From 2722f1bd8ec1b5ff7f461f4064252d16e036b6fc Mon Sep 17 00:00:00 2001 From: Guy Reginiano <45633598+guregini@users.noreply.github.com> Date: Sun, 8 Sep 2019 11:21:46 +0300 Subject: [PATCH 1/4] Added full-form before the existing parentheses --- .../threat-protection/microsoft-defender-atp/configure-siem.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md index 351164afa3..44e2fdd28e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md @@ -32,7 +32,7 @@ ms.date: 10/16/2017 >- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections >- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. -Microsoft Defender ATP supports (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. +Microsoft Defender ATP supports security information and event management (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. Microsoft Defender ATP currently supports the following SIEM tools: From 5efb63490255229df888681cdc13dd24c35ccc61 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 10 Sep 2019 09:35:31 -0700 Subject: [PATCH 2/4] Update ransomware-malware.md Fixed broken link to CFA --- .../threat-protection/intelligence/ransomware-malware.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/ransomware-malware.md b/windows/security/threat-protection/intelligence/ransomware-malware.md index 5ebb6aa87a..b992070322 100644 --- a/windows/security/threat-protection/intelligence/ransomware-malware.md +++ b/windows/security/threat-protection/intelligence/ransomware-malware.md @@ -61,6 +61,6 @@ We recommend: * Educate your employees so they can identify social engineering and spear-phishing attacks. -* [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). It can stop ransomware from encrypting files and holding the files for ransom. +* [Controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/controlled-folders). It can stop ransomware from encrypting files and holding the files for ransom. For more general tips, see [prevent malware infection](prevent-malware-infection.md). From 82d09d4154a0883c286cb15a19bf382e256444a2 Mon Sep 17 00:00:00 2001 From: Guy Reginiano <45633598+guregini@users.noreply.github.com> Date: Wed, 11 Sep 2019 12:20:58 +0300 Subject: [PATCH 3/4] Arranging the paragraphs Moved the 'Improve request performance' out of the Example section (It's not part of the example). Put a whitespace after a period --- .../threat-protection/microsoft-defender-atp/update-alert.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/update-alert.md b/windows/security/threat-protection/microsoft-defender-atp/update-alert.md index ca069f5c81..8d6c69ea8d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/update-alert.md +++ b/windows/security/threat-protection/microsoft-defender-atp/update-alert.md @@ -51,7 +51,7 @@ Content-Type | String | application/json. **Required**. ## Request body -In the request body, supply the values for the relevant fields that should be updated.Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For best performance you shouldn't include existing values that haven't change. +In the request body, supply the values for the relevant fields that should be updated. Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For best performance you shouldn't include existing values that haven't change. Property | Type | Description :---|:---|:--- @@ -60,6 +60,7 @@ assignedTo | String | Owner of the alert classification | String | Specifies the specification of the alert. The property values are: 'Unknown', 'FalsePositive', 'TruePositive'. determination | String | Specifies the determination of the alert. The property values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other' +[!include[Improve request performance](improve-request-performance.md)] ## Response If successful, this method returns 200 OK, and the [alert](alerts.md) entity in the response body with the updated properties. If alert with the specified id was not found - 404 Not Found. @@ -71,8 +72,6 @@ If successful, this method returns 200 OK, and the [alert](alerts.md) entity in Here is an example of the request. -[!include[Improve request performance](improve-request-performance.md)] - ``` PATCH https://api.securitycenter.windows.com/api/alerts/121688558380765161_2136280442 Content-Type: application/json From 960fb9821fdf5cd0156bf37e2aeeb69fb459a621 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Wed, 11 Sep 2019 22:23:55 -0700 Subject: [PATCH 4/4] CAT Auto Pulish for Windows Release Messages - 20190911221309 (#1101) * remove pre-release * typo add ms author * CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190911212458 (#1100) --- .../resolved-issues-windows-10-1903.yml | 2 ++ windows/release-information/status-windows-10-1803.yml | 2 ++ .../status-windows-10-1809-and-windows-server-2019.yml | 10 ++++++++++ windows/release-information/status-windows-10-1903.yml | 4 ++++ ...status-windows-7-and-windows-server-2008-r2-sp1.yml | 4 ++-- .../configure-server-endpoints.md | 7 ++++--- 6 files changed, 24 insertions(+), 5 deletions(-) diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 348d00243a..c2c7870398 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -65,6 +66,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusDate resolved
Screenshots and Snips have an unnatural orange tint
Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

See details >		OS Build 18362.356

September 10, 2019
KB4516115		Resolved External
September 11, 2019
08:54 PM PT
Windows Desktop Search may not return any results and may have high CPU usage
Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

See details >		OS Build 18362.329

August 30, 2019
KB4512941		Resolved
KB4515384		September 10, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
+
DetailsOriginating updateStatusHistory
Screenshots and Snips have an unnatural orange tint
When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: None
Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

Back to top		OS Build 18362.356

September 10, 2019
KB4516115		Resolved External
Last updated:
September 11, 2019
08:54 PM PT

Opened:
September 11, 2019
08:54 PM PT
Windows Desktop Search may not return any results and may have high CPU usage
Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4515384.

Back to top		OS Build 18362.329

August 30, 2019
KB4512941		Resolved
KB4515384		Resolved:
September 10, 2019
10:00 AM PT

Opened:
September 04, 2019
02:25 PM PT
" diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index a227eb41e0..1fe49fd40a 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -65,6 +65,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ @@ -86,6 +87,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

See details >		OS Build 17134.950

August 13, 2019
KB4512501		Mitigated
September 11, 2019
05:32 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17134.915

July 16, 2019
KB4507466		Resolved
KB4512501		August 13, 2019
10:00 AM PT
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

See details >		N/A

Resolved
September 03, 2019
12:32 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17134.829

June 11, 2019
KB4503286		Resolved
KB4512509		August 19, 2019
02:00 PM PT
+
DetailsOriginating updateStatusHistory
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
After installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps:
  1. Close the Windows Mixed Reality Portal, if it is running.
  2. Open Task Manager by selecting the Start button and typing Task Manager.
  3. In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
  4. You can now open the Windows Mixed Reality Portal.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 17134.950

August 13, 2019
KB4512501		Mitigated
Last updated:
September 11, 2019
05:32 PM PT

Opened:
September 11, 2019
05:32 PM PT
Notification issue: \"Your device is missing important security and quality fixes.\"
Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

Affected platforms:
  • Client: Windows 10, version 1803
  • Server: Windows Server, version 1803
Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

Back to top		N/A

Resolved
Resolved:
September 03, 2019
12:32 PM PT

Opened:
September 03, 2019
12:32 PM PT
" diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index d0f9c241ed..5543553734 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,6 +64,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ @@ -81,6 +82,15 @@ sections:
" +- title: September 2019 +- items: + - type: markdown + text: " +
SummaryOriginating updateStatusLast updated
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

See details >		OS Build 17763.678

August 13, 2019
KB4511553		Mitigated
September 11, 2019
05:32 PM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 17763.652

July 22, 2019
KB4505658		Resolved
KB4511553		August 13, 2019
10:00 AM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		OS Build 17763.557

June 11, 2019
KB4503327		Resolved
KB4512534		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		OS Build 17763.678

August 13, 2019
KB4511553		Resolved
KB4512534		August 17, 2019
02:00 PM PT
+ +
DetailsOriginating updateStatusHistory
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
After installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

Affected platforms:
  • Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps:
  1. Close the Windows Mixed Reality Portal, if it is running.
  2. Open Task Manager by selecting the Start button and typing Task Manager.
  3. In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
  4. You can now open the Windows Mixed Reality Portal.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Back to top		OS Build 17763.678

August 13, 2019
KB4511553		Mitigated
Last updated:
September 11, 2019
05:32 PM PT

Opened:
September 11, 2019
05:32 PM PT
+ " + - title: August 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index d203f071d7..a33834cce2 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,6 +65,8 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

+ + @@ -94,6 +96,8 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Screenshots and Snips have an unnatural orange tint
Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

See details >		OS Build 18362.356

September 10, 2019
KB4516115		Resolved External
September 11, 2019
08:54 PM PT
Some users report issues related to the Start menu and Windows Desktop Search
Microsoft has received reports that some users are having issues related to the Start menu and Windows Desktop Search.

See details >		OS Build 18362.356

September 10, 2019
KB4515384		Acknowledged
September 11, 2019
05:18 PM PT
Windows Desktop Search may not return any results and may have high CPU usage
Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

See details >		OS Build 18362.329

August 30, 2019
KB4512941		Resolved
KB4515384		September 10, 2019
10:00 AM PT
Domain connected devices that use MIT Kerberos realms will not start up
Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
Issues updating when certain versions of Intel storage drivers are installed
Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

See details >		OS Build 18362.145

May 29, 2019
KB4497935		Resolved
KB4512941		August 30, 2019
10:00 AM PT
+ +
DetailsOriginating updateStatusHistory
Screenshots and Snips have an unnatural orange tint
When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

Affected platforms:
  • Client: Windows 10, version 1903
  • Server: None
Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

Back to top		OS Build 18362.356

September 10, 2019
KB4516115		Resolved External
Last updated:
September 11, 2019
08:54 PM PT

Opened:
September 11, 2019
08:54 PM PT
Some users report issues related to the Start menu and Windows Desktop Search
Microsoft has received reports that some users are having issues related to the Start menu and Windows Desktop Search.

Affected platforms:
  • Client: Windows 10, version 1903
Next steps: We are presently investigating and will provide an update when more information is available.

Back to top		OS Build 18362.356

September 10, 2019
KB4515384		Acknowledged
Last updated:
September 11, 2019
05:18 PM PT

Opened:
September 11, 2019
05:18 PM PT
Windows Desktop Search may not return any results and may have high CPU usage
Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

Affected platforms:
  • Client: Windows 10, version 1903
Resolution: This issue was resolved in KB4515384.

Back to top		OS Build 18362.329

August 30, 2019
KB4512941		Resolved
KB4515384		Resolved:
September 10, 2019
10:00 AM PT

Opened:
September 04, 2019
02:25 PM PT
" diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index 5722012e0f..33d09744bd 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + @@ -81,7 +81,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
You may receive an error when opening or using the Toshiba Qosmio AV Center
Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

See details >		August 13, 2019
KB4512506		Investigating
September 10, 2019
09:48 AM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center
Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

See details >		August 13, 2019
KB4512506		Investigating
September 11, 2019
08:58 PM PT
Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

See details >		August 13, 2019
KB4512506		Resolved External
August 27, 2019
02:29 PM PT
Devices starting using PXE from a WDS or SCCM servers may fail to start
Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

See details >		June 11, 2019
KB4503292		Resolved
KB4512514		August 17, 2019
02:00 PM PT
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

See details >		August 13, 2019
KB4512506		Resolved
KB4517297		August 16, 2019
02:00 PM PT
- +
DetailsOriginating updateStatusHistory
You may receive an error when opening or using the Toshiba Qosmio AV Center
After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

Affected platforms:
  • Client: Windows 7 SP1
Next steps: Microsoft is working with Toshiba to resolve this issue and will provide an update in an upcoming release.

Back to top		August 13, 2019
KB4512506		Investigating
Last updated:
September 10, 2019
09:48 AM PT

Opened:
September 10, 2019
09:48 AM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center
After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

Affected platforms:
  • Client: Windows 7 SP1
Next steps: Microsoft is working with Dynabook to resolve this issue and will provide an update in an upcoming release.

Back to top		August 13, 2019
KB4512506		Investigating
Last updated:
September 11, 2019
08:58 PM PT

Opened:
September 10, 2019
09:48 AM PT
" diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 0687aa77f4..ec708627ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -9,6 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +ms.author: macapara ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -33,7 +34,7 @@ ms.topic: article Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Microsoft Defender Security Center console. The service supports the onboarding of the following servers: -- Windows Server 2008 R2 SP1 (pre-release) +- Windows Server 2008 R2 SP1 - Windows Server 2012 R2 - Windows Server 2016 - Windows Server, version 1803 @@ -73,7 +74,7 @@ You'll need to take the following steps if you choose to onboard servers through >This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2. - Turn on server monitoring from Microsoft Defender Security Center. -- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). +- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). >[!TIP] @@ -205,7 +206,7 @@ For other server versions, you have two options to offboard servers from the ser >[!NOTE] >Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months. -### Uninstall servers by uinstalling the MMA agent +### Uninstall servers by uninstalling the MMA agent To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP. For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).