@@ -62,35 +62,35 @@ Represents why verification failed, or if it succeeded.
| VerificationError Value | Explanation |
|---|----------|
-| 0 | Successfully verified signature |
-| 1 | File has an invalid hash |
-| 2 | File contains shared writable sections |
-| 3 | File isn't signed|
-| 4 | Revoked signature |
-| 5 | Expired signature |
-| 6 | File is signed using a weak hashing algorithm, which doesn't meet the minimum policy |
-| 7 | Invalid root certificate |
-| 8 | Signature was unable to be validated; generic error |
-| 9 | Signing time not trusted |
-| 10 | The file must be signed using page hashes for this scenario |
-| 11 | Page hash mismatch |
-| 12 | Not valid for a PPL (Protected Process Light) |
-| 13 | Not valid for a PP (Protected Process) |
-| 14 | The signature is missing the required ARM processor EKU |
-| 15 | Failed WHQL check |
-| 16 | Default policy signing level not met |
-| 17 | Custom policy signing level not met; returned when signature doesn't validate against an SBCP-defined set of certs |
-| 18 | Custom signing level not met; returned if signature fails to match `CISigners` in UMCI |
-| 19 | Binary is revoked based on its file hash |
-| 20 | SHA1 cert hash's timestamp is missing or after valid cutoff as defined by Weak Crypto Policy |
-| 21 | Failed to pass Windows Defender Application Control policy |
-| 22 | Not Isolated User Mode (IUM)) signed; indicates an attempt to load a non-trustlet binary into a trustlet |
-| 23 | Invalid image hash |
-| 24 | Flight root not allowed; indicates trying to run flight-signed code on production OS |
-| 25 | Anti-cheat policy violation |
-| 26 | Explicitly denied by WADC policy |
-| 27 | The signing chain appears to be tampered/invalid |
-| 28 | Resource page hash mismatch |
+| 0 | Successfully verified signature. |
+| 1 | File has an invalid hash. |
+| 2 | File contains shared writable sections. |
+| 3 | File isn't signed. |
+| 4 | Revoked signature. |
+| 5 | Expired signature. |
+| 6 | File is signed using a weak hashing algorithm, which doesn't meet the minimum policy. |
+| 7 | Invalid root certificate. |
+| 8 | Signature was unable to be validated; generic error. |
+| 9 | Signing time not trusted. |
+| 10 | The file must be signed using page hashes for this scenario. |
+| 11 | Page hash mismatch. |
+| 12 | Not valid for a PPL (Protected Process Light). |
+| 13 | Not valid for a PP (Protected Process). |
+| 14 | The signature is missing the required ARM processor EKU. |
+| 15 | Failed WHQL check. |
+| 16 | Default policy signing level not met. |
+| 17 | Custom policy signing level not met; returned when signature doesn't validate against an SBCP-defined set of certs. |
+| 18 | Custom signing level not met; returned if signature fails to match `CISigners` in UMCI. |
+| 19 | Binary is revoked based on its file hash. |
+| 20 | SHA1 cert hash's timestamp is missing or after valid cutoff as defined by Weak Crypto Policy. |
+| 21 | Failed to pass Windows Defender Application Control policy. |
+| 22 | Not Isolated User Mode (IUM)) signed; indicates an attempt to load a standard Windows binary into a virtualization-based security (VBS) trustlet. |
+| 23 | Invalid image hash. This error can indicate file corruption or a problem with the file's signature. Signatures using elliptic curve cryptography (ECC), such as ECDSA, return this VerificationError. |
+| 24 | Flight root not allowed; indicates trying to run flight-signed code on production OS. |
+| 25 | Anti-cheat policy violation. |
+| 26 | Explicitly denied by WADC policy. |
+| 27 | The signing chain appears to be tampered/invalid. |
+| 28 | Resource page hash mismatch. |
## Policy activation event Options
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
index 161e563a19..a03dd12363 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
@@ -59,6 +59,8 @@ The blocklist is updated with each new major release of Windows, typically 1-2 t
Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we've provided a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, you can use the XML provided below to create your own custom WDAC policies.
+[!INCLUDE [microsoft-vulnerable-driver-blocklist](../../../../includes/licensing/microsoft-vulnerable-driver-blocklist.md)]
+
## Blocking vulnerable drivers using WDAC
Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking [this list of drivers](#vulnerable-driver-blocklist-xml) within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can cause devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) and review the audit block events.
diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
index 0aa63e99f8..a9c0d42e86 100644
--- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
+++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md
@@ -9,7 +9,7 @@ ms.reviewer: jogeurte
ms.author: jogeurte
ms.manager: jsuther
manager: aaroncz
-ms.date: 04/04/2023
+ms.date: 05/09/2023
ms.technology: itpro-security
ms.topic: article
ms.localizationpriority: medium
@@ -51,7 +51,7 @@ When the WDAC engine evaluates files against the active set of policies on the d
1. Explicit deny rules - if any explicit deny rule exists for the file, it's blocked even if other rules are created to try to allow it. Deny rules can use any [rule level](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-file-rule-levels). Use the most specific rule level practical when creating deny rules to avoid blocking more than you intend.
-2. Explicit allow rules - if any explicit allow rul exists for the file, it's allowed by the policy.
+2. Explicit allow rules - if any explicit allow rule exists for the file, the file runs.
3. WDAC then checks for the [Managed Installer extended attribute (EA)](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer) or the [Intelligent Security Graph (ISG) EA](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph) on the file. If either EA exists and the policy enables the corresponding option, then the file is allowed.
@@ -71,7 +71,11 @@ When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when
### .NET native images may generate false positive block events
-In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET will regenerate the native image at its next scheduled maintenance window.
+In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window.
+
+### Signatures using elliptical curve cryptography (ECC) aren't supported
+
+WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA.
### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index aa785afde2..ac8c1073a4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -13,7 +13,7 @@ author: jgeurten
ms.reviewer: jsuther1974
ms.author: vinpa
manager: aaroncz
-ms.date: 04/05/2023
+ms.date: 05/09/2023
ms.technology: itpro-security
ms.topic: article
---
@@ -48,7 +48,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru
| **1 Enabled:Boot Menu Protection** | This option isn't currently supported. | No |
| **2 Required:WHQL** | By default, kernel drivers that aren't Windows Hardware Quality Labs (WHQL) signed are allowed to run. Enabling this rule requires that every driver is WHQL signed and removes legacy driver support. Kernel drivers built for Windows 10 should be WHQL certified. | No |
| **3 Enabled:Audit Mode (Default)** | Instructs WDAC to log information about applications, binaries, and scripts that would have been blocked, if the policy was enforced. You can use this option to identify the potential impact of your WDAC policy, and use the audit events to refine the policy before enforcement. To enforce a WDAC policy, delete this option. | No |
-| **4 Disabled:Flight Signing** | If enabled, binaries from Windows Insider builds aren't trusted. This option is useful for organizations that only want to run released binaries, not pre-release Windows builds. | No |
+| **4 Disabled:Flight Signing** | If enabled, binaries from Windows Insider builds aren't trusted. This option is useful for organizations that only want to run released binaries, not prerelease Windows builds. | No |
| **5 Enabled:Inherit Default Policy** | This option is reserved for future use and currently has no effect. | Yes |
| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and any supplemental policies must also be signed. The certificates that are trusted for future policy updates must be identified in the UpdatePolicySigners section. Certificates that are trusted for supplemental policies must be identified in the SupplementalPolicySigners section. | Yes |
| **7 Allowed:Debug Policy Augmented** | This option isn't currently supported. | Yes |
@@ -72,6 +72,9 @@ File rule levels allow administrators to specify the level at which they want to
Each file rule level has advantages and disadvantages. Use Table 2 to select the appropriate protection level for your available administrative resources and WDAC deployment scenario.
+> [!NOTE]
+> WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. Files can be allowed instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA.
+
### Table 2. Windows Defender Application Control policy - file rule levels
| Rule level | Description |
@@ -82,7 +85,7 @@ Each file rule level has advantages and disadvantages. Use Table 2 to select the
| **SignedVersion** | This level combines the publisher rule with a version number. It allows anything to run from the specified publisher with a version at or above the specified version number. |
| **Publisher** | This level combines the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. You can use this rule level to trust a certificate issued by a particular CA and issued to a specific company you trust (such as Intel, for device drivers). |
| **FilePublisher** | This level combines the "FileName" attribute of the signed file, plus "Publisher" (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
-| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. When this level is used, no policy update would be needed to run the new version of the application. However, leaf certificates typically have shorter validity periods than other certificate levels, so the WDAC policy must be updated whenever these certificates change. |
+| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product have different hash values but typically the same signing certificate. When this level is used, no policy update would be needed to run the new version of the application. However, leaf certificates typically have shorter validity periods than other certificate levels, so the WDAC policy must be updated whenever these certificates change. |
| **PcaCertificate** | Adds the highest available certificate in the provided certificate chain to signers. This level is typically one certificate below the root because the scan doesn't resolve the complete certificate chain via the local root stores or with an online check. |
| **RootCertificate** | Not supported. |
| **WHQL** | Only trusts binaries that have been submitted to Microsoft and signed by the Windows Hardware Qualification Lab (WHQL). This level is primarily for kernel binaries. |
@@ -175,7 +178,7 @@ The Authenticode/PE image hash can be calculated for digitally signed and unsign
The PowerShell cmdlet produces an Authenticode Sha1 Hash, Sha256 Hash, Sha1 Page Hash, Sha256 Page Hash.
During validation, WDAC selects which hashes are calculated based on how the file is signed and the scenario in which the file is used. For example, if the file is page-hash signed, WDAC validates each page of the file and avoids loading the entire file in memory to calculate the full sha256 authenticode hash.
-In the cmdlets, rather than try to predict which hash will be used, we pre-calculate and use the four hashes (sha1/sha2 authenticode, and sha1/sha2 of first page). This method is also resilient to changes in how the file is signed since your WDAC policy has more than one hash available for the file already.
+In the cmdlets, rather than try to predict which hash will be used, we precalculate and use the four hashes (sha1/sha2 authenticode, and sha1/sha2 of first page). This method is also resilient to changes in how the file is signed since your WDAC policy has more than one hash available for the file already.
### Why does scan create eight hash rules for certain XML files?
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
index 2ba7d43f84..9f1f0f96d3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
@@ -73,6 +73,8 @@ Smart App Control enforces the [Microsoft Recommended Driver Block rules](micros
- Microsoft.Build.Framework.dll
- Wslhost.dll
+[!INCLUDE [windows-defender-application-control-wdac](../../../../includes/licensing/windows-defender-application-control-wdac.md)]
+
## Related articles
- [WDAC design guide](windows-defender-application-control-design-guide.md)
diff --git a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md
index 10b4f41000..74e332cb87 100644
--- a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md
+++ b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md
@@ -30,7 +30,7 @@ With Windows 7, one of the means attackers would use to persist and evade detect
This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege.
With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) a hardware-based root of trust helps ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader.
-This hardware-based root of trust comes from the device’s Secure Boot feature, which is part of the Unified Extensible Firmware Interface (UEFI).
+This hardware-based root of trust comes from the device's Secure Boot feature, which is part of the Unified Extensible Firmware Interface (UEFI).
This technique of measuring the static early boot UEFI components is called the Static Root of Trust for Measurement (SRTM).
As there are thousands of PC vendors that produce many models with different UEFI BIOS versions, there becomes an incredibly large number of SRTM measurements upon bootup.
@@ -69,18 +69,20 @@ Paging protection can be implemented to lock certain code tables to be read-only
A hardware-enforced processor feature known as a supervisor SMI handler can monitor the SMM and make sure it doesn't access any part of the address space that it isn't supposed to.
SMM protection is built on top of the Secure Launch technology and requires it to function.
-In the future, Windows 10 will also measure this SMI Handler’s behavior and attest that no OS-owned memory has been tampered with.
+In the future, Windows 10 will also measure this SMI Handler's behavior and attest that no OS-owned memory has been tampered with.
## Validating platform integrity after Windows is running (run time)
-While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity.
+While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can't just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device's integrity.
-As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch won't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few.
+As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device's Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch won't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device's firmware, hardware configuration state, and Windows boot-related components, just to name a few.
After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources.
+[!INCLUDE [windows-defender-system-guard](../../../../includes/licensing/windows-defender-system-guard.md)]
+
## System requirements for System Guard
This feature is available for the following processors:
diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
index 282125d3bd..a5468a9a20 100644
--- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
+++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
@@ -23,7 +23,7 @@ Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Serv
The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment.
-
+[!INCLUDE [windows-firewall](../../../../includes/licensing/windows-firewall.md)]
## Feature description
diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
index 74e81b1a05..8f3d7bd7de 100644
--- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
+++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md
@@ -32,10 +32,10 @@ Windows Sandbox has the following properties:
> [!IMPORTANT]
> Windows Sandbox enables network connection by default. It can be disabled using the [Windows Sandbox configuration file](/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file#networking).
+[!INCLUDE [windows-sandbox](../../../../includes/licensing/windows-sandbox.md)]
+
## Prerequisites
-- Windows 10, version 1903 and later, or Windows 11
-- Windows Pro, Enterprise or Education edition
- ARM64 (for Windows 11, version 22H2 and later) or AMD64 architecture
- Virtualization capabilities enabled in BIOS
- At least 4 GB of RAM (8 GB recommended)
diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md
index 238193ef00..b4829615f9 100644
--- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md
+++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md
@@ -41,6 +41,8 @@ For example, there are over 3,000 group policy settings for Windows 10, which do
In modern organizations, the security threat landscape is constantly evolving, and IT pros and policy-makers must keep up with security threats and make required changes to security settings to help mitigate these threats. To enable faster deployments and make managing Microsoft products easier, Microsoft provides customers with security baselines that are available in consumable formats, such as group policy object backups.
+[!INCLUDE [security-baselines](../../../../includes/licensing/security-baselines.md)]
+
## Baseline principles
Our recommendations follow a streamlined and efficient approach to baseline definitions. The foundation of that approach is essentially:
diff --git a/windows/security/trusted-boot.md b/windows/security/trusted-boot.md
index ad5c50ecc7..8790964196 100644
--- a/windows/security/trusted-boot.md
+++ b/windows/security/trusted-boot.md
@@ -29,6 +29,8 @@ Trusted Boot picks up the process that started with Secure Boot. The Windows boo
Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the Windows 11 device to start normally.
+[!INCLUDE [secure-boot-and-trusted-boot](../../includes/licensing/secure-boot-and-trusted-boot.md)]
+
## See also
[Secure the Windows boot process](information-protection/secure-the-windows-10-boot-process.md)
\ No newline at end of file
diff --git a/windows/security/zero-trust-windows-device-health.md b/windows/security/zero-trust-windows-device-health.md
index d6159d39a6..64a4233745 100644
--- a/windows/security/zero-trust-windows-device-health.md
+++ b/windows/security/zero-trust-windows-device-health.md
@@ -13,7 +13,7 @@ ms.date: 12/31/2017
---
# Zero Trust and Windows device health
-Organizations need a security model that more effectively adapts to the complexity of the modern work environment. IT admins need to embrace the hybrid workplace, while protecting people, devices, apps, and data wherever they’re located. Implementing a Zero Trust model for security helps address today's complex environments.
+Organizations need a security model that more effectively adapts to the complexity of the modern work environment. IT admins need to embrace the hybrid workplace, while protecting people, devices, apps, and data wherever they're located. Implementing a Zero Trust model for security helps address today's complex environments.
The [Zero Trust](https://www.microsoft.com/security/business/zero-trust) principles are:
@@ -27,12 +27,12 @@ The Zero Trust concept of **verify explicitly** applies to the risks introduced
[Conditional access](/azure/active-directory/conditional-access/overview) evaluates identity signals to confirm that users are who they say they are before they're granted access to corporate resources.
-Windows 11 supports device health attestation, helping to confirm that devices are in a good state and haven't been tampered with. This capability helps users access corporate resources whether they’re in the office, at home, or when they’re traveling.
+Windows 11 supports device health attestation, helping to confirm that devices are in a good state and haven't been tampered with. This capability helps users access corporate resources whether they're in the office, at home, or when they're traveling.
Attestation helps verify the identity and status of essential components and that the device, firmware, and boot process haven't been altered. Information about the firmware, boot process, and software, is used to validate the security state of the device. This information is cryptographically stored in the security co-processor Trusted Platform Module (TPM). Once the device is attested, it can be granted access to resources.
## Device health attestation on Windows
- Many security risks can emerge during the boot process as this process can be the most privileged component of the whole system. The verification process uses remote attestation as the secure channel to determine and present the device’s health. Remote attestation determines:
+ Many security risks can emerge during the boot process as this process can be the most privileged component of the whole system. The verification process uses remote attestation as the secure channel to determine and present the device's health. Remote attestation determines:
- If the device can be trusted
- If the operating system booted correctly
diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml
index 6f313338d0..7de54c5362 100644
--- a/windows/whats-new/TOC.yml
+++ b/windows/whats-new/TOC.yml
@@ -26,6 +26,8 @@
href: whats-new-windows-10-version-21H1.md
- name: What's new in Windows 10, version 20H2
href: whats-new-windows-10-version-20H2.md
+- name: Windows commercial licensing overview
+ href: windows-licensing.md
- name: Deprecated and removed Windows features
expanded: false
items:
diff --git a/windows/whats-new/index.yml b/windows/whats-new/index.yml
index c988c8ebb4..f11b6dbc0c 100644
--- a/windows/whats-new/index.yml
+++ b/windows/whats-new/index.yml
@@ -32,6 +32,8 @@ landingContent:
url: windows-11-plan.md
- text: Prepare for Windows 11
url: windows-11-prepare.md
+ - text: Windows commercial licensing overview
+ url: windows-licensing.md
- title: Windows 10
linkLists:
diff --git a/windows/whats-new/windows-licensing.md b/windows/whats-new/windows-licensing.md
new file mode 100644
index 0000000000..212d022557
--- /dev/null
+++ b/windows/whats-new/windows-licensing.md
@@ -0,0 +1,212 @@
+---
+title: Windows commercial licensing overview
+description: Learn about products and use rights available through Windows commercial licensing.
+ms.prod: windows-client
+author: paolomatarazzo
+ms.author: paoloma
+manager: aaroncz
+ms.collection:
+- tier2
+ms.topic: conceptual
+ms.date: 05/04/2023
+appliesto:
+- ✅ Windows 11
+ms.technology: itpro-security
+---
+
+# Windows Commercial Licensing overview
+
+This document provides an overview of the products and use rights available through Microsoft Commercial Licensing, information about the products that are eligible for upgrades, and the key choices you have for using Windows in your organization.
+
+> [!NOTE]
+> The content of this article doesn't replace or override other licensing documentation, such as the Windows 11 End User License Agreement or [Commercial Licensing Product Terms][EXT-4].
+
+## Windows 11 editions
+
+The following table lists the editions of Windows 11 available through each Microsoft distribution channel:
+
+| Full Packaged Product (Retail) | Preinstalled on device (OEM)|Commercial Licensing|
+|-|-|-|
+|Windows 11 Home
Windows 11 Pro|Windows 11 Home
Windows 11 Pro|Windows 11 Pro
Windows 11 Enterprise
Windows 11 Enterprise LTSC|
+
+## Windows desktop offerings available through Commercial Licensing
+
+The following offerings are available for purchase through [Microsoft Commercial Licensing][EXT-5]:
+
+|Product|Description|Availability|
+|-|-|-|
+|Windows 11 Pro Upgrade |Windows 11 Pro is designed for small and medium businesses. Windows 11 Pro enables organizations to manage devices and apps, protect their data, facilitate remote and mobile scenarios, while taking advantage of the cloud technologies that support their business. Windows 11 Pro devices are a good choice for organizations that support *choose your own device (CYOD)* programs and *prosumer* customers. | The Windows 11 Pro Upgrade in Commercial Licensing upgrades a device from a previous version of Windows Pro.|
+|Windows 11 Enterprise E3|Windows 11 Enterprise E3 is intended for large and medium-sized organizations. It includes Windows Enterprise edition with cloud-powered capabilities and subscription use rights. Examples include advanced identity protection, the broadest range of options for operating system deployment, update control, and device management. |Windows 11 Enterprise E3 is available **per-user** in Commercial Licensing programs. It requires Windows Pro as qualifying operating systems.|
+|Windows 11 Enterprise E5|Windows 11 Enterprise E5 is for organizations that want to take advantage of everything in Windows 11 Enterprise E3 with the addition of **Microsoft Defender for Endpoint Plan 2**, a service that helps enterprises detect, investigate, and respond to advanced cybersecurity attacks on their endpoints and networks.| Windows 11 Enterprise E5 is available **per-user** in Commercial Licensing programs. It requires Windows Pro as qualifying operating systems.|
+|Windows 10 Enterprise LTSC |Windows 10 Enterprise LTSC is designed for devices that have strict change-management policies with only security and critical bug fixes. By using a Long-Term Servicing Channel edition, you can apply monthly Windows 10 security updates for specialized devices while holding back new-feature updates for an extended period of time, up to five years. | Windows Enterprise LTSC is available in the **per-user** and **per-device** model, depending on the Volume Licensing program through which it's acquired.|
+|Windows Virtual Desktop Access (VDA) Subscription License|The Windows VDA subscription license provides the right to access virtual Windows desktop environments from devices that aren't covered by a Commercial Licensing offer that includes VDA rights, such as thin clients. |Windows VDA is available on a **per-device** and **per-user** basis.|
+
+## Windows 11 Pro Upgrade license
+
+Windows 11 Pro is designed for small and medium businesses. Windows 11 Pro enables you to manage your devices and apps, protect your business data, facilitate remote and mobile scenarios, and take advantage of the cloud technologies for your organization.
+
+The Windows 11 Pro Upgrade license is recommended if you want to:
+
+- Upgrade a Windows 10 Pro device to Windows 11 Pro
+- Upgrade Windows 7/8/8.1 Pro devices to Windows 10 Pro
+
+## Windows 11 Enterprise
+
+There are two core Windows 11 Enterprise offers: **Windows 11 Enterprise E3** and **Windows 11 Enterprise E5**. These offers can be purchased on a **per-user basis**, and are only available through **Commercial Licensing**, including the **Cloud Solution Provider** program.
+
+### Windows 11 Enterprise E3
+
+Windows 11 Enterprise E3 builds on Windows 11 Pro by adding more advanced features designed to address the needs of large and mid-size organizations. Examples include advanced protection against modern security threats, the broadest range of options for operating system deployment and update, and comprehensive device and app management.
+
+> [!NOTE]
+> Windows Enterprise E3 is a **per user subscription**, intended for organizations. It includes **Windows Enterprise edition** with cloud-powered capabilities and **subscription use rights**. Windows Enterprise E3 is usually licensed through Volume Licensing programs and is an upgrade from Windows Pro.
+
+#### Windows 11 Enterprise features
+
+The following table describes the unique Windows Enterprise edition features:
+
+| OS-based feature | Description |
+|-|-|
+|**[Windows Defender Credential Guard][WIN-1]**|Protects against user credential harvesting and pass-the-hash attacks or pass the token attacks.|
+|**[Managed Microsoft Defender Application Guard for Microsoft Edge][EDGE-1]**| Isolates enterprise-defined untrusted sites with virtualization-based security from Windows, protecting your organization while users browse the Internet.|
+|**[Modern BitLocker Management][WIN-2]** | Allows you to eliminate on-premises tools to monitor and support BitLocker recovery scenarios. |
+|**[Personal Data Encryption][WIN-3]**|Encrypts individual's content using Windows Hello for Business to link the encryption keys to user credentials.|
+|**[Direct Access][WINS-1]**|Connect remote users to the organization network without the need for traditional VPN connections.|
+|**[Always-On VPN device tunnel][WINS-2]**|Advanced security capabilities to restrict the type of traffic and which applications can use the VPN connection.|
+|**[Windows Experience customization][WIN-4]**|Settings to lock down the user experience of corporate desktops and Shell Launcher with Unified Write Filter for frontline workers devices or public kiosks.|
+
+#### Windows 11 Enterprise cloud-based capabilities
+
+The following table describes the unique Windows Enterprise cloud-based features:
+
+|Cloud-based feature | Description |
+|-|-|
+|**[Windows subscription activation][WIN-5]**|Enables you to *step-up* from **Windows Pro edition** to **Enterprise edition**. You can eliminate license key management and the deployment of Enterprise edition images.|
+|**[Windows Autopatch][WIN-6]**|Cloud service that puts Microsoft in control of automating updates to Windows, Microsoft 365 Apps for enterprise, Microsoft Edge, and Microsoft Teams.|
+|**[Windows Update For Business deployment service][WIN-7]**|This cloud service gives you the control over the approval, scheduling, and safeguarding of quality, feature upgrades, and driver updates delivered from Windows Update.|
+|**[Universal Print][UP-1]**|Removes the need for on-premises print servers and enables any endpoint to print to cloud registered printers.|
+|**[Microsoft Connected Cache][WIN-8]**|A software solution that caches app and OS updates on the local network to save Internet bandwidth in locations with limited connectivity.|
+|**[Endpoint analytics proactive remediation][MEM-1]**|Helps you fix common support issues before end-users notice them.|
+|**[Organizational messages][MEM-2]**|Keeps employees informed with organizational messages directly inserted in Windows UI surfaces.|
+
+#### Windows 11 Enterprise licensing use rights
+
+The following table describes the Windows Enterprise licensing use rights:
+
+|Licensing use rights|Description|
+|-|-|
+|**[Five Windows instances per licensed user][EXT-1]**|Allows your employees to simultaneously use a Windows laptop, a cloud PC and a specialized device with Windows LTSC, and more.|
+|**[36 months (3 years) support on annual feature releases][WIN-9]**|Get extra time to deploy feature releases.|
+|**[Azure Virtual Desktop, Windows 365 Enterprise and Virtual Desktop Access][AZ-1]**|Empower flexible work styles and smarter work with the included virtualization access rights. Includes FSLogix for a consistent experience of
+Windows user profiles in virtual desktop environments.|
+|**[Windows release health in the Microsoft 365 admin center][EXT-2]**|Gives you essential information about monthly quality and feature updates in the Microsoft 365 admin center.|
+|**[Windows feature update device readiness report][MEM-3]**|Provides per-device information about compatibility risks that are associated with an upgrade or update to a chosen version of Windows.|
+|**[Windows feature update compatibility risks reports][MEM-3]**|Provides a summary view of the top compatibility risks, so you understand which compatibility risks impact the greatest number of devices in your organization.|
+|**[Windows LTSC Enterprise][WIN-10]**|Intended for highly specialized devices that require limited changes due to regulations and certification|
+|**[Microsoft Desktop Optimization Pack (MDOP) ][MDOP-1]**|Help improve compatibility and management, reduce support costs, improve asset management, and improve policy control.|
+
+Learn more about [Windows 11 Enterprise E3][EXT-3].
+
+### Windows 11 Enterprise E5
+
+Windows 11 Enterprise E5 is for organizations that want to take advantage of everything in Windows 11 Enterprise E3 with the addition of **Microsoft Defender for Endpoint Plan 2**, a cloud service that helps enterprises detect, investigate, and respond to advanced cybersecurity attacks on their endpoints and networks.
+
+Building on the existing security defenses in Windows 11, Microsoft Defender for Device provides a post-breach layer of protection to the Windows 11 security stack. With a combination of client technology built into Windows 11 and a robust cloud service, it can help detect threats that have made it past other defenses, provide enterprises with information to investigate the breach across endpoints, and offer response recommendations.
+
+> [!NOTE]
+> Windows 11 Enterprise E5 is available per user in Commercial Licensing programs.
+
+### Windows Enterprise E3 in Microsoft 365 F3
+
+Windows Enterprise E3 subscription license in Microsoft 365 F3 has all the OS features, and most of the cloud services and use rights, included with regular Windows Enterprise E3.
+Windows Enterprise E3 in Microsoft 365 F3 does not include some use rights previously included in Software Assurance benefits that come with the regular E3 user subscription license. F3 does not come with:
+
+- Microsoft Desktop Optimization Pack (MDOP)
+- Windows LTSC Enterprise
+- Windows Autopatch
+
+## Use a Windows Pro device with the Windows Enterprise user subscription license
+
+In most cases, the Windows Pro edition comes pre-installed on a business-class device. Microsoft recommends upgrading your Windows Pro devices to Enterprise edition when you have acquired a user subscription licenses for Windows. However, there are cases that require to keep devices on the Pro edition and not upgrade them to Enterprise edition. With Windows 11 Enterprise E3, you can take advantage of features, services and use rights not licensed to the Windows Pro license bound to the device. It includes Windows Enterprise edition with cloud-powered capabilities and subscription use rights, and these capabilities are not always technically enforced. Some scenarios that may require to not upgrade to Windows Enterprise edition:
+
+- Devices not properly provisioned that don't automatically upgrade to Windows Enterprise edition
+- Devices may have been acquired for a business process that was not under control of a central IT department or outside of the IT department's knowledge
+- Devices may be used temporarily for a project by vendors and added to the IT infrastructure, but not upgraded to Enterprise edition
+- A developer that is developing applications that must be tested and certified on Pro, as that is how it will be delivered to customers
+- A Windows Pro device that was pre-configured for a specific purpose and is certified on Pro only
+
+In these cases, you want the PC to be configured, secured, monitored, and updated with the enterprise management and security tools that come with the Windows Enterprise user subscription. Your Windows Enterprise E3 subscriptions does not block these scenarios.
+
+The following table lists the Windows 11 Enterprise features and their Windows edition requirements:
+
+| OS-based feature |Windows Pro|Windows Enterprise|
+|-|-|-|
+|**[Windows Defender Credential Guard][WIN-1]**|❌|Yes|
+|**[Microsoft Defender Application Guard (MDAG) for Microsoft Edge][EDGE-1]**|Yes|Yes|
+|**[Modern BitLocker Management][WIN-2]**|Yes|Yes|
+|**[Personal data encryption (PDE)][WIN-3]**|❌|Yes|
+|**[Direct Access][WINS-1]**|Yes|Yes|
+|**[Always On VPN][WINS-2]**|Yes|Yes|
+|**[Windows Experience customization][WIN-4]**|❌|Yes|
+
+The following table lists the Windows 11 Enterprise cloud-based features and their Windows edition requirements:
+
+| Cloud-based feature |Windows Pro|Windows Enterprise|
+|-|-|-|
+|**[Windows subscription activation][WIN-5]**|Yes|Yes|
+|**[Windows Autopatch][WIN-6]**|Yes|Yes|
+|**[Windows Update For Business deployment service][WIN-7]**|Yes|Yes|
+|**[Universal Print][UP-1]**|Yes|Yes|
+|**[Microsoft Connected Cache][WIN-8]**|Yes|Yes|
+|**[Endpoint analytics proactive remediation][MEM-1]**|Yes|Yes|
+|**[Organizational messages][MEM-2]**|❌|Yes|
+
+The following table lists the Windows 11 Enterprise E3 licensing use rights and their Windows edition requirements:
+
+|Licensing use rights|Windows Pro|Windows Enterprise|
+|-|-|-|
+|**[Five Windows instances per licensed user][EXT-1]**|n/a|n/a|
+|**[36 months (3 years) support on annual feature releases][WIN-9]**|❌|Yes|
+|**[Azure Virtual Desktop, Windows 365 Enterprise and Virtual Desktop Access][AZ-1]**|n/a|n/a|
+|**[Windows release health in the Microsoft 365 admin center][EXT-2]**|n/a|n/a|
+|**[Windows feature update device readiness report][MEM-3]**|Yes|Yes|
+|**[Windows feature update compatibility risks reports][MEM-3]**|Yes|Yes|
+|**[Windows LTSC Enterprise][WIN-10]**|n/a|n/a|
+|**[Microsoft Desktop Optimization Pack (MDOP)][MDOP-1]**|Yes|Yes|
+
+## Next steps
+
+To learn more about Windows 11 Enterprise E3 and E5 licensing, download the [Windows 11 licensing guide][EXT-6]. The guide provides additional information to complement the information in this article, including:
+
+- Description of qualifying operating systems
+- Availability of Windows desktop operating system products in licensing programs
+- Deciding between per-device and per-user licensing
+- Windows 11 downgrade rights
+- Volume license activation methods
+- How to acquire licenses through Commercial Licensing
+
+[AZ-1]: /azure/virtual-desktop/prerequisites#operating-systems-and-licenses
+[EDGE-1]: /deployedge/microsoft-edge-security-windows-defender-application-guard
+[EXT-1]: https://www.microsoft.com/licensing/terms/productoffering/WindowsDesktopOperatingSystem/EAEAS
+[EXT-2]: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-release-health-now-available-in-the-microsoft-365-admin/ba-p/2235908
+[EXT-3]: https://windows.com/enterprise
+[EXT-4]: https://www.microsoft.com/licensing/product-licensing/products.aspx
+[EXT-5]: https://www.microsoft.com/licensing
+[EXT-6]: https://aka.ms/WindowsLicensingGuide
+[MDOP-1]: /microsoft-desktop-optimization-pack
+[MEM-1]: /mem/analytics/proactive-remediations
+[MEM-2]: /mem/intune/remote-actions/organizational-messages-overview
+[MEM-3]: /mem/intune/protect/windows-update-compatibility-reports
+[UP-1]: /universal-print/
+[WIN-1]: /windows/security/identity-protection/credential-guard/credential-guard
+[WIN-2]: /windows/security/information-protection/bitlocker/bitlocker-overview
+[WIN-3]: /windows/security/information-protection/personal-data-encryption/overview-pde
+[WIN-4]: /windows/client-management/mdm/policy-csp-experience
+[WIN-5]: /windows/deployment/windows-10-subscription-activation
+[WIN-6]: /windows/deployment/windows-autopatch
+[WIN-7]: /windows/deployment/update/deployment-service-overview
+[WIN-8]: /windows/deployment/do/waas-microsoft-connected-cache
+[WIN-9]: /windows/release-health/supported-versions-windows-client#enterprise-and-iot-enterprise-ltsbltsc-editions
+[WIN-10]: /windows/whats-new/ltsc/
+[WINS-1]: /windows-server/remote/remote-access/directaccess/directaccess
+[WINS-2]: /windows-server/remote/remote-access/vpn/always-on-vpn/