From 177c01c8291eb3cc7c35fb2232c6c9de729745d3 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 24 Jan 2022 17:07:01 +0500 Subject: [PATCH 1/2] Addition to note As the policy needs to have Windows 10 ver 1803 or later. Or The ADMX template file needs to be updated. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/9726 --- .../wdsc-device-security.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index 8526440bc9..8bb0a730d3 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -33,10 +33,8 @@ You can choose to hide the entire section by using Group Policy. The section wil This can only be done in Group Policy. ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. @@ -56,10 +54,8 @@ This can only be done in Group Policy. ## Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. @@ -86,6 +82,8 @@ If you don't want users to see the recommendation to update TPM firmware, you ca ## Disable Memory integrity switch If you don't want users to be able to change the Hypervisor Control Integrity (HVCI), or memory integrity, setting on their computers, you can disable the **Memory integrity** switch. +> [!IMPORTANT] +> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. @@ -95,4 +93,4 @@ If you don't want users to be able to change the Hypervisor Control Integrity (H 4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Click **OK**. -5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). \ No newline at end of file +5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). From 66053a7cea70b3817a25105a292c890655a96c3e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 24 Jan 2022 09:36:27 -0800 Subject: [PATCH 2/2] Update wdsc-device-security.md --- .../wdsc-device-security.md | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index 8bb0a730d3..547b17ac29 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -29,20 +29,18 @@ You can choose to hide the section from users of the machine. This can be useful ## Hide the Device security section -You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app. - -This can only be done in Group Policy. +You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app. You can hide the device security section by using Group Policy only. > [!IMPORTANT] > You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Hide the Device security area** setting and set it to **Enabled**. Click **OK**. +4. Open the **Hide the Device security area** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). @@ -59,11 +57,11 @@ If you don't want users to be able to click the **Clear TPM** button in the Wind 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Click **OK**. +4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). @@ -72,11 +70,11 @@ If you don't want users to see the recommendation to update TPM firmware, you ca 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Click **OK**. +4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). @@ -87,10 +85,10 @@ If you don't want users to be able to change the Hypervisor Control Integrity (H 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Click **OK**. +4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).