From 7711df8eabf2a2261d993124923dd915a984a2d9 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 15:32:45 -0700 Subject: [PATCH] exclusion fixes --- ...e-exclusions-windows-defender-antivirus.md | 8 +++---- ...e-exclusions-windows-defender-antivirus.md | 14 ++++++------ ...e-exclusions-windows-defender-antivirus.md | 20 +++++++++--------- ...dav-powershell-get-exclusions-variable.png | Bin 9714 -> 9323 bytes ...troubleshoot-windows-defender-antivirus.md | 3 ++- ...indows-defender-antivirus-in-windows-10.md | 3 ++- 6 files changed, 25 insertions(+), 23 deletions(-) diff --git a/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md index bed4fbf9c1..874d94951f 100644 --- a/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md @@ -12,7 +12,7 @@ localizationpriority: medium author: iaanw --- -# Configure and validate file and folder exclusions in Windows Defender AV scans +# Configure and validate file, folder, and process-opened file exclusions in Windows Defender AV scans **Applies to:** @@ -33,9 +33,9 @@ author: iaanw - Microsoft Intune - Windows Defender Security Center -You can exclude certain files, folders, processes, and process-modified files from being scanned by Windows Defender Antivirus. +You can exclude certain files, folders, processes, and process-opened files from being scanned by Windows Defender Antivirus. -The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). +The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Exclusions for process-opened files only aply to real-time protection. Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. @@ -48,5 +48,5 @@ Topic | Description ---|--- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender AV scans based on their file extension, file name, or location [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | You can exclude files from scans that have been opened by a specific process -[Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions +[Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions diff --git a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md index d4baacf3ec..3d78deccde 100644 --- a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -42,7 +42,7 @@ Exclusion | Examples | Exclusion list Any file with a specific extension | All files with the .test extension, anywhere on the machine | Extension exclusions Any file under a specific folder | All files under the c:\test\sample folder | File and folder exclusions A specific file in a specific folder | The file c:\sample\sample.test only | File and folder exclusions -A specific process | The executable file c:\test\process.exe | File and folder exclusions list +A specific process | The executable file c:\test\process.exe | File and folder exclusions This means the exclusion lists have the following characteristics: - Folder exclusions will apply to all files and folders under that folder. @@ -95,7 +95,7 @@ You can [configure how locally and globally defined exclusions lists are merged] 7. Click **OK**. -![The Group Policy setting for file and folder exclusions](images/defender/wdav-extension-exclusions.png) +![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) 8. Double-click the **Extension Exclusions** setting and add the exclusions: @@ -106,7 +106,7 @@ You can [configure how locally and globally defined exclusions lists are merged] 9. Click **OK**. -![The Group Policy setting for extension exclusions](images/defender/wdav-path-exclusions.png) +![The Group Policy setting for extension exclusions](images/defender/wdav-extension-exclusions.png) @@ -184,7 +184,7 @@ See [Add exclusions in the Windows Defender Security Center app](windows-defende ## Use wildcards in the file name and folder path or extension exclusion lists -You can use the asterisk **\***, question mark **?**, or environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the file name or folder path exclusion list. +You can use the asterisk \*, question mark ?, or environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the file name or folder path exclusion list. >[!IMPORTANT] >Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. @@ -196,8 +196,8 @@ The following table describes how the wildcards can be used and provides some ex Wildcard | Use | Example use | Example matches ---|---|---|--- -***** (asterisk) | Replaces any number of chararacters | | -**?** (question mark) | Replaces a single character | | +\* (asterisk) | Replaces any number of characters | | +? (question mark) | Replaces a single character | | Environment variables | The defined variable will be populated as a path when the exclusion is evaluated | | @@ -276,6 +276,6 @@ $client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt" - [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) +- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) - [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index c8456fa9cf..48dcf3df40 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Configure and validate exclusions for files opened by specific processes +title: Configure exclusions for files opened by specific processes description: You can exclude files from scans if they have been opened by a specific process. keywords: process, exclusion, files, scans search.product: eADQiWindows 10XVcnh @@ -12,7 +12,7 @@ localizationpriority: medium author: iaanw --- -# Configure and validate exclusions for files opened by processes +# Configure exclusions for files opened by processes **Applies to:** @@ -40,8 +40,8 @@ This topic describes how to configure exclusion lists for the following: Exclusion | Example ---|--- -Any file on the machine that is opened by any process with a specific file name | Specifying "*test.exe*" would excude files opened by: -Any file on the machine that is opened by any process under a specific folder | Specifying "*c:\test\sample\\*" would exclude files opened by: +Any file on the machine that is opened by any process with a specific file name | Specifying "*test.exe*" would exclude files opened by: +Any file on the machine that is opened by any process under a specific folder | Specifying "*c:\test\sample\\**" would exclude files opened by: Any file on the machine that is opened by a specific process in a specific folder | Specifying "*c:\test\process.exe*" would exclude files only opened by *c:\test\process.exe* When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). @@ -89,7 +89,7 @@ You can [configure how locally and globally defined exclusions lists are merged] **Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans:** -Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets with the `-ExclusionProcess' parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). +Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess' parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). The format for the cmdlets is: @@ -110,7 +110,7 @@ Remove items from the list | `Remove-MpPreference` >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by process: +For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the specified process: ```PowerShell Add-MpPreference -ExclusionProcess "c:\internal\test.exe" @@ -156,14 +156,14 @@ See [Add exclusions in the Windows Defender Security Center app](windows-defende The use of wildcards in the process exclusion list is different from their use in other exclusion lists. -In particular, you cannot use the question mark **?** wilcard, and the asterisk **\*** wildcard can only be used at the end of a complete path. You can still use environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the process exclusion list. +In particular, you cannot use the question mark ? wildcard, and the asterisk \* wildcard can only be used at the end of a complete path. You can still use environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the process exclusion list. The following table describes how the wildcards can be used in the process exclusion list: Wildcard | Use | Example use | Example matches ---|---|---|--- -**\*** (asterisk) | Replaces any number of chararacters | | -**?** (question mark) | Not available | \- | \- +\* (asterisk) | Replaces any number of characters | | +? (question mark) | Not available | \- | \- Environment variables | The defined variable will be populated as a path when the exclusion is evaluated | | @@ -212,6 +212,6 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use - [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) +- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) - [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/images/defender/wdav-powershell-get-exclusions-variable.png b/windows/keep-secure/images/defender/wdav-powershell-get-exclusions-variable.png index adf6c2b6613bff859cb30361d7fd0be1c08c2a5a..68b455b5a3d6e45bde77d3ea2d3073e370597343 100644 GIT binary patch literal 9323 zcmbVyWmsEXvvw%Otw6Ctfx-h6DPCNP6k5DEZLtP|dvI;BqQN0(6-o)3;$9pAv=18G zDI~#NPk`rrzaQT@=Q`KBugK2qwO7`fxo75Hvv!n@mMR(XJz@X=K=%BZvMvCC3&NiJ z5aMG$q4V?av0p^4&rCc30P^;$H%=-qIU`m`0Di9dlwcm0nHGn23Vcv@EqZDUR`3Md zy0`-hOAybnB2q9`q-^a0bhmQ_+qpOcsEHo1W97tGawQj6Uw1njTQC4dfsn#V$*-mE z)|OXIS;2Nr)_}){6hzo7L|0ezTtHxNOLuF4sq5ucbCT=M?L2^vme{85fa;bX5UiN+ zN^E55?ri65188AfiNwkXZtnMV2U-L6FGErPYNq7k@EH8zpTwRQ8i{63OS2)RL_3Cc!?={~`M|sg9u-qE_Mvuv8bW04c!&R( z`Y2*R1XYXwkSn`+~TeadSNddP{`z>PQsUv*2XAI&?wAi0f9$y&7+!*PT3r z${Mdz5UQ34ZZ%(WZ0F!a;Ly`Y?AwGQHibx6g4akIPF$LG*FWC$i6G*jKwO;8HE%)k zc|sS*HW`a~+jDKZ3OE1ME!!#>`zcpM z6W-1az1Jp4&%|W4zdmBJNkK;T!pKORcah(Ydl54m+$sOsAD}@!sAe0yp>W|I-gSd&P^^;l~>vEgZH3Tl6A^4;kd4% zAyhYS*-BM>OPU3^ha*X~;*q!ktL_!}Nez>pp0wjV1rPSPj*RXbd4vAJdVM zlkXH)qUi74%LKdF+P-%wHtm|5n}Y=yKF5WN{0?6DC=i6_apo~|%o0539V~c!IEYw` zdKyKFtVw;4b+nqQ&5xLMbCma22{=+YNLfiYQsrfVvix4pSo0V<$MZi37V>u4p_H+Y zLA+U|pTFDqF$42Ap@X4BOkOau_@jvZIfdi|k<+U~4^<#^JZMyoq$}w%lFGETR`Jr1 z^~!?YaU(@WyW6T(Z zE=}{V>qWbcCU7u*zt7wQdzRpbF3sgS0zTg5ed;O}4}2wz%0Nr6d0eBy{R%PYF!=8! z8pX!BeZ;XXAFnE^=tyhdUG-8*dC=XypE!F>;n#XoXr92;U^v8uBzT|d;B$~82F%#l zsl6_GS;jq2*r48yJx#Gz#irl9cgzj?X_T{d&IeqnMBAiy*pX zbm2>TCOv3y(_xN30&1N~T@hM-4s#;6@y(OGRJ0QRJeWH!2Uix_FPYBT%CQGJlnjH0 zFPtly;o#Y;sR|n*L*cr&t#y93pbs|X7sZX@Vk?0L<~dz4j45>8>6FuGV1Klo!9Na@k&z~oeHO8G*fH^Wtvx#z`BV_BvyCzM^iPg-TxieU& z&VP=DJ-3kqel#W%loICy$mGu$I_M#26gVsb+IAO#s%fmD?^E4pBWHoOyaFr2W3=<9j z-`*_hK@=2cSA08!cJtiBAE9(9Y>zv!)EEex&0=6N`hx=407TT#D_lk)6o%X}pG`9K5sH z*)#cu%QZqemw>3t8sA5nvnFaoC#Apla=z*d1ZH48maP)9JlQIbn5ojsw)e=t;Ala5 z5$i7dSTETwvkxtqR?(XKrI-6ErwlyiUsa+hh-2Sfo*4z;umSbnTKReCa1SAHzv(B@vL8o^L<`%xI`$K zpAiR}K?{bk$a0X10-ZTL!46F!J_1LTtg>L@8ON`K&7Pca9!gb|s9T2GU& zGN1Bh;p?1H9rZWy78o^#AJ$=L_hO+?Wu3n};Z9M}jaIX*ViUTkzI@i%(*bD^?+~)y zlY-rhf}F{xft_jEe>9Cu6D*Q?DETTc$JV^8U9e%+Q0pH1us@IXsE~&vkNH(3hn~7S z?Y)SegIT>bIb$hqK^wJIkMEerd$0zi3hfO)%@wWnR(T}^djl< zpqj4G7tQNCmL3klHxZeq^G4BOtnz>?@n+e9j|tM8fXUpbY1CvpXXCC~t`PqI}A$Adg`GMi+MsEFjM31EP}YxdKF zN7(q|4yk1vYabaIS)TgC&XA2g>F>2+07Vh&;0Et9=l|c> zMa2A8<}!1;#t4ScHH6jEl&()U#XlM;@g6CZb|N>m(XngBK=9X9kHV^PsuUiJopE;6 z&0PQDDejqe7GByZ!lM{M!J5w%R_9rm(2PnBR1*x*serI`IVmciVy}~j#)ZbJ`sG&>T67>;Jd>ECk55|N+j=k&$Th#1+y-Fb z(mwm3&`H3>YJTsMu(I|Sfp(+T2oBdX(T3L$A>n!CVzp)48A1$zF(Z9N^udHNyh)@G z#aTV)L%*O66cy-4!?R)?;60hMT)z?|)7=GYpRR5T7FRV3cBE)!zFsljqaJuX42Qp$ zG#<=rk=+vArP|!@*f6UrGA#EBO@_qSIW*g%Z0ho*2(FY2^#^4N`MZKx^2jq`A-!!5 zee7uF;-!7rqCYM>+n;|g_>0I2xJ@@F9pcKZD|S?i)O2s;wf%}$^8P`1tG!C5>yn4U{Jw=Yuk;Lt(2nSWN}`?^Kp|j2hd2&iIW}geYIZkL}Of`zEvy z78=DGtDI(ks_1hp^sQN$#}v6uWsOyIF*dY0;#iNW+8p#S6$L4Xf>FT3i!u-fllL zLvM7%=C<@3ygW@hB=9YtBald$P!p%_5_cvSee*dH24BIWWb8TFxaY@mRT5 zO;fXCnpMCZs*~o0TuEpE^;^bn=yNXuPVGIa)gd1CdFc*8s}nBE&NjS7h>?OTmW`M~ z#grsafxJI^XMDCBMmdXk;$YB;6XXAUqW<4%CJ?WWPhy3xo~xA;rO{x3_FKVTQ=zY8; zxs2)Fz3Ld7H)s3MPt5&2JQOmaxbN?S7tuBS`F^g$kqp)S4-75Hk)tq5^NtC!C{}c% zb(pl)ulv|vls=C?@4q={&Ng-ts|eFMBV`_ZG@;T$9MSnlOKwcZh2%CJ)(pg?agKO|KT zjFUjG+O+>1(_!6!js@{P{GoPFJ4E(j|3~-KP^aLF@aJQtmwCJ3oMWW{uYyk`mi3h@ zC=7O1T3iBNhZTJX2>n4Fk+O;x(p;~_pQp_}TK)r&=t^^q=3D+wt*o~x)!6A+afWKo z_a}dS;8k64>>Iu+wO@YaiO=|{MXYPz!IK=*T^1H9V=G#JIt;*c+bxZ&AG!2c4m<`C z71S$c2d{9iJC4CLOcGH0O8PYc`ZdG^)|}PuE{XEOEZ+y7jIg%^%vD=C%G+%gxZPQ& zQySAPirxMoZNU6~$SGBXbM)v-FN3sJOGslZC2RRS;giLO`j7ZCKC17JQCai6a>=Z$ z)*WQLzyHfDC$M<>Hr-(R5lYF1D{z^l7vSR}dAbM$vp{x=`8*_~02^sNhoE%~NZ_$a zsHVd-eS-02Rfb20m6Aus2Gfdez3#>1h^cLv_kp2g}52c?Z5RVOymN4+OO#P05PTehM=H0!W zfrym2ljkB!*Gy~xLB2HCM7I<6+`q?AiznYmBp}dz7E3|fR$Xf0#aDK#{KEcQvmKs0 z1FcfbqoL6aO&9_12c(lz2a9ZSP?g02idea=s;Q{eB=gZ}s~?3EBg`%6uI89xXD93u zKWiG6;j{T6D>EK1DrEllbYSBT&dyBf&jzp#iC2CM+6^ezdhgD9{*|mY@PwrFjwp{p zJ+|#oZYb8A-RJxaDV|^Z93q{)ZjtzTsyQ!O7VAFELYP&rMwU-a1fN|9dqit zaph+ozki5;IQjk9Cyia2eRl5in3Y%6iKmMT4lfRj!^$#t+c>Lv8#tOh4JSNe<>Yrg z{uVxMB>hdjMzU>CW=X^(PbOefawuHu=#|1za0hhcF!-#EZ%?cqBU|(Kp_c*zzUAQ^AzQ zvkE(h%iH92Z(k6Oe0@hJk~>~EbD<8#IKAg07tlht+s6JCT4tu<*a}^(zN5{;pEHr; zR*%tuFRdPq>Al1oc#>72jSQZ}r$5}Cx{BpioS@Paw>`Z9`0YsCXvu0vwq!N4U`vi| zrMC@}>#H(de0%CAdA{-aM1zAh2%*ViQ(#PS`LK%6XIw)lu%C=ROMdMIu$_p2T7f=_ zZ{#3+YX_(k%-zTl*d-n!^elxcbLyRoK-eKn36DoN>iMxiU<+6^kDUka|ueA`b z3_vsm7E=+Kfx(J*#KxBk@L0y!S_=tm?`tcJ5RC_k?D~NpNVu4^(i^pUkYtNL$Xt{u z_@nr(&I!*lF5SX{A(pS4Jl$C%Ufzu!%og(bfVdqKsbL;Y+p-oOVW4vvuPpF& z6X_W_kL!K%1ofTzR}BCdN|&t-%z3e*$>f*Qy~7dOHN20|MXU+VoD!*=+D+X*9XC3? zog;tF`QVjT&)7MBF_U$%hsZ9Kc`idhevg#dbWqd^-#G(&^M}q_hPGp+gD$QgMd!@F zG zlVLggbuVT&5?wlBNs?ayvF7hLy@GGFNLz~|$0?iPmgjVH7_R2pV>6XMk9c0o(bnE- zHzRa^wDb2D$5Al-=fL6GfWk^g21TXpSz$?sD>eRH&TEIo+Qy*t~yGX&p0fT|o0Kj_<7x8>_~QLs`|H zxJq{6V>{0D;?VNyNTJV-cgU1z40WL1GwPPCiO=EIv(do8Gb@lm>|xN)iO^pYhxoY^ zQhEx|9x1UArK1*sBcJHJG=Fj~NvW;7(^Y(WFYMFi-(TKu>~U{T)C*gH=;|d0%;{ls zKmBU0db{vF?ZA!Wzh+~Ar;M?xSai*Ps3guFuxdtj>E>Res#^mgD98vZ=u-{9dgXb_ zLR+7D$+OJ0gs1xKfCl&}>j5Z~=`nL}AM4KHS4x z%r)xV7a-Y4e_vAAUrYtQ&j-vi{u+xp4y_gSU$OBRh?8O(fzTjl_Zp`i<18`b-kUmW zrgkgL&f162QuBIgdGG6WQPjUO^xU_tOp&6yZuFy0eObSIYdiVo!A9?Q2W6h-U|vqg zhop`av8dfnY-&J_!z8DA8=qcu2Yi#lHGlwi-_9nLpMPo0>s0t=PHL)NEZiBop&t@< zouS|5>PrHAq?gMZS!0}jX9wPkKhQlm!8Be4$cXh`)xIg& zz?*7xb?@;@C!?R3EZ;O13$G{eA)avms&fHBX>#hHFE8&pUOeE9Z*Eonty$<*9(r8e zS$!-0KKSr{e(I2@I8z6*n$OLfY*S_S8J_*<=sp)o{0#ju-oSx%MwMjPq&Qve(8AtI zt|Vm1xY!d^I}-yBmFX4w2LpC_K(Tb}(q4Awp?}^c&{gaN#T>R$N5lY=wy7Fqye?BD zA|Er$B1(hLQFhh;V?uA-%ticD@|b$wo1vK)71NdoD1DUI=rx4Vy9y)9w>R2a&|2kQ z@3M2?lh=}^8N&)whD{?+>05g)CW>cEg4^yCD%Y1bh&f0QNjPdrf%O5{R3*Pqz~Nhk zyskYYo#z%8ulYuyE>e?A7e9$FJfM|mQ)$lPVGVlt#5BF~X;W>(+mFmBDXvIg`9X;o zr*zcJ)q;X{M_+O@JV=I7n@NCF2rTA zj4QA-T#%9L$73v+STe`1eNYph@&&a|FsQn;Upu#c)CBMmlj>D2OJ-65*D!7#atXHL z02C%vmRTcEs~kgozd5LRTz3a zc_g*afAdnN?-&^WRo_%X$$aO-+V7z~bK`gHp3xgLKsgVW(jH=!oV``K{1cQ_cZ3nJC?!0xuuVl=~AWu6&iFu{8EZW!l#R zNnA*M2t2q;z;*#nXcLq+O&s>#Y@)I_rj$RY^j?1{{5kE^jHL)yy>^EB3y0hJc?g6h zE-77TLbdOs!QN@;>s_TYos2^h>uGju_+&mw4$LL>n0uEMn3&$OZ@A&*dy-uP?QVLO z5Qw#z`2N_#Yh`=KapeWLPdJga%|EtroQ5yBiuS-iZ4*MGZ-$7^B% zT3B#x4+4PKPJdLb1V`l~PoLdPCW#j*3G&u;=W0Ldncr*u`=)2_s3dgn_#P-B5XEVB zA5?&P+*Jcaq_0lc64RVMLT9CncxN8I`!WK%9jW)&6^PngX(yJ&xJvf=qjQQ(df0Pj!kjsZe(Nlxq~QmoU{0WZYK5S+C=t+1|d{ zY@Fg2nMnQpdZxwV8kkS3%PZcLU4-MWbM6~K>#+IT=7mMZ_fmnZo;z10QdxPWfx+p* z(y3}bpGOsGxe{^TSL_n75P1tGcabu}l03PD+C_(vDJ8jEFJHG;1`TP5Uq0+9iT%eC z$xwU{hx9*2P>%lm|5rUtdTxnO(?zo5n7sI_k!+8KfmDpO zZjXa%(wNAg0$kW^%|BAM<6!MmwGGYrTS2!|i!}L;&aTK~lbwY1Uw1a;H$dqHcSY!K z{QfT0#_ews*z*oHBQ~i=w5ymRqDcU9#_u~=d_Io=avRX`dx&|?Qfiuw-Vg;q+Pn|b0EGM1 z&91daTkL2Cw2zTKyG#XkhnE*0WuDQ16It6J?CDh2H~6VV(7@c>@I!OV*&kmP8h(_+ z3%v}9HZ+){_r9w35Ox_cJNv@!@fHkp9xmt)za4&K>}8#bSd;I3(UDIKRye!bGfiw_#|Etw|@{*1@A&ElacP%I5GO_xS~$c7-E+#w>sWumx-&k>%EuR zS7Gvf_iNEMQ-&dhWEve`A1B|i>CdSRO<2rm$~p9%ut9UvYc|Y#PH|W~^~MKgu!Wvr zawTb=HSRk{|7_|%h8y)toN%w2ylcbhQOYi0^VI>L>9C?&hYDBSb8=|^U9~k>xrt*Q z)Bmn#c1yV+7;6;OwG$i?S+Q^hTi|)DcIBsUtAYBPIHP0rJF+S13So_r zX&Swm968MOx1Nm91}B=xT#qF2Z{8lSV@`gvKEin7Qc1WPWu)bFRRcqDwgZAn%R5}+ z5}`MYEWz$&7@IVnd{n-()>j{Y6CIbdGXEpiHc|ZIdiX1xHz0Xa_5a9C*;MGwu>5Cy z_5{V9r!u@wlTw7!vQi(v>cDZ@d2o#n@3;QKz#F%4=i>g?S^EF_fX9EnpYtDY4k0fI a-n20&x_^amV4tZ0Jb$XCT%u_4?!N%;mia#b literal 9714 zcmb_?2UJtRx-J$#q}k|I6p&s*uOdj1B7)L;Oag`u(u;snq>1z*0Vx&;2nYzFmqZ{0 z5d=anl7MtVuQ$PS&O7V9ch|c2zPDEhd;K$ec4p@L|M~uJCdSY}i}o_>Wim1{S{-c- zBQmlJVB)>sB?{tq=FChq@gJ4Dwz(G>8C?hI?_8=79UIX|>8+!GpK|5``$anT);j_& zXQumR-fGXi9o;<1K9!-hi6$CvqDcef1@v@s_jYn~CA&^_^A^#5nPgXYbNBajf;f7U zmC~aXh*r8Yt0%~wRF&J?$pu6vy-QC;ETJNm7`uVJeeFF#WY+Gdr0UdXjXQY(o$ZNL zJ;`cYz9tgQmq=z)drwy7Uiq-CSHiuHIxj=(J{{ zje=C|v6Htmi0tF)Pku5oZZaJWwa0!rD-)s4gS+qW8~Ajo-Wuw{wk^i+rPJfJ9_g%Ga*V6T}4jDatcXLl(X=K+6^>u1#jD#RELFYxqxP@L?lVy9T_m|uk1n}y0~pK`X_ZJ0Kr*-m$$ot#-` zk9`j}+-g~Fra!qJy4yJrRB{a+Ben;t2t^*vdhzj{kbBKiqs2}-PY8IupbdFk2R>-A zqBE~WkM#22VRp=#YJHi-=D(Bl67893=;$h4C+g#Nqaq_e!r||dJ(#LfHYVLv@NRC( z=Zj<9XumeC^Pad@w{~>kO$=o=oc??e~0 zCC*0eWV+x*eYdcS`}jG?Pd15f=^e(;1`sp_xR&4bMG`(_8WTd7#D`+eioT7Knb?pU zL*oN)5Qia?tJn#5WD!k4Nx8p+)Tg1P)vuG4lIp0Hb#-uecQ;Te`51)paH9VC(dJy0ad?%6;Z9FtAGo(z-}KRis^*x}3yDex zih6oMn328a^*Pn%p7&Z!XqZ&UyVvDno=CZV%hzx8!Wi8*=p%%VP zx%*6p#@2vBv|z^O868KsZbb(}TjTVu$eyF{t>GrwOF2s*n^T1jQ4iPlXXBsLzVs<3 z!o*0>x-Tm)C!}deai0z?YRxZl-3N43%Ptp^J$3x<{!teuv{UtTZsjr69FvLrPLbHD zsPsdXw*|wG$!0e9^JQ~#d0CXvnuxE?b2B{&Y(9*FZ|mKjthnf3ze|MDh+IUV!Ma6Sujkx5YHT zRR_ymD+9VWlGjEN@hx?XK44uJWX>8NK~Z;Ggw$8+RKVZ9(x6w5ab6+M2ed5}O*Xdg zH#Bq#8aGJ!L`((w03XN~Ac6#%56u!1wA#03QFsTVFXyi0cTL>u)hYS9e5vu}PgYpL zJQ=%$K05i_y*{?(-_cJZeI#4z(jv@5bX2r@id^bovFwFKxTlqxHDgOfV@f*Qk6edW z^mn8i4lWgAf?_7~ryYodv_t2Tpx7}2gC=V}{^bDV&{e;Fleq%C002=yAuUCz7sN8joINo)r zf$6{G^A!t0=>1fpqI@ehwqMrhoh@HwIJNx!&z?V!7)#2PlF zrtw6yzjh-i+N&#Fc@ZBK8_dNYt_pFN*d%B;jWOPiQY%KPnT`1uNXjVcwY|9ISiAm|4hteY2Z6dUVUT#yty0dzZWV zQ`92b54_~drA6nWJ!QvR;hB=)%su72uKDFCe?Jf70pt zj_u}dY*Sb5vs~O%Fn*~k&l#WgVY4K&D1 z8Km(R+I&CgxW4DU61+Ctlo-P?+TxBIv{b<3t`^t_^nsSXzGhvP53d#ieNVdT*si*kn@F7MXEHr>c5Xjm?xJ0e?j@onN{JN58s}Y%)!<>@7 znlZeHL>#+MN^-)rRpshsSuP zXv{_t%uJ!U@lX&X%!BebSxsY|9KoM&aHiH9?P%{hWQ}rcbzx>!6nm76&d_(o7mbOg z0%$I@PsFO4*hSun-!2=OM$-_Tk*u;ztcRD_Gi7jkA3fg4Tp_)$&)rcjwYq0d<%2{S zHmGKTQwuCZ=qrD%8}nA9U0=6XM+KvZIe*AV^f>>P@kHqCGbpsmbt~x-hIoVjT}4x+ zP5!Y}^)w}P58t6{bCKdjSkhjVy&dzS$Bgf3@9 z^ABp*o{I7|>9NYY`W*=#c+5MN+EDI)vKFH(7rULiDUw60w36Ry8yt_b;Sm|q_m`Rq z(UEFsGq*n_`GdCtAsrtIdT+ttD710VZyHYr|0GX1@Q1WG4V}@ReW*JZ;B2~p=if&TN;D=AEgGPC<&!S ztnsd0&+L{A89anWiz?6jdPEa-*Ak!a%;Sr*eGXD^y|t?BuTZb9tSNp&m`b{lcwJAv z@zovqleQa13QnF8$rTU3S=pja&g1NqLn+o;s)Q@2mU<={y-iC&bBwah!i8|c`vO>I z*6P`he>#)tf?U?EI^28w<0<)LmC4eC%>!+DHx4u1P~Z!$#2b^@i(~C8HPShB6d!4s zCNa~j<)=3ychUv`=}Tw})v(>hmP;?8$*r+0%~Vfb5YiX20& zqj#avVo`9}>Go7+;npKZ`Q@gBt_L)D{O)k?M3AIKmP+C^Z3@r^#QZA=v^g5-01}w% zVSytsJ*BrhXltGbL%vQUQ>E&l{`5-_wxz?D30bLLR}4kw--b())`F;^@l?r#pl$|} zY0q<|ZQFxeS=lLsAzf%R7j31omLb?=7{E;HvBdH4Ab!1XA#|0Tm0wwPNfOl^Xj~pI zQj0XY-X2G521cc86Wr`(u1b5qe(QR#iB0P2b8Cj~5A9%PU56 zIg@x$_SF0k0y`$(Em*ZJKtg+!tZ!JR8%K7Xwj2$`qoY=jtiXHYuOsDfLWLKEG7yq7 zRdJ>~(47b!wGlfATkpkh47B>HccHfQ3=q3r$l@?iw>5b9GV&W$6Jq*=#z9wd_qyd} zhTT%`(isJs((oCED-X#XD1_`^JSEfWmFqAqs)UTc1h=e29aJ0c#sDYAm^;cotja&v zn!Y6#IY#eVE)9$1Wwtz;4q^Owv6icS1?4_w-lVaf(U5ENI#Yk&g6Y&B^+&)qa9Aa+ zYJy@HBL3y|Zsj<=x7K>_Z&1=$;>?ccw^^DQ3cvEM#F>z^OFi;dYmlU|J|4yF)Q4`N zypwR*OU}n}?tY$kgOh`MzYMIPKHBy;PVjf#70_>g-tgFyXWtdMkYJ71cyFC6pW|%S zb|MlZ|M=%`1N6-&KQmlb0s9S)6;VePLLMueIuuo5tCtSVdXT@(jOGjL4oSQ{$;!gQ z!gCTvL@TSp`S)KWgh zp%~&AgWj3!ESq@WSA$NpbdP@NOvFw=Q*Sk`bvo8Yly?WVK*SB5j{ThltVHe3TcYxs z884J>-bdtIeR1-@v9_B98+h)3NTYjZ7;1mH`jK~tnVp;Y5?ns{C)r+B%3MUx^)81Y zQ|tK3LU%CJ_iGvs)>#b-9VqR&%6NW;M6T{x$k4U3IlmPg!Wk1jqAA`J5 zkbOg$xF^uee@^aryQWZ$bpAZP)Bz5lv%>l8g7^IQ@e0Qkq$EmPCK&+2hF86JPIsG~ z>HS*SdIZIk8g;~eaWcicZ7+qQo$-q8R{pNa)d^6OV&RUJ`kUQK=em{lBP5d%*xK)0 zHZ%-Od9xmN66?^PH8Ag;0r5-Ed-A=Co*?&{WX(CF$DpZzQE1TH`M4E`U5h#LlAW8} z`5)rv8F~odg}2Ajs0_?dHn?}){im-GGHG#mLfBnpfQ$XGccByY_p}Owq6iQg#^8&5|M? zQK1KluR>>l@T2`mILD{8hm-_Lb{*ZdrCw^2ojdk#^Wk!x+R5Q=hP zozu9)w02*l#8|pnm{}ej%}pW5Mw`TpP4HM5D<+RE9ohthNv(FJP{ z+?gOfAzvoddl;cPTqvXJHwD0aP3fO^czs&jBUhVjcCf(S+qJ~yA! zZ4~_KRSuU-we^X}KD_Fujot4~EG#)~a*a0nosM;M`705j=|O)#-r&acE?Vf=kx1;o zSWC*vpWZCyEo*HX**d7pkE;(=0qEZp-p1?l4uI^bakw=A+tD>*)8J&4_WX^rkpn zYvD8A;&)wIA#uDlqfz<7`1D@0CI0m$Cgw1A7fC;fxt*bHjO}~qs@k|p!^mVzKeNF_ z`^F5paKKdg&0Ga5g*wGKS5ziArf;ph;M-5qEr&~ zSy8;kue$*Gg>AAnLVQ{H*J{yvce0_cay4)8U*15a|KH;c7L>Yu)-eUxb#*=m)FpnL zDIr)CrLdqK#QAW*L-0xELXZp;=FGFaT!1^YN;rO#zH&I_y7GMlwr#c3rxW-50ipvh zT{y~QbU6dMD(1`89=FojbA5S9HwgTU&UjLHw>TVGX^0~MWK+D(bG|#S87C@EfCB+c zR8es2tH=MZ48a`Z^;+cB>p+t$L+%_DCavq2m)sX4JN8!E^H#_bvOJ;{=`)+CdS8su zZ$tA}ucPW~C8Dh#PI&!EXwjM+3>#vA#^M#`RRf-& ztRwXOgiX}l-LXBDgCuFj-9$O7is7qzAkLn9SqM@*zX47Q!x9OA$@+7I3%PatCutjE zv?E6BH2?6prW>;+-hC;~Lwd}&f(HZ6cU3z(wW(WSC8VJ;BUsH$e(@Eu-WEDLiscIh zmTSeXCX-d+6=4q)OKNV2GW}Q_l31wiX4=1#s&iqvy=X;vbdvhVnw4b@yN!os*y#G@ z=&^J5vo?*@Ma>e+24y;cI(v?|M#XTJrB`Mb1;2!M=MZeDF8J{ECIt({0SL*tPb5^1 zsMw~Wf`i@W4i^k1?+|^pMj_h!n7la$_W=ZJH#eXu{V)mE?NnP>qL#NIK6!(#sg#w6-~jo#sFE+; zEN*wLd4KmX^8&p6hhnM~ByC+)H3QSoxe@(Om3v0`O$30@RXfqn%zbR`^8z~4`DF4P zS+6x|bKr>FPNTnIqY!5N7W|Wn*Y=XssTUK8onY^D`|R^^PU=x7Y?jMcJ-8~?R%|T~ zurMFaz+!wO>o&&&o^cF6+ogb)+DyFR(4g=v16JYOWe*wm+hg-*&p%e86Q&5!AKgjD zgs@WNyUKf)eeGtR+U2`&d)%fZr=Kq1@A7Q-t56-jLaRl_s+s5DKS^U<*^FZzzy=JI z)@27xI+jNab$_k)*$<&GKXlo<$rXw(A6ZzvZImw9RVAr3?Q)_rm1~li&_oQmO)lTw zdig0}hsDNrEsK0#UDQY~2Uu)~9L2zbdntk#V4kEEyKDoL87K+}7Nd4Ko2R!^!oDCh zrn(^BQqgD%Mu(%1j9W(tv%!hkE7m8c42i~miwnLoKP?vCfLj6vj$H1pzw`)~IXNmF z!J82nC~-ZTXUHCuOP1Vug>p6)j-QpyZ`+S8w?4RZ+sEWRuJ zLHrp0+cl>N4B_ZX6-U;%iNH7k9{K_s5+^=%@WF5((Jc6ni%NovZVg+o>h92<$#iA< zY7=mIPD!8W;k)q4HP>nF<&~#-U>EC9nYD%ZndX*>`pW|nQQAv8=Y1`5u;T;xB<7N8 zjPO{XM{TmYz*%7AsgjuULNiKUr*A~Trl(_rX)yOgCnA14RuqVk4#gcbNDzTSlvoP%?!U_ZW}N~D)bCBvXenwvn2Qi19SX7 zQ4(GN1fs(1HZQ$Ah7A9Z=oLA-Pa+PC;qP72Z4t8CrwI&QYwyP9Nty75OxATs_PgU3 zm8J!mYx1L6P0Hi0mVj*q&VT|H%?PHEQC!h^VzO*B=H!y(M$DE6f!6rt`v!PsNd8LY z1lzK6LFqtK^QRvoI0)W8c$i{%!GpckebIDoef;`hTh21_EXkC#eeKh-1yw|1-5`>D zTni0^cQQ36ZQb6&go}#-&zMj_p8|U|Mif55&8_!IVX$b>`5g0#UlxO zeJz7Ug9>J?t|iq0*C_(=aRy}*!w6gL`@VH(;>U>uqOK6=Bym0mp`N1_x{luIP zr++S6bs2l376aN{Wdm+K(Oj@Zfkm$wTojtg|LTn1PkO>$HGD@Npdmjtzv!j1Xw6^g zhsb-Oj{ZB!@873N?liFGMRjDASUZ8BZ){xCD?gjHcYWWd4mRg89t5b)M|myUhYXv@ z7oVvVSL>R41%V_fB16E~*xCSojBmxrlsK=jnQ+^I{Okz2+g*@ro)f?=ij5CLMzA{{ zN^JUuJ|I~*dI8`2**eT4`b4KJn}=mT-N5umL5r#r1Z)uv!8q{2j=K=+gR~orgPLm! zKv;~CKKU8wJXM8^kj~21{WXJPlU7fg`Lm8zzn7?ePORjOZ??o#j;Lc8It^6}k}4TK#?UB*mJAZHlVD!fEqY?DB4dE`5x8 z*qCETchmEo3*9!=HGZ&$i6DpU{h;7`e}2rWdRYlY8ug0h`?$S1!HYUt`jH|+61hVS zLXy!15kw3fkGKlrjcZ@J1@U*#hk)J{rCxHdQl*`y4_t^ZyOqQHrTZ5@+SV@3O}I15 z_D`m@;a9Kzv%Ws9Uq!5J0yreLM@PdBbGrl1%gChbt*3 z-O0lgieqMs4ceWuCcWV3PffvrMCHc=EgLUG?HHmsZ1 z6EB?5z*>0V$9DY4ZF7IGpL@vw{y}I|^Zw?a`#XW}{SO$~uz+tFlrpc+Uno?8!woo=K1xk2xS#fe=H&dY5&bkS-T zMu@A36V3!`|7ZqY;Lx5y^jN>OGnl+rIY!SwFcxHl$wqOoaHHhyO^`y*#XMHcPE?e) zc1nv>nQyML>um?rs60s%T=W< z&EPm0gNa-f4>M15ytLxn08+yCM(9X8DUhx?6*TgV63;$dtRS5QfQ$yOhTFXu)>^{; zX_&Fl>HNiJ^}yyEQ7Rd+FsHLZxZzO7HiuSU2mPHovtWP0U+ymkk^*p~k#J;8DXgXL zopZJjU==-g7RS^nxy%rvX@0>^Byf-`AVlz$=PQ%k$NkFFG?=pi``u(xDGeq@hZ@L8 zQ_~sF9-R1GRb?%#0R-Yug*ml078f4EXH2|JHv_b!w4Vdn$`dEKPX-^DL^R@_F_e9n z?l$wN((#gR?!v(8?*^ePK9_`D&C~chzDad}5@|5_xpGAEkl{QK6i*C-v3Kj5Iw_&XTF&i{tt>PK2Ov_`=Vy*2<)3{fdw9So>{ z@ACL|xeYN`S{TBxD3ADI+aoelsYe!mNyoX^H8VLFLD7h~b|ntG${LsgpJDzr%3SU4 z`@Kf=4mTaoK;2%<_7~LtdjHyG$iqlv3qT2P{uSN|FW$&FN6ZzVT3Tn&PP%rd``iEl zP7Efk9XO`H4eVyJK!|~EOVhUk>)-Dolb%^)|ElN>eC9( zqmn!@BKohgaiuxnOgN>wJzQBtMehMZ4VGd_x@qo<^MB8vn7;wDWLOjD>TV|KLzqER z4Er5-a$B1YPxoZXBS>Chh40!nG@u}^VAc}6&@}fDXZ9DbIb6uW8)x9wcwK&nNRj;f z03veT%{a8+{f0}~KJ#ctkTnpjIK_hN_FDS%+^S@P?Q3Pgb9J99EZ^%ANRowy##0rB zl^0IK2{NuL+QFd;8LG^ZZEKazUx~U3WXz+U6#$u&-1$FLE-i#KX_GMed)rfH(Pr~M zYG~>IMK99=#Lwn@vn4y4V-E995#VZ@VuUoRssuw9fAVpi6?$^{{X3Ne{GGSMoPTa% n{TC13{NFau{=e?Tov4P{DXR`^FYXYJHj(MvH_#}%XBYk-9mV60 diff --git a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md index eabca9e983..ebca8b01c8 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md +++ b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md @@ -2,7 +2,8 @@ title: Windows Defender AV event IDs and error codes description: Look up the causes and solutions for Windows Defender Antivirus event IDs and errors keywords: event, error code, siem, logging, troubleshooting, wef, windows event forwarding -ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 +search.product: eADQiWindows 10XVcnh +ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/keep-secure/windows-defender-antivirus-in-windows-10.md b/windows/keep-secure/windows-defender-antivirus-in-windows-10.md index 243eb9a1c3..a9cdcf6735 100644 --- a/windows/keep-secure/windows-defender-antivirus-in-windows-10.md +++ b/windows/keep-secure/windows-defender-antivirus-in-windows-10.md @@ -2,7 +2,8 @@ title: Windows Defender Antivirus description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10. keywords: windows defender antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security -ms.assetid: 6A9EB85E-1F3A-40AC-9A47-F44C4A2B55E2 +search.product: eADQiWindows 10XVcnh +ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library