mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-26 04:07:22 +00:00
Merge branch 'master' into v-smandalika-BL-nonenyp-4491111
This commit is contained in:
Siddarth Mandalika
commit
779a134ae3
@ -18,16 +18,16 @@ additionalContent:
|
||||
# Card
|
||||
- title: UWP apps for education
|
||||
summary: Learn how to write universal apps for education.
|
||||
url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/
|
||||
url: https://docs.microsoft.com/windows/uwp/apps-for-education/
|
||||
# Card
|
||||
- title: Take a test API
|
||||
summary: Learn how web applications can use the API to provide a locked down experience for taking tests.
|
||||
url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/take-a-test-api
|
||||
url: https://docs.microsoft.com/windows/uwp/apps-for-education/take-a-test-api
|
||||
# Card
|
||||
- title: Office Education Dev center
|
||||
summary: Integrate with Office 365 across devices and services to extend Microsoft enterprise-scale compliance and security to students, teachers, and staff in your education app
|
||||
url: https://dev.office.com/industry-verticals/edu
|
||||
url: https://developer.microsoft.com/office/edu
|
||||
# Card
|
||||
- title: Data Streamer
|
||||
summary: Bring new STEM experiences into the classroom with real-time data in Excel using Data Streamer. Data Streamer can send data to Excel from a sensor or application.
|
||||
url: https://docs.microsoft.com/en-us/microsoft-365/education/data-streamer
|
||||
url: https://docs.microsoft.com/microsoft-365/education/data-streamer
|
||||
|
||||
@ -30,10 +30,10 @@ Windows 10, version 1607 introduces two editions designed for the unique needs o
|
||||
|
||||
Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. Windows 10 Pro Education is effectively a variant of Windows 10 Pro that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627).
|
||||
|
||||
For Cortana<sup>[1](#footnote1)</sup>,
|
||||
For Cortana<sup>[1](#footnote1)</sup>:
|
||||
- If you're using version 1607, Cortana is removed.
|
||||
- If you're using new devices with version 1703, Cortana is turned on by default.
|
||||
- If you're upgrading from version 1607 to version 1703, Cortana will be enabled.
|
||||
- If you're using new devices with version 1703 or later, Cortana is turned on by default.
|
||||
- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled.
|
||||
|
||||
You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
|
||||
|
||||
@ -49,10 +49,10 @@ Customers who deploy Windows 10 Pro are able to configure the product to have si
|
||||
|
||||
Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise-grade manageability and security desired by many schools. Windows 10 Education is effectively a variant of Windows 10 Enterprise that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627).
|
||||
|
||||
For Cortana<sup>1</sup>,
|
||||
For Cortana<sup>1</sup>:
|
||||
- If you're using version 1607, Cortana<sup>1</sup> is removed.
|
||||
- If you're using new devices with version 1703, Cortana is turned on by default.
|
||||
- If you're upgrading from version 1607 to version 1703, Cortana will be enabled.
|
||||
- If you're using new devices with version 1703 or later, Cortana is turned on by default.
|
||||
- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled.
|
||||
|
||||
You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ This article lists new and updated articles for the Mobile Device Management (MD
|
||||
|
||||
|New or updated article | Description|
|
||||
|--- | ---|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)<br>- [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)<br>- [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)<br>- [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)<br>- [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)<br>- [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)<br>- [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) |
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)<br>- [Update/DisableWUfBSafeguards](policy-csp-update.md#update-disablewufbsafeguards)<br>- [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)<br>- [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)<br>- [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)<br>- [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)<br>- [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)<br>- [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) |
|
||||
|
||||
## September 2020
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.date: 10/20/2020
|
||||
|
||||
# What's new in mobile device enrollment and management
|
||||
|
||||
This article provides information about what's new in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. This article also provide details about the breaking changes and known issues and frequently asked questions.
|
||||
This article provides information about what's new in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. This article also provides details about the breaking changes and known issues and frequently asked questions.
|
||||
|
||||
For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
@ -61,7 +61,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
|
||||
| New or updated article | Description |
|
||||
|-----|-----|
|
||||
|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings in Windows 10, version 1809:<br>- ApplicationManagement/LaunchAppAfterLogOn<br>- ApplicationManagement/ScheduleForceRestartForUpdateFailures<br>- Authentication/EnableFastFirstSignIn (Preview mode only)<br>- Authentication/EnableWebSignIn (Preview mode only)<br>- Authentication/PreferredAadTenantDomainName<br>- Browser/AllowFullScreenMode<br>- Browser/AllowPrelaunch<br>- Browser/AllowPrinting<br>- Browser/AllowSavingHistory<br>- Browser/AllowSideloadingOfExtensions<br>- Browser/AllowTabPreloading<br>- Browser/AllowWebContentOnNewTabPage<br>- Browser/ConfigureFavoritesBar<br>- Browser/ConfigureHomeButton<br>- Browser/ConfigureKioskMode<br>- Browser/ConfigureKioskResetAfterIdleTimeout<br>- Browser/ConfigureOpenMicrosoftEdgeWith<br>- Browser/ConfigureTelemetryForMicrosoft365Analytics<br>- Browser/PreventCertErrorOverrides<br>- Browser/SetHomeButtonURL<br>- Browser/SetNewTabPageURL<br>- Browser/UnlockHomeButton<br>- Defender/CheckForSignaturesBeforeRunningScan<br>- Defender/DisableCatchupFullScan<br>- Defender/DisableCatchupQuickScan<br>- Defender/EnableLowCPUPriority<br>- Defender/SignatureUpdateFallbackOrder<br>- Defender/SignatureUpdateFileSharesSources<br>- DeviceGuard/ConfigureSystemGuardLaunch<br>- DeviceInstallation/AllowInstallationOfMatchingDeviceIDs<br>- DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses<br>- DeviceInstallation/PreventDeviceMetadataFromNetwork<br>- DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings<br>- DmaGuard/DeviceEnumerationPolicy<br>- Experience/AllowClipboardHistory<br>- Experience/DoNotSyncBrowserSettings<br>- Experience/PreventUsersFromTurningOnBrowserSyncing<br>- Kerberos/UPNNameHints<br>- Privacy/AllowCrossDeviceClipboard<br>- Privacy/DisablePrivacyExperience<br>- Privacy/UploadUserActivities<br>- Security/RecoveryEnvironmentAuthentication<br>- System/AllowDeviceNameInDiagnosticData<br>- System/ConfigureMicrosoft365UploadEndpoint<br>- System/DisableDeviceDelete<br>- System/DisableDiagnosticDataViewer<br>- Storage/RemovableDiskDenyWriteAccess<br>- TaskManager/AllowEndTask<br>- Update/EngagedRestartDeadlineForFeatureUpdates<br>- Update/EngagedRestartSnoozeScheduleForFeatureUpdates<br>- Update/EngagedRestartTransitionScheduleForFeatureUpdates<br>- Update/SetDisablePauseUXAccess<br>- Update/SetDisableUXWUAccess<br>- WindowsDefenderSecurityCenter/DisableClearTpmButton<br>- WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning<br>- WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl<br>- WindowsLogon/DontDisplayNetworkSelectionUI |
|
||||
|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings in Windows 10, version 1809:<br>- ApplicationManagement/LaunchAppAfterLogOn<br>- ApplicationManagement/ScheduleForceRestartForUpdateFailures<br>- Authentication/EnableFastFirstSignIn (Preview mode only)<br>- Authentication/EnableWebSignIn (Preview mode only)<br>- Authentication/PreferredAadTenantDomainName<br>- Browser/AllowFullScreenMode<br>- Browser/AllowPrelaunch<br>- Browser/AllowPrinting<br>- Browser/AllowSavingHistory<br>- Browser/AllowSideloadingOfExtensions<br>- Browser/AllowTabPreloading<br>- Browser/AllowWebContentOnNewTabPage<br>- Browser/ConfigureFavoritesBar<br>- Browser/ConfigureHomeButton<br>- Browser/ConfigureKioskMode<br>- Browser/ConfigureKioskResetAfterIdleTimeout<br>- Browser/ConfigureOpenMicrosoftEdgeWith<br>- Browser/ConfigureTelemetryForMicrosoft365Analytics<br>- Browser/PreventCertErrorOverrides<br>- Browser/SetHomeButtonURL<br>- Browser/SetNewTabPageURL<br>- Browser/UnlockHomeButton<br>- Defender/CheckForSignaturesBeforeRunningScan<br>- Defender/DisableCatchupFullScan<br>- Defender/DisableCatchupQuickScan<br>- Defender/EnableLowCPUPriority<br>- Defender/SignatureUpdateFallbackOrder<br>- Defender/SignatureUpdateFileSharesSources<br>- DeviceGuard/ConfigureSystemGuardLaunch<br>- DeviceInstallation/AllowInstallationOfMatchingDeviceIDs<br>- DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses<br>- DeviceInstallation/PreventDeviceMetadataFromNetwork<br>- DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings<br>- DmaGuard/DeviceEnumerationPolicy<br>- Experience/AllowClipboardHistory<br>- Experience/DoNotSyncBrowserSettings<br>- Experience/PreventUsersFromTurningOnBrowserSyncing<br>- Kerberos/UPNNameHints<br>- Privacy/AllowCrossDeviceClipboard<br>- Privacy/DisablePrivacyExperience<br>- Privacy/UploadUserActivities<br>- Security/RecoveryEnvironmentAuthentication<br>- System/AllowDeviceNameInDiagnosticData<br>- System/ConfigureMicrosoft365UploadEndpoint<br>- System/DisableDeviceDelete<br>- System/DisableDiagnosticDataViewer<br>- Storage/RemovableDiskDenyWriteAccess<br>- TaskManager/AllowEndTask<br>- Update/DisableWUfBSafeguards<br>- Update/EngagedRestartDeadlineForFeatureUpdates<br>- Update/EngagedRestartSnoozeScheduleForFeatureUpdates<br>- Update/EngagedRestartTransitionScheduleForFeatureUpdates<br>- Update/SetDisablePauseUXAccess<br>- Update/SetDisableUXWUAccess<br>- WindowsDefenderSecurityCenter/DisableClearTpmButton<br>- WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning<br>- WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl<br>- WindowsLogon/DontDisplayNetworkSelectionUI |
|
||||
| [BitLocker CSP](bitlocker-csp.md) | Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro. |
|
||||
| [Defender CSP](defender-csp.md) | Added a new node Health/ProductStatus in Windows 10, version 1809. |
|
||||
| [DevDetail CSP](devdetail-csp.md) | Added a new node SMBIOSSerialNumber in Windows 10, version 1809. |
|
||||
@ -505,4 +505,4 @@ How do I turn if off? | The service can be stopped from the "Services" console o
|
||||
|
||||
## Change history for MDM documentation
|
||||
|
||||
To know what's changed in MDM documentation, see [Change history for MDM documentation](change-history-for-mdm-documentation.md).
|
||||
To know what's changed in MDM documentation, see [Change history for MDM documentation](change-history-for-mdm-documentation.md).
|
||||
|
||||
@ -5225,6 +5225,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-disabledualscan" id="update-disabledualscan">Update/DisableDualScan</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-disablewufbsafeguards" id="update-disablewufbsafeguards">Update/DisableWUfBSafeguards</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-update.md#update-engagedrestartdeadline" id="update-engagedrestartdeadline">Update/EngagedRestartDeadline</a>
|
||||
</dd>
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 02/10/2020
|
||||
ms.date: 10/21/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -96,6 +96,9 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#update-disabledualscan">Update/DisableDualScan</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-disablewufbsafeguards">Update/DisableWUfBSafeguards</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#update-engagedrestartdeadline">Update/EngagedRestartDeadline</a>
|
||||
</dd>
|
||||
@ -1110,8 +1113,8 @@ ADMX Info:
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
Supported values:
|
||||
- true - Enable
|
||||
- false - Disable (Default)
|
||||
- 0 - Disable (Default)
|
||||
- 1 - Enable
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
@ -2013,6 +2016,85 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-disablewufbsafeguards"></a>**Update/DisableWUfBSafeguards**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in Windows Update for Business (WUfB) devices running Windows 10, version 1809 and above and installed with October 2020 security update. This policy setting specifies that a WUfB device should skip safeguards.
|
||||
|
||||
Safeguard holds prevent a device with a known compatibility issue from being offered a new OS version. The offering will proceed once a fix is issued and is verified on a held device. The aim of safeguards is to protect the device and user from a failed or poor upgrade experience.
|
||||
|
||||
The safeguard holds protection is provided by default to all the devices trying to update to a new Windows 10 Feature Update version via Windows Update.
|
||||
|
||||
IT admins can, if necessary, opt devices out of safeguard protections using this policy setting or via the “Disable safeguards for Feature Updates” Group Policy.
|
||||
|
||||
> [!NOTE]
|
||||
> Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied.
|
||||
>
|
||||
> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.
|
||||
>
|
||||
> Disabling safeguards does not guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade as you are bypassing the protection given by Microsoft pertaining to known issues.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Disable safeguards for Feature Updates*
|
||||
- GP name: *DisableWUfBSafeguards*
|
||||
- GP path: *Windows Components/Windows Update/Windows Update for Business*
|
||||
- GP ADMX file name: *WindowsUpdate.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared.
|
||||
- 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="update-engagedrestartdeadline"></a>**Update/EngagedRestartDeadline**
|
||||
|
||||
@ -4525,4 +4607,3 @@ Footnotes:
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -144,6 +144,8 @@
|
||||
href: update/media-dynamic-update.md
|
||||
- name: Migrating and acquiring optional Windows content
|
||||
href: update/optional-content.md
|
||||
- name: Safeguard holds
|
||||
href: update/safeguard-holds.md
|
||||
- name: Manage the Windows 10 update experience
|
||||
items:
|
||||
- name: Manage device restarts after updates
|
||||
@ -237,6 +239,8 @@
|
||||
items:
|
||||
- name: How to troubleshoot Windows Update
|
||||
href: update/windows-update-troubleshooting.md
|
||||
- name: Opt out of safeguard holds
|
||||
href: update/safeguard-opt-out.md
|
||||
- name: Determine the source of Windows Updates
|
||||
href: update/windows-update-sources.md
|
||||
- name: Common Windows Update errors
|
||||
|
||||
BIN
windows/deployment/update/images/safeguard-hold-notification.png
Normal file
BIN
windows/deployment/update/images/safeguard-hold-notification.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
43
windows/deployment/update/safeguard-holds.md
Normal file
43
windows/deployment/update/safeguard-holds.md
Normal file
@ -0,0 +1,43 @@
|
||||
---
|
||||
title: Safeguard holds
|
||||
description: What are safeguard holds, how can you tell if one is in effect, and what to do about it
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Safeguard holds
|
||||
|
||||
Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
|
||||
|
||||
Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows 10.
|
||||
|
||||
The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices.
|
||||
Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services (WSUS)) to remain aware of known issues that might also be present in their environments.
|
||||
|
||||
|
||||
## Am I affected by a safeguard hold?
|
||||
|
||||
IT admins can use [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) to monitor various update health metrics for devices in their organization, including ones affected by a safeguard hold that prevents them from updating to a newer operating system version.
|
||||
|
||||
Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the [Windows Release Health](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) dashboard, where you can easily find information related to publicly available safeguards.
|
||||
|
||||
On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message:
|
||||
|
||||
|
||||
|
||||
|
||||
If you see this message, it means one or more holds affect your device. When the issue is fixed and the update is safe to install, we’ll release the hold and the update can resume safely.
|
||||
|
||||
## What can I do?
|
||||
|
||||
We recommend that you do not attempt to manually update until issues have been resolved and holds released.
|
||||
|
||||
> [!CAUTION]
|
||||
> Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out.
|
||||
|
||||
With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows Release Health](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, protection of safeguard holds is reinstated automatically.
|
||||
32
windows/deployment/update/safeguard-opt-out.md
Normal file
32
windows/deployment/update/safeguard-opt-out.md
Normal file
@ -0,0 +1,32 @@
|
||||
---
|
||||
title: Opt out of safeguard holds
|
||||
description: Steps to install an update even it if has a safeguard hold applied
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
author: jaimeo
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
manager: laurawi
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Opt out of safeguard holds
|
||||
|
||||
Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows 10 feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md).
|
||||
|
||||
## How can I opt out of safeguard holds?
|
||||
|
||||
IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update.
|
||||
|
||||
> [!CAUTION]
|
||||
> Opting out of a safeguard hold can put devices at risk from known performance issues.
|
||||
|
||||
We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows 10 feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business.
|
||||
|
||||
Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues.
|
||||
|
||||
> [!NOTE]
|
||||
> After a device installs a new Windows 10 version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update.
|
||||
|
||||
|
||||
|
||||
@ -47,16 +47,6 @@ Update Compliance reporting offers two queries to help you retrieve data relat
|
||||
|
||||
Update Compliance reporting will display the Safeguard IDs for known issues affecting a device in the **DeploymentErrorCode** column. Safeguard IDs for publicly discussed known issues are also included in the Windows Release Health dashboard, where you can easily find information related to publicly available safeguards.
|
||||
|
||||
### Opting out of safeguard hold
|
||||
|
||||
Microsoft will release a device from a safeguard hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired.
|
||||
To opt out, set the registry key as follows:
|
||||
|
||||
- Registry Key Path :: **Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion**
|
||||
- Create New Key :: **502505fe-762c-4e80-911e-0c3fa4c63fb0**
|
||||
- Name :: **DataRequireGatedScanForFeatureUpdates**
|
||||
- Type :: **REG_DWORD**
|
||||
- Value :: **0**
|
||||
|
||||
Setting this registry key to **0** will force the device to opt out from *all* safeguard holds. Any other value, or deleting the key, will resume compatibility protection on the device.
|
||||
### Opt out of safeguard hold
|
||||
|
||||
You can [opt out of safeguard protections](safeguard-opt-out.md) by using the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update.
|
||||
|
||||
@ -39,7 +39,7 @@ Windows 10 spreads the traditional deployment effort of a Windows upgrade, which
|
||||
> [!NOTE]
|
||||
> This strategy is applicable to approaching an environment in which Windows 10 already exists. For information about how to deploy or upgrade to Windows 10 where another version of Windows exists, see [Plan for Windows 10 deployment](../planning/index.md).
|
||||
>
|
||||
> Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version.
|
||||
> Windows 10 Enterprise LTSC is a separate Long Term Servicing Channel version.
|
||||
|
||||
Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful:
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.author: obezeajo
|
||||
manager: robsize
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 6/9/2020
|
||||
ms.date: 10/22/2020
|
||||
---
|
||||
# Manage connection endpoints for Windows 10 Enterprise, version 2004
|
||||
|
||||
@ -60,9 +60,8 @@ The following methodology was used to derive these network endpoints:
|
||||
||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*|
|
||||
|Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)|
|
||||
||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.|HTTPS|dmd.metaservices.microsoft.com|
|
||||
|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
|
||||
|Diagnostic Data|The following endpoints are used by the Windows Diagnostic Data, Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
|
||||
|||TLSv1.2|v10.events.data.microsoft.com|
|
||||
|||TLSv1.2|v20.events.data.microsoft.com|
|
||||
||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com|
|
||||
|||TLS v1.2|watson.*.microsoft.com|
|
||||
|Font Streaming|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)|
|
||||
|
||||
@ -21,8 +21,7 @@ ms.custom:
|
||||
# Manage Windows Defender Credential Guard
|
||||
|
||||
**Applies to**
|
||||
- Windows 10 <=1903 Enterprise and Education SKUs
|
||||
- Windows 10 >=1909
|
||||
- Windows 10 Enterprise or Education SKUs
|
||||
- Windows Server 2016
|
||||
- Windows Server 2019
|
||||
|
||||
@ -119,12 +118,15 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
2. Enable virtualization-based security:
|
||||
|
||||
- Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard.
|
||||
|
||||
- Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it.
|
||||
|
||||
- Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**.
|
||||
|
||||
3. Enable Windows Defender Credential Guard:
|
||||
|
||||
- Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA.
|
||||
|
||||
- Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.
|
||||
|
||||
4. Close Registry Editor.
|
||||
@ -145,6 +147,7 @@ DG_Readiness_Tool.ps1 -Enable -AutoReboot
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
>
|
||||
> This is a known issue.
|
||||
|
||||
### Review Windows Defender Credential Guard performance
|
||||
@ -171,6 +174,7 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
>
|
||||
> This is a known issue.
|
||||
|
||||
> [!NOTE]
|
||||
@ -179,15 +183,25 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
- We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible.
|
||||
|
||||
- You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for:
|
||||
- **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials.
|
||||
- **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0**
|
||||
- The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run.
|
||||
- The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**.
|
||||
- **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard.
|
||||
- **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\]
|
||||
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
|
||||
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
|
||||
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**.
|
||||
|
||||
- **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials.
|
||||
|
||||
- **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0**
|
||||
|
||||
- The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run.
|
||||
|
||||
- The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**.
|
||||
|
||||
- **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard.
|
||||
|
||||
- **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\]
|
||||
|
||||
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
|
||||
|
||||
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
|
||||
|
||||
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**.
|
||||
|
||||
- You can use Windows PowerShell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated PowerShell window and run the following command:
|
||||
|
||||
```powershell
|
||||
@ -195,10 +209,13 @@ DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
```
|
||||
|
||||
This command generates the following output:
|
||||
|
||||
- **0**: Windows Defender Credential Guard is disabled (not running)
|
||||
|
||||
- **1**: Windows Defender Credential Guard is enabled (running)
|
||||
> [!NOTE]
|
||||
> Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running.
|
||||
|
||||
> [!NOTE]
|
||||
> Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running.
|
||||
|
||||
## Disable Windows Defender Credential Guard
|
||||
|
||||
@ -207,12 +224,15 @@ To disable Windows Defender Credential Guard, you can use the following set of p
|
||||
1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**).
|
||||
|
||||
2. Delete the following registry settings:
|
||||
|
||||
- HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags
|
||||
- HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags
|
||||
|
||||
3. If you also wish to disable virtualization-based security delete the following registry settings:
|
||||
|
||||
- HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity
|
||||
- HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery.
|
||||
|
||||
@ -261,6 +281,7 @@ DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
>
|
||||
> This is a known issue.
|
||||
|
||||
#### Disable Windows Defender Credential Guard for a virtual machine
|
||||
|
||||
@ -58,11 +58,11 @@ For information about Windows Defender Remote Credential Guard hardware and soft
|
||||
|
||||
When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatibility with the reduced functionality.
|
||||
|
||||
>[!WARNING]
|
||||
> [!WARNING]
|
||||
> Enabling Windows Defender Credential Guard on domain controllers is not supported.
|
||||
> The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> Windows Defender Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Windows Defender Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts).
|
||||
|
||||
Applications will break if they require:
|
||||
@ -140,7 +140,7 @@ The following table lists qualifications for Windows 10, version 1703, which are
|
||||
|
||||
> [!IMPORTANT]
|
||||
>
|
||||
>Regarding **VBS enablement of NX protection for UEFI runtime services**:
|
||||
> Regarding **VBS enablement of NX protection for UEFI runtime services**:
|
||||
>
|
||||
> - This only applies to UEFI runtime service memory, and not UEFI boot service memory.
|
||||
>
|
||||
|
||||
@ -39,7 +39,7 @@ Clients need to trust domain controllers and the best way to do this is to ensur
|
||||
|
||||
Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template.
|
||||
|
||||
By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template a baseline to create an updated domain controller certificate template.
|
||||
By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template as a baseline to create an updated domain controller certificate template.
|
||||
|
||||
#### Create a Domain Controller Authentication (Kerberos) Certificate Template
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ Use the following table to compare different Remote Desktop connection security
|
||||
<br />
|
||||
|
||||
|
||||
| **Feature** | **Remote Desktop** | **Windows Defender Remote Credential Guard** | **Restricted Admin mode** |
|
||||
| Feature | Remote Desktop | Windows Defender Remote Credential Guard | Restricted Admin mode |
|
||||
|--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server |
|
||||
| **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**. <br /><br />For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). |
|
||||
@ -67,7 +67,7 @@ Use the following table to compare different Remote Desktop connection security
|
||||
<br />
|
||||
|
||||
For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx)
|
||||
and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot))
|
||||
and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)).
|
||||
|
||||
<br />
|
||||
|
||||
@ -92,9 +92,12 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r
|
||||
|
||||
The Remote Desktop client device:
|
||||
|
||||
- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine.
|
||||
- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine.
|
||||
|
||||
- Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host.
|
||||
|
||||
- Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard.
|
||||
|
||||
- Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk.
|
||||
|
||||
The Remote Desktop remote host:
|
||||
@ -108,9 +111,13 @@ There are no hardware requirements for Windows Defender Remote Credential Guard.
|
||||
|
||||
> [!NOTE]
|
||||
> Remote Desktop client devices running earlier versions, at minimum Windows 10 version 1607, only support signed-in credentials, so the client device must also be joined to an Active Directory domain. Both Remote Desktop client and server must either be joined to the same domain, or the Remote Desktop server can be joined to a domain that has a trust relationship to the client device's domain.
|
||||
>
|
||||
> GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials.
|
||||
|
||||
- For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication.
|
||||
|
||||
- The remote host must be running at least Windows 10 version 1607, or Windows Server 2016.
|
||||
|
||||
- The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Windows Defender Remote Credential Guard.
|
||||
|
||||
## Enable Windows Defender Remote Credential Guard
|
||||
@ -118,15 +125,20 @@ There are no hardware requirements for Windows Defender Remote Credential Guard.
|
||||
You must enable Restricted Admin or Windows Defender Remote Credential Guard on the remote host by using the Registry.
|
||||
|
||||
1. Open Registry Editor on the remote host.
|
||||
|
||||
2. Enable Restricted Admin and Windows Defender Remote Credential Guard:
|
||||
|
||||
- Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa.
|
||||
|
||||
- Add a new DWORD value named **DisableRestrictedAdmin**.
|
||||
|
||||
- To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0 to turn on Windows Defender Remote Credential Guard.
|
||||
|
||||
3. Close Registry Editor.
|
||||
|
||||
You can add this by running the following command from an elevated command prompt:
|
||||
|
||||
```
|
||||
```console
|
||||
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD
|
||||
```
|
||||
|
||||
@ -143,6 +155,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C
|
||||
|
||||
|
||||
3. Under **Use the following restricted mode**:
|
||||
|
||||
- If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used.
|
||||
|
||||
> [!NOTE]
|
||||
@ -163,7 +176,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C
|
||||
|
||||
If you don't use Group Policy in your organization, or if not all your remote hosts support Remote Credential Guard, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Windows Defender Remote Credential Guard for that connection.
|
||||
|
||||
```
|
||||
```console
|
||||
mstsc.exe /remoteGuard
|
||||
```
|
||||
|
||||
|
||||
@ -109,9 +109,7 @@ To better understand each component, review the table below:
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p><b>User</b></p>
|
||||
</td>
|
||||
<th colspan="2">User</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
@ -138,9 +136,7 @@ To better understand each component, review the table below:
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p><b>System</b></p>
|
||||
</td>
|
||||
<th colspan="2">System</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
@ -248,8 +244,7 @@ To better understand each component, review the table below:
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<p><b>Kernel</b></p>
|
||||
<th colspan="2">Kernel</th>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -276,9 +271,11 @@ The slider will never turn UAC completely off. If you set it to <b>Never notify<
|
||||
- Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt.
|
||||
- Automatically deny all elevation requests for standard users.
|
||||
|
||||
> **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**.
|
||||
>
|
||||
> **Warning:** Universal Windows apps will not work when UAC is disabled.
|
||||
> [!IMPORTANT]
|
||||
> In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**.
|
||||
|
||||
> [!WARNING]
|
||||
> Some Universal Windows Platform apps may not work when UAC is disabled.
|
||||
|
||||
### Virtualization
|
||||
|
||||
@ -291,7 +288,9 @@ Most app tasks operate properly by using virtualization features. Although virtu
|
||||
Virtualization is not an option in the following scenarios:
|
||||
|
||||
- Virtualization does not apply to apps that are elevated and run with a full administrative access token.
|
||||
|
||||
- Virtualization supports only 32-bit apps. Non-elevated 64-bit apps simply receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations.
|
||||
|
||||
- Virtualization is disabled if the app includes an app manifest with a requested execution level attribute.
|
||||
|
||||
### Request execution levels
|
||||
@ -319,6 +318,8 @@ Before a 32-bit process is created, the following attributes are checked to dete
|
||||
- Key attributes in the resource script data are linked in the executable file.
|
||||
- There are targeted sequences of bytes within the executable file.
|
||||
|
||||
> **Note:** The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies.
|
||||
>
|
||||
> **Note:** The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md).
|
||||
> [!NOTE]
|
||||
> The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies.
|
||||
|
||||
> [!NOTE]
|
||||
> The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md).
|
||||
|
||||
@ -20,9 +20,9 @@ ms.custom: bitlocker
|
||||
|
||||
# BitLocker recovery guide
|
||||
|
||||
**Applies to**
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
|
||||
This topic for IT professionals describes how to recover BitLocker keys from AD DS.
|
||||
|
||||
@ -32,56 +32,58 @@ This article assumes that you understand how to set up AD DS to back up BitLock
|
||||
|
||||
This article does not detail how to configure AD DS to store the BitLocker recovery information.
|
||||
|
||||
|
||||
## <a href="" id="bkmk-whatisrecovery"></a>What is BitLocker recovery?
|
||||
|
||||
BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario, you have the following options to restore access to the drive:
|
||||
|
||||
- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain).
|
||||
- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it.
|
||||
- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain).
|
||||
- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it.
|
||||
- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
|
||||
### What causes BitLocker recovery?
|
||||
|
||||
The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive:
|
||||
|
||||
- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout.
|
||||
- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised.
|
||||
- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD.
|
||||
- Failing to boot from a network drive before booting from the hard drive.
|
||||
- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked.
|
||||
- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition.
|
||||
- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed.
|
||||
- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM.
|
||||
- Turning off, disabling, deactivating, or clearing the TPM.
|
||||
- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change.
|
||||
- Forgetting the PIN when PIN authentication has been enabled.
|
||||
- Updating option ROM firmware.
|
||||
- Upgrading TPM firmware.
|
||||
- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
- Changes to the master boot record on the disk.
|
||||
- Changes to the boot manager on the disk.
|
||||
- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software.
|
||||
- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs.
|
||||
- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change.
|
||||
- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout.
|
||||
- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised.
|
||||
- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD.
|
||||
- Failing to boot from a network drive before booting from the hard drive.
|
||||
- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked.
|
||||
- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition.
|
||||
- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed.
|
||||
- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM.
|
||||
- Turning off, disabling, deactivating, or clearing the TPM.
|
||||
- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change.
|
||||
- Forgetting the PIN when PIN authentication has been enabled.
|
||||
- Updating option ROM firmware.
|
||||
- Upgrading TPM firmware.
|
||||
- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
- Changes to the master boot record on the disk.
|
||||
- Changes to the boot manager on the disk.
|
||||
- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software.
|
||||
- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs.
|
||||
- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change.
|
||||
|
||||
> [!NOTE]
|
||||
> Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different.
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Upgrading the motherboard to a new one with a new TPM.
|
||||
- Losing the USB flash drive containing the startup key when startup key authentication has been enabled.
|
||||
- Failing the TPM self-test.
|
||||
- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode.
|
||||
- Changing the usage authorization for the storage root key of the TPM to a non-zero value.
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Upgrading the motherboard to a new one with a new TPM.
|
||||
- Losing the USB flash drive containing the startup key when startup key authentication has been enabled.
|
||||
- Failing the TPM self-test.
|
||||
- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode.
|
||||
- Changing the usage authorization for the storage root key of the TPM to a non-zero value.
|
||||
|
||||
> [!NOTE]
|
||||
> The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value.
|
||||
|
||||
- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr).
|
||||
- Pressing the F8 or F10 key during the boot process.
|
||||
- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards.
|
||||
- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive.
|
||||
|
||||
- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr).
|
||||
- Pressing the F8 or F10 key during the boot process.
|
||||
- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards.
|
||||
- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive.
|
||||
|
||||
> [!NOTE]
|
||||
> Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components.
|
||||
@ -95,26 +97,28 @@ If software maintenance requires the computer be restarted and you are using two
|
||||
|
||||
Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user.
|
||||
|
||||
|
||||
## <a href="" id="bkmk-testingrecovery"></a>Testing recovery
|
||||
|
||||
Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The –forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation.
|
||||
|
||||
**To force a recovery for the local computer**
|
||||
**To force a recovery for the local computer:**
|
||||
|
||||
1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
`manage-bde -forcerecovery <BitLockerVolume>`
|
||||
|
||||
|
||||
**To force recovery for a remote computer**
|
||||
**To force recovery for a remote computer:**
|
||||
|
||||
1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
`manage-bde -ComputerName <RemoteComputerName> -forcerecovery <BitLockerVolume>`
|
||||
|
||||
> [!NOTE]
|
||||
> Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx).
|
||||
|
||||
|
||||
## <a href="" id="bkmk-planningrecovery"></a>Planning your recovery process
|
||||
|
||||
When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model.
|
||||
@ -125,26 +129,29 @@ After a BitLocker recovery has been initiated, users can use a recovery password
|
||||
|
||||
When you determine your recovery process, you should:
|
||||
|
||||
- Become familiar with how you can retrieve the recovery password. See:
|
||||
- Become familiar with how you can retrieve the recovery password. See:
|
||||
|
||||
- [Self-recovery](#bkmk-selfrecovery)
|
||||
- [Recovery password retrieval](#bkmk-recoveryretrieval)
|
||||
- [Self-recovery](#bkmk-selfrecovery)
|
||||
- [Recovery password retrieval](#bkmk-recoveryretrieval)
|
||||
|
||||
- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See:
|
||||
- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See:
|
||||
|
||||
- [Post-recovery analysis](#bkmk-planningpostrecovery)
|
||||
|
||||
- [Post-recovery analysis](#bkmk-planningpostrecovery)
|
||||
|
||||
### <a href="" id="bkmk-selfrecovery"></a>Self-recovery
|
||||
|
||||
In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag it would be very easy for access to be gained to the PC by an unauthorized user. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-recoveryretrieval"></a>Recovery password retrieval
|
||||
|
||||
If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain the recovery password can be backed up to AD DS. However, this does not happen by default, you must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used.
|
||||
|
||||
- **Choose how BitLocker-protected operating system drives can be recovered**
|
||||
- **Choose how BitLocker-protected fixed drives can be recovered**
|
||||
- **Choose how BitLocker-protected removable drives can be recovered**
|
||||
- **Choose how BitLocker-protected operating system drives can be recovered**
|
||||
- **Choose how BitLocker-protected fixed drives can be recovered**
|
||||
- **Choose how BitLocker-protected removable drives can be recovered**
|
||||
|
||||
In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD
|
||||
DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds.
|
||||
|
||||
@ -155,24 +162,28 @@ The BitLocker Recovery Password Viewer for Active Directory Users and Computers
|
||||
|
||||
You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool.
|
||||
|
||||
- [Record the name of the user's computer](#bkmk-recordcomputername)
|
||||
- [Verify the user's identity](#bkmk-verifyidentity)
|
||||
- [Locate the recovery password in AD DS](#bkmk-locatepassword)
|
||||
- [Gather information to determine why recovery occurred](#bkmk-gatherinfo)
|
||||
- [Give the user the recovery password](#bkmk-givepassword)
|
||||
- [Record the name of the user's computer](#bkmk-recordcomputername)
|
||||
- [Verify the user's identity](#bkmk-verifyidentity)
|
||||
- [Locate the recovery password in AD DS](#bkmk-locatepassword)
|
||||
- [Gather information to determine why recovery occurred](#bkmk-gatherinfo)
|
||||
- [Give the user the recovery password](#bkmk-givepassword)
|
||||
|
||||
|
||||
### <a href="" id="bkmk-recordcomputername"></a>Record the name of the user's computer
|
||||
|
||||
You can use the name of the user's computer to locate the recovery password in AD DS. If the user does not know the name of the computer, ask the user to read the first word of the **Drive Label** in the **BitLocker Drive Encryption Password Entry** user interface. This is the computer name when BitLocker was enabled and is probably the current name of the computer.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-verifyidentity"></a>Verify the user's identity
|
||||
|
||||
You should verify that the person that is asking for the recovery password is truly the authorized user of that computer. You may also wish to verify that the computer with the name the user provided belongs to the user.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-locatepassword"></a>Locate the recovery password in AD DS
|
||||
|
||||
Locate the Computer object with the matching name in AD DS. Because Computer object names are listed in the AD DS global catalog, you should be able to locate the object even if you have a multi-domain forest.
|
||||
|
||||
|
||||
### Multiple recovery passwords
|
||||
|
||||
If multiple recovery passwords are stored under a computer object in AD DS, the name of the BitLocker recovery information object includes the date that the password was created.
|
||||
@ -181,10 +192,12 @@ If at any time you are unsure what password to provide, or if you think you migh
|
||||
|
||||
Since the password ID is a unique value that is associated with each recovery password stored in AD DS, running a query using this ID will find the correct password to unlock the encrypted volume.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-gatherinfo"></a>Gather information to determine why recovery occurred
|
||||
|
||||
Before you give the user the recovery password, you should gather any information that will help determine why the recovery was needed, in order to analyze the root cause during the post-recovery analysis. For more info about post-recovery analysis, see [Post-recovery analysis](#bkmk-planningpostrecovery).
|
||||
|
||||
|
||||
### <a href="" id="bkmk-givepassword"></a>Give the user the recovery password
|
||||
|
||||
Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password.
|
||||
@ -192,15 +205,17 @@ Because the recovery password is 48 digits long the user may need to record the
|
||||
> [!NOTE]
|
||||
> Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-planningpostrecovery"></a>Post-recovery analysis
|
||||
|
||||
When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption
|
||||
when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted.
|
||||
|
||||
If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See:
|
||||
If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See:
|
||||
|
||||
- [Determine the root cause of the recovery](#bkmk-determinecause)
|
||||
- [Refresh BitLocker protection](#bkmk-refreshprotection)
|
||||
|
||||
- [Determine the root cause of the recovery](#bkmk-determinecause)
|
||||
- [Refresh BitLocker protection](#bkmk-refreshprotection)
|
||||
|
||||
### <a href="" id="bkmk-determinecause"></a>Determine the root cause of the recovery
|
||||
|
||||
@ -210,15 +225,16 @@ While an administrator can remotely investigate the cause of recovery in some ca
|
||||
|
||||
Review and answer the following questions for your organization:
|
||||
|
||||
1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC?
|
||||
2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be?
|
||||
3. If TPM mode was in effect, was recovery caused by a boot file change?
|
||||
4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software?
|
||||
5. When was the user last able to start the computer successfully, and what might have happened to the computer since then?
|
||||
6. Might the user have encountered malicious software or left the computer unattended since the last successful startup?
|
||||
1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC?
|
||||
2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be?
|
||||
3. If TPM mode was in effect, was recovery caused by a boot file change?
|
||||
4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software?
|
||||
5. When was the user last able to start the computer successfully, and what might have happened to the computer since then?
|
||||
6. Might the user have encountered malicious software or left the computer unattended since the last successful startup?
|
||||
|
||||
To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if boot file change occurred). Both of these capabilities can be performed remotely.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-refreshprotection"></a>Resolve the root cause
|
||||
|
||||
After you have identified what caused recovery, you can reset BitLocker protection and avoid recovery on every startup.
|
||||
@ -231,18 +247,21 @@ The details of this reset can vary according to the root cause of the recovery.
|
||||
- [Unknown PIN](#bkmk-unknownpin)
|
||||
- [Lost startup key](#bkmk-loststartup)
|
||||
- [Changes to boot files](#bkmk-changebootknown)
|
||||
### <a href="" id="bkmk-unknownpin"></a>Unknown PIN
|
||||
|
||||
|
||||
### <a href="" id="bkmk-unknownpin"></a>Unknown PIN
|
||||
|
||||
If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted.
|
||||
|
||||
**To prevent continued recovery due to an unknown PIN**
|
||||
|
||||
1. Unlock the computer using the recovery password.
|
||||
2. Reset the PIN:
|
||||
1. Right-click the drive and then click **Change PIN**
|
||||
2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time.
|
||||
3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**.
|
||||
3. You will use the new PIN the next time you unlock the drive.
|
||||
1. Unlock the computer using the recovery password.
|
||||
2. Reset the PIN:
|
||||
1. Right-click the drive and then click **Change PIN**.
|
||||
2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time.
|
||||
3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**.
|
||||
3. You will use the new PIN the next time you unlock the drive.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-loststartup"></a>Lost startup key
|
||||
|
||||
@ -250,22 +269,26 @@ If you have lost the USB flash drive that contains the startup key, then you mus
|
||||
|
||||
**To prevent continued recovery due to a lost startup key**
|
||||
|
||||
1. Log on as an administrator to the computer that has the lost startup key.
|
||||
2. Open Manage BitLocker.
|
||||
3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**.
|
||||
1. Log on as an administrator to the computer that has the lost startup key.
|
||||
2. Open Manage BitLocker.
|
||||
3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-changebootknown"></a>Changes to boot files
|
||||
|
||||
This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time.
|
||||
This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes to the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time.
|
||||
|
||||
|
||||
## Windows RE and BitLocker Device Encryption
|
||||
|
||||
Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives.
|
||||
|
||||
|
||||
## BitLocker recovery screen
|
||||
|
||||
During BitLocker recovery, Windows can display a custom recovery message and hints that identify where a key can be retrieved from. These improvements can help a user during BitLocker recovery.
|
||||
|
||||
|
||||
### Custom recovery message
|
||||
|
||||
BitLocker Group Policy settings in Windows 10, version 1511, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support.
|
||||
@ -281,9 +304,10 @@ Example of customized recovery screen:
|
||||
|
||||
|
||||
|
||||
|
||||
### BitLocker recovery key hints
|
||||
|
||||
BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where key has been saved. Hints are displayed in both the modern (blue) and legacy (black) recovery screen. This applies to both the bootmanager recovery screen and the WinRE unlock screen.
|
||||
BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed in both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen.
|
||||
|
||||
|
||||
|
||||
@ -302,6 +326,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
8. There is no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, "Contact your organization's help desk," will be displayed.
|
||||
9. If two recovery keys are present on the disk, but only one has been successfully backed up, the system will ask for a key that has been backed up, even if another key is newer.
|
||||
|
||||
|
||||
#### Example 1 (single recovery key with single backup)
|
||||
|
||||
| Custom URL | Yes |
|
||||
@ -316,6 +341,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 2 (single recovery key with single backup)
|
||||
|
||||
| Custom URL | Yes |
|
||||
@ -330,6 +356,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 3 (single recovery key with multiple backups)
|
||||
|
||||
| Custom URL | No |
|
||||
@ -344,6 +371,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 4 (multiple recovery passwords)
|
||||
|
||||
| Custom URL | No |
|
||||
@ -373,6 +401,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 5 (multiple recovery passwords)
|
||||
|
||||
| Custom URL | No |
|
||||
@ -402,10 +431,12 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
## <a href="" id="bkmk-usingaddrecovery"></a>Using additional recovery information
|
||||
|
||||
Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used.
|
||||
|
||||
|
||||
### BitLocker key package
|
||||
|
||||
If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password.
|
||||
@ -415,36 +446,37 @@ If the recovery methods discussed earlier in this document do not unlock the vol
|
||||
|
||||
The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc).
|
||||
|
||||
|
||||
## <a href="" id="bkmk-appendixb"></a>Resetting recovery passwords
|
||||
|
||||
You should invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason.
|
||||
|
||||
You can reset the recovery password in two ways:
|
||||
|
||||
- **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method.
|
||||
- **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords.
|
||||
- **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method.
|
||||
- **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords.
|
||||
|
||||
**To reset a recovery password using manage-bde**
|
||||
**To reset a recovery password using manage-bde:**
|
||||
|
||||
1. Remove the previous recovery password
|
||||
1. Remove the previous recovery password
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –delete C: –type RecoveryPassword
|
||||
```
|
||||
|
||||
2. Add the new recovery password
|
||||
2. Add the new recovery password
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –add C: -RecoveryPassword
|
||||
```
|
||||
|
||||
3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password.
|
||||
3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password.
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –get C: -Type RecoveryPassword
|
||||
```
|
||||
|
||||
4. Backup the new recovery password to AD DS
|
||||
4. Backup the new recovery password to AD DS
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692}
|
||||
@ -453,10 +485,10 @@ You can reset the recovery password in two ways:
|
||||
> [!WARNING]
|
||||
> You must include the braces in the ID string.
|
||||
|
||||
**To run the sample recovery password script**
|
||||
**To run the sample recovery password script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
|
||||
**cscript ResetPassword.vbs**
|
||||
|
||||
@ -466,7 +498,7 @@ You can reset the recovery password in two ways:
|
||||
> [!NOTE]
|
||||
> To manage a remote computer, you can specify the remote computer name rather than the local computer name.
|
||||
|
||||
You can use the following sample script to create a VBScript file to reset the recovery passwords.
|
||||
You can use the following sample script to create a VBScript file to reset the recovery passwords:
|
||||
|
||||
```vb
|
||||
' Target drive letter
|
||||
@ -539,23 +571,24 @@ WScript.Echo "A new recovery password has been added. Old passwords have been re
|
||||
'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords."
|
||||
```
|
||||
|
||||
|
||||
## <a href="" id="bkmk-appendixc"></a>Retrieving the BitLocker key package
|
||||
|
||||
You can use two methods to retrieve the key package, as described in [Using Additional Recovery Information](#bkmk-usingaddrecovery):
|
||||
|
||||
- **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS.
|
||||
- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred.
|
||||
- **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS.
|
||||
- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred.
|
||||
|
||||
The following sample script exports all previously-saved key packages from AD DS.
|
||||
|
||||
**To run the sample key package retrieval script**
|
||||
**To run the sample key package retrieval script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
|
||||
**cscript GetBitLockerKeyPackageADDS.vbs -?**
|
||||
|
||||
You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS.
|
||||
You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS:
|
||||
|
||||
```vb
|
||||
' --------------------------------------------------------------------------------
|
||||
@ -697,7 +730,7 @@ WScript.Quit
|
||||
|
||||
The following sample script exports a new key package from an unlocked, encrypted volume.
|
||||
|
||||
**To run the sample key package retrieval script**
|
||||
**To run the sample key package retrieval script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackage.vbs
|
||||
2. Open an administrator command prompt, type a command similar to the following:
|
||||
@ -882,6 +915,7 @@ Function BinaryToString(Binary)
|
||||
End Function
|
||||
```
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
|
||||
@ -82,20 +82,24 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if
|
||||
### Using System information
|
||||
|
||||
1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar.
|
||||
|
||||
2. Check the value of **Kernel DMA Protection**.
|
||||
|
||||
|
||||
|
||||
3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO:
|
||||
|
||||
- Reboot into BIOS settings
|
||||
- Turn on Intel Virtualization Technology.
|
||||
- Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md).
|
||||
- Reboot system into Windows 10.
|
||||
|
||||
>[!NOTE]
|
||||
> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES.
|
||||
>[!NOTE]
|
||||
> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection).
|
||||
|
||||
4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature.
|
||||
|
||||
For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection.
|
||||
For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection.
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
|
||||
@ -397,6 +397,7 @@
|
||||
|
||||
### [Automated investigation and response (AIR)]()
|
||||
#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md)
|
||||
#### [Automation levels in AIR](microsoft-defender-atp/automation-levels.md)
|
||||
#### [Configure AIR capabilities](microsoft-defender-atp/configure-automated-investigations-remediation.md)
|
||||
|
||||
### [Advanced hunting]()
|
||||
|
||||
@ -38,33 +38,12 @@ You can configure this security setting by opening the appropriate policy under
|
||||
|
||||
| Logon events | Description |
|
||||
| - | - |
|
||||
| 528 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. |
|
||||
| 529 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. |
|
||||
| 530 | Logon failure. A logon attempt was made user account tried to log on outside of the allowed time. |
|
||||
| 531 | Logon failure. A logon attempt was made using a disabled account. |
|
||||
| 532 | Logon failure. A logon attempt was made using an expired account. |
|
||||
| 533 | Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer. |
|
||||
| 534 | Logon failure. The user attempted to log on with a type that is not allowed. |
|
||||
| 535 | Logon failure. The password for the specified account has expired. |
|
||||
| 536 | Logon failure. The Net Logon service is not active. |
|
||||
| 537 | Logon failure. The logon attempt failed for other reasons. |
|
||||
| 538 | The logoff process was completed for a user. |
|
||||
| 539 | Logon failure. The account was locked out at the time the logon attempt was made. |
|
||||
| 540 | A user successfully logged on to a network. |
|
||||
| 541 | Main mode Internet Key Exchange (IKE) authentication was completed between the local computer and the listed peer identity (establishing a security association), or quick mode has established a data channel. |
|
||||
| 542 | A data channel was terminated. |
|
||||
| 543 | Main mode was terminated. |
|
||||
| 544 | Main mode authentication failed because the peer did not provide a valid certificate or the signature was not validated. |
|
||||
| 545 | Main mode authentication failed because of a Kerberos failure or a password that is not valid. |
|
||||
| 546 | IKE security association establishment failed because the peer sent a proposal that is not valid. A packet was received that contained data that is not valid. |
|
||||
| 547 | A failure occurred during an IKE handshake. |
|
||||
| 548 | Logon failure. The security ID (SID) from a trusted domain does not match the account domain SID of the client. |
|
||||
| 549 | Logon failure. All SIDs corresponding to untrusted namespaces were filtered out during an authentication across forests. |
|
||||
| 550 | Notification message that could indicate a possible denial-of-service attack. |
|
||||
| 551 | A user initiated the logoff process. |
|
||||
| 552 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. |
|
||||
| 682 | A user has reconnected to a disconnected terminal server session. |
|
||||
| 683 | A user disconnected a terminal server session without logging off. |
|
||||
| 4624 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. |
|
||||
| 4625 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. |
|
||||
| 4634 | The logoff process was completed for a user. |
|
||||
| 4647 | A user initiated the logoff process. |
|
||||
| 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. |
|
||||
| 4779 | A user disconnected a terminal server session without logging off. |
|
||||
|
||||
|
||||
When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type.
|
||||
|
||||
@ -12,6 +12,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.date: 10/21/2020
|
||||
---
|
||||
|
||||
# Configure and validate exclusions based on file extension and folder location
|
||||
@ -187,7 +188,7 @@ The following table describes how the wildcards can be used and provides some ex
|
||||
|Wildcard |Examples |
|
||||
|---------|---------|
|
||||
|`*` (asterisk) <br/><br/>In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument. <br/><br/>In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included. | `C:\MyData\*.txt` would include `C:\MyData\notes.txt`<br/><br/>`C:\somepath\*\Data` would include any file in `C:\somepath\Archives\Data and its subfolders` and `C:\somepath\Authorized\Data and its subfolders` <br/><br/>`C:\Serv\*\*\Backup` would include any file in `C:\Serv\Primary\Denied\Backup and its subfolders` and `C:\Serv\Secondary\Allowed\Backup and its subfolders` |
|
||||
|`?` (question mark) <br/><br/>In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument. <br/><br/>In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my` would include `C:\MyData\my1.zip` <br/><br/>`C:\somepath\?\Data` would include any file in `C:\somepath\P\Data` and its subfolders <br/><br/>`C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders |
|
||||
|`?` (question mark) <br/><br/>In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument. <br/><br/>In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my?` would include `C:\MyData\my1.zip` <br/><br/>`C:\somepath\?\Data` would include any file in `C:\somepath\P\Data` and its subfolders <br/><br/>`C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders |
|
||||
|Environment variables <br/><br/>The defined variable is populated as a path when the exclusion is evaluated. |`%ALLUSERSPROFILE%\CustomLogFiles` would include `C:\ProgramData\CustomLogFiles\Folder1\file1.txt` |
|
||||
|
||||
|
||||
|
||||
@ -61,10 +61,10 @@ You can also randomize the times when each endpoint checks and downloads protect
|
||||
|
||||
4. Click **Policies** then **Administrative templates**.
|
||||
|
||||
5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following settings:
|
||||
5. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Intelligence Updates** and configure the following settings:
|
||||
|
||||
1. Double-click the **Specify the interval to check for security intelligence updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**.
|
||||
2. Double-click the **Specify the day of the week to check for security intelligence updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**.
|
||||
1. Double-click the **Specify the day of the week to check for security intelligence updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**.
|
||||
2. Double-click the **Specify the interval to check for security intelligence updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**.
|
||||
3. Double-click the **Specify the time to check for security intelligence updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**.
|
||||
|
||||
|
||||
@ -103,8 +103,3 @@ See the following for more information and allowed parameters:
|
||||
- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.date: 10/08/2020
|
||||
ms.date: 10/21/2020
|
||||
---
|
||||
|
||||
# Manage Microsoft Defender Antivirus updates and apply baselines
|
||||
@ -319,6 +319,7 @@ The below table provides the Microsoft Defender Antivirus platform and engine ve
|
||||
|
||||
|Windows 10 release |Platform version |Engine version |Support phase |
|
||||
|-|-|-|-|
|
||||
|2004 (20H1) |4.18.2004.6 |1.1.17000.2 | Technical upgrade Support (Only) |
|
||||
|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) |
|
||||
|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) |
|
||||
|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) |
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 02/19/2019
|
||||
ms.date: 10/21/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -17,7 +17,7 @@ ms.custom: asr
|
||||
# Prepare to install Microsoft Defender Application Guard
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## Review system requirements
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.date: 09/30/2020
|
||||
ms.date: 10/21/2020
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
@ -27,15 +27,21 @@ ms.custom: AIR
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806)
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bOeh]
|
||||
|
||||
Your security operations team receives an alert whenever a malicious or suspicious artifact is detected by Microsoft Defender for Endpoint. Security operations teams face challenges in addressing the multitude of alerts that arise from the seemingly never-ending flow of threats. Microsoft Defender for Endpoint includes automated investigation and remediation capabilities that can help your security operations team address threats more efficiently and effectively.
|
||||
|
||||
Watch the following video to see how automated investigation and remediation works:
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4bOeh]
|
||||
|
||||
Automated investigation uses various inspection algorithms and processes used by analysts to examine alerts and take immediate action to resolve breaches. These capabilities significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives. The [Action center](auto-investigation-action-center.md) keeps track of all the investigations that were initiated automatically, along with details, such as investigation status, detection source, and any pending or completed actions.
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink)
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink).
|
||||
|
||||
## How the automated investigation starts
|
||||
|
||||
@ -72,28 +78,19 @@ If an incriminated entity is seen in another device, the automated investigation
|
||||
|
||||
## How threats are remediated
|
||||
|
||||
Depending on how you set up the device groups and their level of automation, each automated investigation either requires user approval (default) or automatically takes action to remediate threats.
|
||||
As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*.
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Defender for Endpoint tenants created on or after August 16, 2020 have **Full - remediate threats automatically** selected by default. You can keep the default setting, or change it according to your organizational needs. To change your settings, [adjust your device group settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation#set-up-device-groups).
|
||||
As verdicts are reached, automated investigations can result in one or more remediation actions. Examples of remediation actions include sending a file to quarantine, stopping a service, removing a scheduled task, and more. (See [Remediation actions](manage-auto-investigation.md#remediation-actions).)
|
||||
|
||||
You can configure the following levels of automation:
|
||||
Depending on the [level of automation](automation-levels.md) set for your organization, remediation actions can occur automatically or only upon approval by your security operations team.
|
||||
|
||||
|Automation level | Description|
|
||||
|---|---|
|
||||
|**Full - remediate threats automatically** | All remediation actions are performed automatically. Remediation actions that were taken can be viewed in the [Action Center](auto-investigation-action-center.md), on the **History** tab.<br/><br/>***This option is recommended** and is selected by default for tenants that were created on or after August 16, 2020 with Microsoft Defender for Endpoint, with no device groups defined yet.* <br/><br/>*If you do have a device group defined, you will also have a device group called **Ungrouped devices (default)**, which will be set to **Full - remediate threats automatically**.* |
|
||||
|**Semi - require approval for core folders remediation** | Approval is required for remediation actions on files or executables that are in core folders. Pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md). <br/><br/>Remediation actions can be taken automatically on files or executables that are in other (non-core) folders. Core folders include operating system directories, such as the **Windows** (`\windows\*`). |
|
||||
|**Semi - require approval for non-temp folders remediation** | Approval is required for remediation actions on files or executables that are not in temporary folders. Pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md).<br/><br/> Remediation actions can be taken automatically on files or executables that are in temporary folders. Temporary folders can include the following examples: <br/>- `\users\*\appdata\local\temp\*`<br/>- `\documents and settings\*\local settings\temp\*` <br/>- `\documents and settings\*\local settings\temporary\*`<br/>- `\windows\temp\*`<br/>- `\users\*\downloads\*`<br/>- `\program files\` <br/>- `\program files (x86)\*`<br/>- `\documents and settings\*\users\*` |
|
||||
|**Semi - require approval for any remediation** | Approval is required for any remediation action. Pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md).<br/><br/>*This option is selected by default for tenants that were created before August 16, 2020 with Microsoft Defender ATP, with no device groups defined.*<br/><br/>*If you do have a device group defined, you will also have a device group called **Ungrouped devices (default)**, which will be set to **Semi - require approval for any remediation**.*|
|
||||
|**No automated response** | Automated investigation does not run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation. <br/><br/>***This option is not recommended**, because it reduces the security posture of your organization's devices. [Consider setting up or changing your device groups to use **Full** or **Semi** automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups)* |
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If your tenant already has device groups defined, then the automation level settings are not changed for those device groups.
|
||||
All remediation actions, whether pending or completed, can be viewed in Action Center. If necessary, your security operations team can undo a remediation action. (See [Review and approve remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation).)
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Learn about the automated investigations dashboard](manage-auto-investigation.md)
|
||||
- [Get an overview of the automated investigations dashboard](manage-auto-investigation.md)
|
||||
|
||||
- [Learn more about automation levels](automation-levels.md)
|
||||
|
||||
- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide)
|
||||
|
||||
|
||||
@ -0,0 +1,62 @@
|
||||
---
|
||||
title: Automation levels in automated investigation and remediation
|
||||
description: Get an overview of automation levels and how they work in Microsoft Defender for Endpoint
|
||||
keywords: automated, investigation, level, defender atp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.date: 10/22/2020
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365initiative-defender-endpoint
|
||||
ms.topic: conceptual
|
||||
ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
|
||||
ms.custom: AIR
|
||||
---
|
||||
|
||||
# Automation levels in automated investigation and remediation capabilities
|
||||
|
||||
Automated investigation and remediation (AIR) capabilities in Microsoft Defender for Endpoint can be configured to one of several levels of automation. Your automation level affects whether remediation actions following AIR investigations are taken automatically or only upon approval.
|
||||
- *Full automation* (recommended) means remediation actions are taken automatically on artifacts determined to be malicious.
|
||||
- *Semi-automation* means some remediation actions are taken automatically, but other remediation actions await approval before being taken. (See the table in [Levels of automation](#levels-of-automation).)
|
||||
- All remediation actions, whether pending or completed, are tracked in the Action Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)).
|
||||
|
||||
> [!TIP]
|
||||
> For best results, we recommend using full automation when you [configure AIR](configure-automated-investigations-remediation.md). Data collected and analyzed over the past year shows that customers who are using full automation had 40% more high-confidence malware samples removed than customers who are using lower levels of automation. Full automation can help free up your security operations resources to focus more on your strategic initiatives.
|
||||
|
||||
## Levels of automation
|
||||
|
||||
The following table describes each level of automation and how it works.
|
||||
|
||||
|Automation level | Description|
|
||||
|:---|:---|
|
||||
|**Full - remediate threats automatically** <br/>(also referred to as *full automation*)| With full automation, remediation actions are performed automatically. All remediation actions that are taken can be viewed in the [Action Center](auto-investigation-action-center.md) on the **History** tab. If necessary, a remediation action can be undone.<br/><br/>***Full automation is recommended** and is selected by default for tenants that were created on or after August 16, 2020 with Microsoft Defender for Endpoint, with no device groups defined yet.* |
|
||||
|**Semi - require approval for any remediation** <br/>(also referred to as *semi-automation*)| With this level of semi-automation, approval is required for *any* remediation action. Such pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.<br/><br/>*This level of semi-automation is selected by default for tenants that were created before August 16, 2020 with Microsoft Defender ATP, with no device groups defined.*|
|
||||
|**Semi - require approval for core folders remediation** <br/>(also a type of *semi-automation*) | With this level of semi-automation, approval is required for any remediation actions needed on files or executables that are in core folders. Core folders include operating system directories, such as the **Windows** (`\windows\*`).<br/><br/>Remediation actions can be taken automatically on files or executables that are in other (non-core) folders. <br/><br/>Pending actions for files or executables in core folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab. <br/><br/>Actions that were taken on files or executables in other folders can be viewed in the [Action Center](auto-investigation-action-center.md), on the **History** tab. |
|
||||
|**Semi - require approval for non-temp folders remediation** <br/>(also a type of *semi-automation*)| With this level of semi-automation, approval is required for any remediation actions needed on files or executables that are *not* in temporary folders. <br/><br/>Temporary folders can include the following examples: <br/>- `\users\*\appdata\local\temp\*`<br/>- `\documents and settings\*\local settings\temp\*` <br/>- `\documents and settings\*\local settings\temporary\*`<br/>- `\windows\temp\*`<br/>- `\users\*\downloads\*`<br/>- `\program files\` <br/>- `\program files (x86)\*`<br/>- `\documents and settings\*\users\*`<br/><br/>Remediation actions can be taken automatically on files or executables that are in temporary folders. <br/><br/>Pending actions for files or executables that are not in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.<br/><br/>Actions that were taken on files or executables in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **History** tab. |
|
||||
|**No automated response** <br/>(also referred to as *no automation*) | With no automation, automated investigation does not run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation. However, other threat protection features, such as [protection from potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus), can be in effect, depending on how your antivirus and next-generation protection features are configured.<br/><br/>***Using the *no automation* option is not recommended**, because it reduces the security posture of your organization's devices. [Consider setting up your automation level to full automation (or at least semi-automation)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups)*. |
|
||||
|
||||
## Important points about automation levels
|
||||
|
||||
- Full automation has proven to be reliable, efficient, and safe, and is recommended for all customers. Full automation frees up your critical security resources so they can focus more on your strategic initiatives.
|
||||
|
||||
- New tenants (which include tenants that were created on or after August 16, 2020) with Microsoft Defender for Endpoint are set to full automation by default.
|
||||
|
||||
- If your security team has defined device groups with a level of automation, those settings are not changed by the new default settings that are rolling out.
|
||||
|
||||
- You can keep your default automation settings, or change them according to your organizational needs. To change your settings, [set your level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation#set-up-device-groups).
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint](configure-automated-investigations-remediation.md)
|
||||
|
||||
- [Visit the Action Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center)
|
||||
@ -31,7 +31,7 @@ ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
|
||||
|
||||
If your organization is using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/) (Microsoft Defender ATP), [automated investigation and remediation capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) can save your security operations team time and effort. As outlined in [this blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Learn more about automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations).
|
||||
|
||||
To configure automated investigation and remediation, you [turn on the features](#turn-on-automated-investigation-and-remediation), and then you [set up device groups](#set-up-device-groups).
|
||||
To configure automated investigation and remediation, [turn on the features](#turn-on-automated-investigation-and-remediation), and then [set up device groups](#set-up-device-groups).
|
||||
|
||||
## Turn on automated investigation and remediation
|
||||
|
||||
|
||||
@ -58,10 +58,10 @@ The static proxy is configurable through Group Policy (GP). The group policy can
|
||||
|
||||
- Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service
|
||||
- Set it to **Enabled** and select **Disable Authenticated Proxy usage**:
|
||||
|
||||
|
||||
- **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**:
|
||||
- Configure the proxy:<br>
|
||||
|
||||
|
||||
|
||||
The policy sets two registry values `TelemetryProxyServer` as REG_SZ and `DisableEnterpriseAuthProxy` as REG_DWORD under the registry key `HKLM\Software\Policies\Microsoft\Windows\DataCollection`.
|
||||
|
||||
@ -113,7 +113,7 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
|
||||
|
||||
|**Item**|**Description**|
|
||||
|:-----|:-----|
|
||||
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)<br/> [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) | The spreadsheet provides specific DNS records for service locations, geographic locations, and OS.
|
||||
|[](https://github.com/MicrosoftDocs/windows-docs-pr/blob/prereq-urls/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)<br/> [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) | The spreadsheet provides specific DNS records for service locations, geographic locations, and OS.
|
||||
|
||||
|
||||
If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed in the above table from HTTPS scanning.
|
||||
@ -127,11 +127,11 @@ If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> If you are using Microsoft Defender Antivirus in your environment, please refer to the following article for details on allowing connections to the Microsoft Defender Antivirus cloud service: https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus
|
||||
> If you are using Microsoft Defender Antivirus in your environment, see [Configure network connections to the Microsoft Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus).
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
|
||||
### Log analytics agent requirements
|
||||
### Microsoft Monitoring Agent (MMA) - proxy and firewall requirements for older versions of Windows client or Windows Server
|
||||
|
||||
The information below list the proxy and firewall configuration information required to communicate with Log Analytics agent (often referred to as Microsoft Monitoring Agent) for the previous versions of Windows such as Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016.
|
||||
|
||||
@ -141,25 +141,31 @@ The information below list the proxy and firewall configuration information requ
|
||||
|*.oms.opinsights.azure.com |Port 443 |Outbound|Yes |
|
||||
|*.blob.core.windows.net |Port 443 |Outbound|Yes |
|
||||
|
||||
## Microsoft Defender ATP service backend IP range
|
||||
|
||||
If your network devices don't support the URLs added to an "allow" list in the prior section, you can use the following information.
|
||||
|
||||
Microsoft Defender ATP is built on Azure cloud, deployed in the following regions:
|
||||
|
||||
- \+\<Region Name="uswestcentral">
|
||||
- \+\<Region Name="useast2">
|
||||
- \+\<Region Name="useast">
|
||||
- \+\<Region Name="europenorth">
|
||||
- \+\<Region Name="europewest">
|
||||
- \+\<Region Name="uksouth">
|
||||
- \+\<Region Name="ukwest">
|
||||
|
||||
You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https://www.microsoft.com/download/details.aspx?id=56519).
|
||||
|
||||
> [!NOTE]
|
||||
> As a cloud-based solution, the IP range can change. It's recommended you move to DNS resolving setting.
|
||||
|
||||
## Confirm Microsoft Monitoring Agent (MMA) Service URL Requirements
|
||||
|
||||
Please see the following guidance to eliminate the wildcard (*) requirement for your specific environment when using the Microsoft Monitoring Agent (MMA) for previous versions of Windows.
|
||||
|
||||
1. Onboard a previous operating system with the Microsoft Monitoring Agent (MMA) into Microsoft Defender for Endpoint (for more information, see [Onboard previous versions of Windows on Microsoft Defender ATP](https://go.microsoft.com/fwlink/p/?linkid=2010326) and [Onboard Windows servers](configure-server-endpoints.md#windows-server-2008-r2-sp1-windows-server-2012-r2-and-windows-server-2016).
|
||||
|
||||
2. Ensure the machine is successfully reporting into the Microsoft Defender Security Center portal.
|
||||
|
||||
3. Run the TestCloudConnection.exe tool from “C:\Program Files\Microsoft Monitoring Agent\Agent” to validate the connectivity and to see the required URLs for your specific workspace.
|
||||
|
||||
4. Check the Microsoft Defender for Endpoint URLs list for the complete list of requirements for your region (please refer to the Service URLs [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)).
|
||||
|
||||
|
||||
|
||||
The wildcards (*) used in *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, and *.agentsvc.azure-automation.net URL endpoints can be replaced with your specific Workspace ID. The Workspace ID is specific to your environment and workspace and can be found in the Onboarding section of your tenant within the Microsoft Defender Security Center portal.
|
||||
|
||||
The *.blob.core.windows.net URL endpoint can be replaced with the URLs shown in the “Firewall Rule: *.blob.core.windows.net” section of the test results.
|
||||
|
||||
> [!NOTE]
|
||||
> In the case of onboarding via Azure Security Center (ASC), multiple workspaces maybe used. You will need to perform the TestCloudConnection.exe procedure above on an onboarded machine from each workspace (to determine if there are any changes to the *.blob.core.windows.net URLs between the workspaces).
|
||||
|
||||
## Verify client connectivity to Microsoft Defender ATP service URLs
|
||||
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs.
|
||||
|
||||
Binary file not shown.
@ -36,9 +36,6 @@ You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/librar
|
||||
|
||||
For example, if devices are not appearing in the **Devices list**, you might need to look for event IDs on the devices. You can then use this table to determine further troubleshooting steps.
|
||||
|
||||
> [!NOTE]
|
||||
> It can take several days for devices to begin reporting to the Microsoft Defender ATP service.
|
||||
|
||||
**Open Event Viewer and find the Microsoft Defender ATP service event log:**
|
||||
|
||||
1. Click **Start** on the Windows menu, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 04/02/2019
|
||||
ms.date: 10/21/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -65,7 +65,7 @@ DeviceEvents
|
||||
You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app:
|
||||
|
||||
|Provider/source | Event ID | Description|
|
||||
|---|---|---|
|
||||
|:---|:---|:---|
|
||||
|Security-Mitigations | 1 | ACG audit |
|
||||
|Security-Mitigations | 2 | ACG enforce |
|
||||
|Security-Mitigations | 3 | Do not allow child processes audit |
|
||||
@ -100,7 +100,7 @@ The mitigations available in EMET are included natively in Windows 10 (starting
|
||||
The table in this section indicates the availability and support of native mitigations between EMET and exploit protection.
|
||||
|
||||
|Mitigation | Available under exploit protection | Available in EMET |
|
||||
|---|---|---|
|
||||
|:---|:---|:---|
|
||||
|Arbitrary code guard (ACG) | yes | yes<br />As "Memory Protection Check" |
|
||||
|Block remote images | yes | yes<br/>As "Load Library Check" |
|
||||
|Block untrusted fonts | yes | yes |
|
||||
@ -131,8 +131,6 @@ The table in this section indicates the availability and support of native mitig
|
||||
## See also
|
||||
|
||||
- [Protect devices from exploits](exploit-protection.md)
|
||||
- [Evaluate exploit protection](evaluate-exploit-protection.md)
|
||||
- [Enable exploit protection](enable-exploit-protection.md)
|
||||
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
|
||||
- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md)
|
||||
- [Optimize ASR rule deployment and detections](configure-machines-asr.md)
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 1.2 MiB |
@ -14,7 +14,7 @@ ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.topic: overview
|
||||
---
|
||||
|
||||
# Threat and vulnerability management
|
||||
|
||||
@ -23,10 +23,10 @@ ms.topic: article
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
@ -54,14 +54,23 @@ Examples of devices that should be assigned a high value:
|
||||
1. Navigate to any device page, the easiest place is from the device inventory.
|
||||
|
||||
2. Select **Device value** from three dots next to the actions bar at the top of the page.
|
||||
|
||||
|
||||
<br><br>
|
||||
|
||||
|
||||
3. A flyout will appear with the current device value and what it means. Review the value of the device and choose the one that best fits your device.
|
||||
|
||||
|
||||
## How device value impacts your exposure score
|
||||
|
||||
The exposure score is a weighted average across all devices. If you have device groups, you can also filter the score by device group.
|
||||
|
||||
- Normal devices have a weight of 1
|
||||
- Low value devices have a weight of 0.75
|
||||
- High value devices have a weight of NumberOfAssets / 10.
|
||||
- If you have 100 devices, each high value device will have a weight of 10 (100/10)
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||
- [Exposure Score](tvm-exposure-score.md)
|
||||
- [APIs](next-gen-threat-and-vuln-mgt.md#apis)
|
||||
@ -25,6 +25,7 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,6 @@ ms.topic: conceptual
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -23,6 +23,7 @@ ms.topic: conceptual
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
|
||||
@ -26,6 +26,7 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,6 +26,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,10 +22,10 @@ ms.topic: conceptual
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>[!NOTE]
|
||||
> Configuration score is now part of threat and vulnerability management as Microsoft Secure Score for Devices.
|
||||
|
||||
@ -24,6 +24,7 @@ ms.topic: conceptual
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,6 +24,7 @@ ms.topic: conceptual
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
|
||||
@ -14,6 +14,7 @@
|
||||
#### [Authorize reputable apps with Intelligent Security Graph (ISG)](use-windows-defender-application-control-with-intelligent-security-graph.md)
|
||||
#### [Use multiple WDAC policies](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
#### [Microsoft recommended block rules](microsoft-recommended-block-rules.md)
|
||||
#### [Microsoft recommended driver block rules](microsoft-recommended-driver-block-rules.md)
|
||||
### Create your initial WDAC policy
|
||||
#### [Example WDAC base policies](example-wdac-base-policies.md)
|
||||
#### [Policy creation for common WDAC usage scenarios](types-of-devices.md)
|
||||
|
||||
@ -0,0 +1,387 @@
|
||||
---
|
||||
title: Microsoft recommended driver block rules (Windows 10)
|
||||
description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community.
|
||||
keywords: security, malware, kernel mode, driver
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jgeurten
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 10/15/2020
|
||||
---
|
||||
|
||||
# Microsoft recommended driver block rules
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016 and above
|
||||
|
||||
Microsoft has strict requirements for code running in kernel. Consequently, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they are patched and rolled out to the ecosystem in an expedited manner. Microsoft then adds the vulnerable versions of the drivers to our ecosystem block policy which is applied to the following sets of devices:
|
||||
|
||||
- Hypervisor-protected code integrity (HVCI) enabled devices
|
||||
- Windows 10 in S mode (S mode) devices
|
||||
|
||||
Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events.
|
||||
|
||||
> [!Note]
|
||||
> This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. It is recommended that this policy be first validated in audit mode before rolling the rules into enforcement mode.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
|
||||
<VersionEx>10.0.19565.0</VersionEx>
|
||||
<PolicyTypeID>{D2BDA982-CCF6-4344-AC5B-0B44427B6816}</PolicyTypeID>
|
||||
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
|
||||
<Rules>
|
||||
<Rule>
|
||||
<Option>Enabled:Unsigned System Integrity Policy</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Audit Mode</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Advanced Boot Options Menu</Option>
|
||||
</Rule>
|
||||
</Rules>
|
||||
<!--EKUS-->
|
||||
<EKUs />
|
||||
<!--File Rules-->
|
||||
<FileRules>
|
||||
<Allow ID="ID_ALLOW_ALL_1" FriendlyName="" FileName="*" />
|
||||
<Allow ID="ID_ALLOW_ALL_2" FriendlyName="" FileName="*" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA1" FriendlyName="bandai.sys Hash Sha1" Hash="0F780B7ADA5DD8464D9F2CC537D973F5AC804E9C" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA256" FriendlyName="bandai.sys Hash Sha256" Hash="7FD788358585E0B863328475898BB4400ED8D478466D1B7F5CC0252671456CC8" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA1_PAGE" FriendlyName="bandai.sys Hash Page Sha1" Hash="EA360A9F23BB7CF67F08B88E6A185A699F0C5410" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA256_PAGE" FriendlyName="bandai.sys Hash Page Sha256" Hash="BB83738210650E09307CE869ACA9BFA251024D3C47B1006B94FCE2846313F56E" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA1" FriendlyName="capcom.sys Hash Sha1" Hash="1D1CAFC73C97C6BCD2331F8777D90FDCA57125A3" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA256" FriendlyName="capcom.sys Hash Sha256" Hash="FAA08CB609A5B7BE6BFDB61F1E4A5E8ADF2F5A1D2492F262483DF7326934F5D4" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA1_PAGE" FriendlyName="capcom.sys Hash Page Sha1" Hash="69006FBBD1B150FB9404867A5BCDC04FE0FC1BAD" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA256_PAGE" FriendlyName="capcom.sys Hash Page Sha256" Hash="42589C7CE89941060465096C4661654B43E38C1F9D05D66239825E8FCCF52705" />
|
||||
<Deny ID="ID_DENY_FIDDRV_SHA1" FriendlyName="fiddrv.sys Hash Sha1" Hash="8CC8974A05E81678E3D28ACFE434E7804ABD019C" />
|
||||
<Deny ID="ID_DENY_FIDDRV_SHA256" FriendlyName="fiddrv.sys Hash Sha256" Hash="97B976F7E7E5DF7AF0781BBBB33CB5F3F7A59EFDD07995253B31DE8123352A67" />
|
||||
<Deny ID="ID_DENY_FIDDRV_SHA1_PAGE" FriendlyName="fiddrv.sys Hash Page Sha1" Hash="282BB241BDA5C4C1B8EB9BF56D018896649CA0E1" />
|
||||
<Deny ID="ID_DENY_FIDDRV_SHA256_PAGE" FriendlyName="fiddrv.sys Hash Page Sha256" Hash="1ED9DA2DA2539284404E0701E6BA3C9EB37BE10353E826F425A194D247B8B7CE" />
|
||||
<Deny ID="ID_DENY_FIDDRV64_SHA1" FriendlyName="fiddrv64.sys Hash Sha1" Hash="10E15BA8FF8ED926DDD3636CEC66A0F08C9860A4" />
|
||||
<Deny ID="ID_DENY_FIDDRV64_SHA256" FriendlyName="fiddrv64.sys Hash Sha256" Hash="FEEF191064D18B6FB63B7299415D1B1E2EC8FCDD742854AA96268D0EC4A0F7B6" />
|
||||
<Deny ID="ID_DENY_FIDDRV64_SHA1_PAGE" FriendlyName="fiddrv64.sys Hash Page Sha1" Hash="E4436C8C42BA5FFABD58A3B2256F6E86CCC907AB" />
|
||||
<Deny ID="ID_DENY_FIDDRV64_SHA256_PAGE" FriendlyName="fiddrv64.sys Hash Page Sha256" Hash="2D48414647A7F9DEA30F19074EBF8F17E55E9031B8604794CEB88369C8C52532" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV_SHA1" FriendlyName="fidpcidrv.sys Hash Sha1" Hash="08596732304351B311970FF96B21F451F23B1E25" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV_SHA256" FriendlyName="fidpcidrv.sys Hash Sha256" Hash="7B7E0E1453E733050B586A6FAC91883DBB85AE0775C84C4CEB967CFC9B4EFD10" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV_SHA1_PAGE" FriendlyName="fidpcidrv.sys Hash Page Sha1" Hash="7838FB56FDAB816BC1900A4720EEA2FC9972EF7A" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV_SHA256_PAGE" FriendlyName="fidpcidrv.sys Hash Page Sha256" Hash="0893E186E236315FE78A7EF41ED71617E75D90D2D14FE93911E0D9344BEAF69F" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV64_SHA1" FriendlyName="fidpcidrv64.sys Hash Sha1" Hash="4789B910023A667BEE70FF1F1A8F369CFFB10FE8" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV64_SHA256" FriendlyName="fidpcidrv64.sys Hash Sha256" Hash="7FB0F6FC5BDD22D53F8532CB19DA666A77A66FFB1CF3919A2E22B66C13B415B7" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV64_SHA1_PAGE" FriendlyName="fidpcidrv64.sys Hash Page Sha1" Hash="EEFF4EC4EBC12C6ACD2C930DC2EAAF877CFEC7EC" />
|
||||
<Deny ID="ID_DENY_FIDPCIDRV64_SHA256_PAGE" FriendlyName="fidpcidrv64.sys Hash Page Sha256" Hash="B98E008DFEA10EC74C89D08F12F31C12F52234BE6FFFF06B6B9E749BFEA6CBED" />
|
||||
<Deny ID="ID_DENY_GDRV" FriendlyName="gdrv.sys" FileName="gdrv.sys" />
|
||||
<Deny ID="ID_DENY_GLCKIO2_SHA1" FriendlyName="GLCKIO2.sys Hash Sha1" Hash="D99B80B3269D735CAC43AF5E43483E64CA7961C3" />
|
||||
<Deny ID="ID_DENY_GLCKIO2_SHA256" FriendlyName="GLCKIO2.sys Hash Sha256" Hash="47DBA240967FD0088BE618163672DFBDDF0138178CCCD45B54037F622B221220" />
|
||||
<Deny ID="ID_DENY_GLCKIO2_SHA1_PAGE" FriendlyName="GLCKIO2.sys Hash Page Sha1" Hash="51E0740AAEE5AE76B0095C92908C97B817DB8BEA" />
|
||||
<Deny ID="ID_DENY_GLCKIO2_SHA256_PAGE" FriendlyName="GLCKIO2.sys Hash Page Sha256" Hash="E7F011E9857C7DB5AACBD424612CD7E3D12C363FDC8F072DDFAF9E2E5C85F5F3" />
|
||||
<Deny ID="ID_DENY_GVCIDRV64_SHA1" FriendlyName="GVCIDrv64.sys Hash Sha1" Hash="4EAE38E9DC262EB7B6EDE4B3D3F4AD068933845E" />
|
||||
<Deny ID="ID_DENY_GVCIDRV64_SHA256" FriendlyName="GVCIDrv64.sys Hash Sha256" Hash="2FF09BB919A9909068166C30322C4E904BEFEBA5429E9A11D011297FB8A73C07" />
|
||||
<Deny ID="ID_DENY_GVCIDRV64_SHA1_PAGE" FriendlyName="GVCIDrv64.sys Hash Page Sha1" Hash="6980122AEF4E2D5D7A6DDDB6DA76A166C460E0A1" />
|
||||
<Deny ID="ID_DENY_GVCIDRV64_SHA256_PAGE" FriendlyName="GVCIDrv64.sys Hash Page Sha256" Hash="A69247025DD32DC15E06FEE362B494BCC6105D34B8D7091F7EC3D9000BD71501" />
|
||||
<Deny ID="ID_DENY_WINFLASH64_SHA1" FriendlyName="WinFlash64.sys Hash Sha1" Hash="DA21F5889F8374C3961856D681ADEC3D663D2964" />
|
||||
<Deny ID="ID_DENY_WINFLASH64_SHA256" FriendlyName="WinFlash64.sys Hash Sha256" Hash="F2B51FBEEAD17F5EE34D5B4A3A83C848FB76F8F0E80769212E137A7AA539A3BC" />
|
||||
<Deny ID="ID_DENY_WINFLASH64_SHA1_PAGE" FriendlyName="WinFlash64.sys Hash Page Sha1" Hash="C5057A4FD3C9B58F4C9AB9FE356081DF8804BF98" />
|
||||
<Deny ID="ID_DENY_WINFLASH64_SHA256_PAGE" FriendlyName="WinFlash64.sys Hash Page Sha256" Hash="C8FA1EC3D03050FBC1AA677F2C0348690521291219E8D2E94F0EA9E9174B9156" />
|
||||
<Deny ID="ID_DENY_AMIFLDRV64_SHA1" FriendlyName="amifldrv64.sys Hash Sha1" Hash="B0EC7D971DA8AE84C0ED8F88A5D46B23996E636C" />
|
||||
<Deny ID="ID_DENY_AMIFLDRV64_SHA256C" FriendlyName="amifldrv64.sys Hash Sha256" Hash="038F39558035292F1D794B7CF49F8E751E8633DAEC31454FE85CCCBEA83BA3FB" />
|
||||
<Deny ID="ID_DENY_AMIFLDRV64_SHA1_PAGE" FriendlyName="amifldrv64.sys Hash Page Sha1" Hash="C9CC3779ED67755220DBF9592EC2AC0E1DE363DC" />
|
||||
<Deny ID="ID_DENY_AMIFLDRV64_SHA256_PAGE" FriendlyName="amifldrv64.sys Hash Page Sha256" Hash="AA594D977312A944B14351C075634E7C59B42687928FBCDA8E2C4CEA46686DD9" />
|
||||
<Deny ID="ID_DENY_ASUPIO64_SHA1F" FriendlyName="AsUpIO64.sys Hash Sha1" Hash="2A95F882DD9BAFCC57F144A2708A7EC67DD7844C" />
|
||||
<Deny ID="ID_DENY_ASUPIO64_SHA256" FriendlyName="AsUpIO64.sys Hash Sha256" Hash="7F75D91844B0C162EEB24D14BCF63B7F230E111DAA7B0A26EAA489EEB22D9057" />
|
||||
<Deny ID="ID_DENY_ASUPIO64_SHA1_PAGE" FriendlyName="AsUpIO64.sys Hash Page Sha1" Hash="316E7872A227F0EAD483D244805E9FF4D3569F6F" />
|
||||
<Deny ID="ID_DENY_ASUPIO64_SHA256_PAGE" FriendlyName="AsUpIO64.sys Hash Page Sha256" Hash="5958CBE6CF7170C4B66893777BDE66343F5536A98610BD188E10D47DB84BC04C" />
|
||||
<Deny ID="ID_DENY_BSFLASH64_SHA1" FriendlyName="BS_Flash64.sys Hash Sha1" Hash="5107438A02164E1BCEDD556A786F37F59CD04231" />
|
||||
<Deny ID="ID_DENY_BSFLASH64_SHA256" FriendlyName="BS_Flash64.sys Hash Sha256" Hash="543C3F024E4AFFD0AAFA3A229FA19DBE7A70972BB18ED6347D3492DD174EDAC5" />
|
||||
<Deny ID="ID_DENY_BSFLASH64_SHA1_PAGE" FriendlyName="BS_Flash64.sys Hash Page Sha1" Hash="26C398B86FD33B3E6C4348F780C4CF758C99C8FD" />
|
||||
<Deny ID="ID_DENY_BSFLASH64_SHA256_PAGE" FriendlyName="BS_Flash64.sys Hash Page Sha256" Hash="8BF958AFA751D7AB66EBB1FAE25679E6F0FDE72078AEFC09F1824EEFA526005E" />
|
||||
<Deny ID="ID_DENY_BSHWMIO64_SHA1" FriendlyName="BS_HWMIo64.sys Hash Sha1" Hash="3281135748C9C7A9DDACE55C648C720AF810475F" />
|
||||
<Deny ID="ID_DENY_BSHWMIO64_SHA256" FriendlyName="BS_HWMIo64.sys Hash Sha256" Hash="3DE51A3102DB7297D96B4DE5B60ACA5F3A07E8577BBBED7F755F1DE9A9C38E75" />
|
||||
<Deny ID="ID_DENY_BSHWMIO64_SHA1_PAGE" FriendlyName="BS_HWMIo64.sys Hash Page Sha1" Hash="FC5F231383FE72E298893010A9A3714B205C4110" />
|
||||
<Deny ID="ID_DENY_BSHWMIO64_SHA256_PAGE" FriendlyName="BS_HWMIo64.sys Hash Page Sha256" Hash="6AD3624CA1DC38ECEEC75234E50934B1BAD7C72621DC57DEAB09044D0135877D" />
|
||||
<Deny ID="ID_DENY_MSIO64_SHA1" FriendlyName="MsIo64.sys Hash Sha1" Hash="7E732ACB7CFAD9BA043A9350CDEFF25D742BECB8" />
|
||||
<Deny ID="ID_DENY_MSIO64_SHA256" FriendlyName="MsIo64.sys Hash Sha256" Hash="7018D515A6C781EA6097CA71D0F0603AD0D689F7EC99DB27FCACD492A9E86027" />
|
||||
<Deny ID="ID_DENY_MSIO64_SHA1_PAGE" FriendlyName="MsIo64.sys Hash Page Sha1" Hash="CDE1A50E1DF7870F8E4AFD8631E45A847C714C0A" />
|
||||
<Deny ID="ID_DENY_MSIO64_SHA256_PAGE" FriendlyName="MsIo64.sys Hash Page Sha256" Hash="05736AB8B48DF84D81CB2CC0FBDC9D3DA34C22DB67A3E71C6F4B6B3923740DD5" />
|
||||
<Deny ID="ID_DENY_PIDDRV_SHA1" FriendlyName="piddrv.sys Hash Sha1" Hash="877C6C36A155109888FE1F9797B93CB30B4957EF" />
|
||||
<Deny ID="ID_DENY_PIDDRV_SHA256" FriendlyName="piddrv.sys Hash Sha256" Hash="4E19D4CE649C28DD947424483796BEACE3656284FB0379D97DDDD320AA602BBC" />
|
||||
<Deny ID="ID_DENY_PIDDRV_SHA1_PAGE" FriendlyName="piddrv.sys Hash Page Sha1" Hash="A7D827A41B2C4B7638495CD1D77926F1BA902978" />
|
||||
<Deny ID="ID_DENY_PIDDRV_SHA256_PAGE" FriendlyName="piddrv.sys Hash Page Sha256" Hash="EAC7316089DBAF7DF79A531355547BBDA22FA0921E31BBA0D27BCC88234E9ED3" />
|
||||
<Deny ID="ID_DENY_PIDDRV64_SHA1" FriendlyName="piddrv64.sys Hash Sha1" Hash="0C2599D738D01A82EC91725F499ACEBBCFB47CC9" />
|
||||
<Deny ID="ID_DENY_PIDDRV64_SHA256" FriendlyName="piddrv64.sys Hash Sha256" Hash="B97F870C501714FA453CF18AE8A30C87D08FF1E6D784AFDBB0121AEA3DA2DC28" />
|
||||
<Deny ID="ID_DENY_PIDDRV64_SHA1_PAGE" FriendlyName="piddrv64.sys Hash Page Sha1" Hash="C978063E678233C5EFB8F002FEF000FD479CC632" />
|
||||
<Deny ID="ID_DENY_PIDDRV64_SHA256_PAGE" FriendlyName="piddrv64.sys Hash Page Sha256" Hash="1081CCD57FD35998634103AE1E736638D82351092ACD30FE75084EA6A08CA0F7" />
|
||||
<Deny ID="ID_DENY_SEMAV6MSR64_SHA1" FriendlyName="semav6msr64.sys Hash Sha1" Hash="E3DBE2AA03847DF621591A4CAD69A5609DE5C237" />
|
||||
<Deny ID="ID_DENY_SEMAV6MSR64_SHA256" FriendlyName="semav6msr64.sys Hash Sha256" Hash="EB71A8ECEF692E74AE356E8CB734029B233185EE5C2CCB6CC87CC6B36BEA65CF" />
|
||||
<Deny ID="ID_DENY_SEMAV6MSR64_SHA1_PAGE" FriendlyName="semav6msr64.sys Hash Page Sha1" Hash="F3821EC0AEF270F749DF9F44FBA91AFA5C8C38E8" />
|
||||
<Deny ID="ID_DENY_SEMAV6MSR64_SHA256_PAGE" FriendlyName="semav6msr64.sys Hash Page Sha256" Hash="4F12EE563E7496E7105D67BF64AF6B436902BE4332033AF0B5A242B206372CB7" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_CPUZ_DRIVER" FriendlyName="" FileName="cpuz.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.4.3" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_ELBY_DRIVER" FriendlyName="" FileName="ElbyCDIO.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="6.0.3.2" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_LIBNICM_DRIVER" FriendlyName="" FileName="libnicm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_MTCBSV64" FriendlyName="mtcBSv64.sys FileAttribute" FileName="mtcBSv64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="21.2.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NICM_DRIVER" FriendlyName="" FileName="NICM.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NSCM_DRIVER" FriendlyName="" FileName="nscm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_SANDRA_DRIVER" FriendlyName="" FileName="sandra.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.12.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_RTKIO64_DRIVER" FriendlyName="" FileName="rtkio64.sys " MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_RTKIOW10X64_DRIVER" FriendlyName="" FileName="rtkiow10x64.sys " MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_RTKIOW8X64_DRIVER" FriendlyName="" FileName="rtkiow8x64.sys " MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BSMI" FriendlyName="" FileName="BSMI.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.3" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_HWMIO64" FriendlyName="" FileName="BS_HWMIO64_W10.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.0.1806.2200" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_I2CIO" FriendlyName="" FileName="BS_I2cIo.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.1.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NTIOLIB" FriendlyName="" FileName="NTIOLib.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NCHGBIOS2X64" FriendlyName="" FileName="NCHGBIOS2x64.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="4.2.4.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_SEGWINDRVX64" FriendlyName="segwindrvx64.sys FileAttribute" FileName="segwindrvx64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="100.0.7.2" />
|
||||
</FileRules>
|
||||
<!--Signers-->
|
||||
<Signers>
|
||||
<Signer ID="ID_SIGNER_F_1" Name="VeriSign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="CPUID" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_CPUZ_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_F_2" Name="Microsoft Windows Third Party Component CA 2014">
|
||||
<CertRoot Type="TBS" Value="D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE" />
|
||||
<CertPublisher Value="Microsoft Windows Hardware Compatibility Publisher" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_CPUZ_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_CPUZ" Name="DigiCert EV Code Signing CA (SHA2)">
|
||||
<CertRoot Type="TBS" Value="EEC58131DC11CD7F512501B15FDBC6074C603B68CA91F7162D5A042054EDB0CF" />
|
||||
<CertPublisher Value="CPUID" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_CPUZ_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_ELBY" Name="GlobalSign Primary Object Publishing CA">
|
||||
<CertRoot Type="TBS" Value="041750993D7C9E063F02DFE74699598640911AAB" />
|
||||
<CertPublisher Value="Elaborate Bytes AG" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_ELBY_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_NOVELL" Name="VeriSign Class 3 Code Signing 2009-2 CA">
|
||||
<CertRoot Type="TBS" Value="4CDC38C800761463749C3CBD94A12F32E49877BF" />
|
||||
<CertPublisher Value="Novell, Inc." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_SANDRA" Name="GeoTrust TrustCenter CodeSigning CA I">
|
||||
<CertRoot Type="TBS" Value="172F39BCA3DDA7C6D5169C96B34A5FE7E96FF0BD" />
|
||||
<CertPublisher Value="SiSoftware Ltd" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_SANDRA_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_MIMIKATZ_KERNEL" Name="GlobalSign CodeSigning CA - G2">
|
||||
<CertRoot Type="TBS" Value="589A7D4DF869395601BA7538A65AFAE8C4616385" />
|
||||
<CertPublisher Value="Benjamin Delpy" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_MIMIKATZ_USER" Name="Certum Code Signing CA SHA2">
|
||||
<CertRoot Type="TBS" Value="F7B6EEB3A567223000A61F68C53B458193557C17E5D512D2825BCB13E5FC9BE5" />
|
||||
<CertPublisher Value="Open Source Developer, Benjamin Delpy" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_SPEEDFAN" Name="VeriSign Class 3 Code Signing 2004 CA">
|
||||
<CertRoot Type="TBS" Value="C7FC1727F5B75A6421A1F95C73BBDB23580C48E5" />
|
||||
<CertPublisher Value="Sokno S.R.L." />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_RWEVERY" Name="GlobalSign CodeSigning CA - G2">
|
||||
<CertRoot Type="TBS" Value="589A7D4DF869395601BA7538A65AFAE8C4616385" />
|
||||
<CertPublisher Value="ChongKim Chan" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VBOX" Name="GlobalSign Primary Object Publishing CA">
|
||||
<CertRoot Type="TBS" Value="041750993D7C9E063F02DFE74699598640911AAB" />
|
||||
<CertPublisher Value="innotek GmbH" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_REALTEK" Name="DigiCert EV Code Signing CA">
|
||||
<CertRoot Type="TBS" Value="2D54C16A8F8B69CCDEA48D0603C132F547A5CF75" />
|
||||
<CertPublisher Value="Realtek Semiconductor Corp." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIO64_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIOW10X64_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIOW8X64_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_REALTEK_2" Name="DigiCert EV Code Signing CA (SHA2)">
|
||||
<CertRoot Type="TBS" Value="EEC58131DC11CD7F512501B15FDBC6074C603B68CA91F7162D5A042054EDB0CF" />
|
||||
<CertPublisher Value="Realtek Semiconductor Corp." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIO64_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIOW10X64_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIOW8X64_DRIVER" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_WINDOWS_3RD_PARTY_2014" Name="Microsoft Windows Third Party Component CA 2014">
|
||||
<CertRoot Type="TBS" Value="D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE" />
|
||||
<CertPublisher Value="Microsoft Windows Hardware Compatibility Publisher" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIOW10X64_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_BS_HWMIO64" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VERISIGN_2004" Name="VeriSign Class 3 Code Signing 2004 CA">
|
||||
<CertRoot Type="TBS" Value="C7FC1727F5B75A6421A1F95C73BBDB23580C48E5" />
|
||||
<CertPublisher Value="Mitac Technology Corporation" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_MTCBSV64" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VERISIGN_2009" Name="VeriSign Class 3 Code Signing 2009-2 CA">
|
||||
<CertRoot Type="TBS" Value="4CDC38C800761463749C3CBD94A12F32E49877BF" />
|
||||
<CertPublisher Value="BIOSTAR MICROTECH INT'L CORP" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_BSMI" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VERISIGN_BIOSTAR" Name="VeriSign Class 3 Code Signing 2004 CA">
|
||||
<CertRoot Type="TBS" Value="C7FC1727F5B75A6421A1F95C73BBDB23580C48E5" />
|
||||
<CertPublisher Value="BIOSTAR MICROTECH INT'L CORP" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_BS_I2CIO" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_GLOBALSIGN_G2_MICROSTAR" Name="GlobalSign CodeSigning CA - G2">
|
||||
<CertRoot Type="TBS" Value="589A7D4DF869395601BA7538A65AFAE8C4616385" />
|
||||
<CertPublisher Value="MICRO-STAR INTERNATIONAL CO., LTD." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NTIOLIB" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VERISIGN_TOSHIBA" Name="VeriSign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="TOSHIBA CORPORATION" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCHGBIOS2X64" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_GLOBALSIGN_MICROSTAR" Name="GlobalSign Primary Object Publishing CA">
|
||||
<CertRoot Type="TBS" Value="041750993D7C9E063F02DFE74699598640911AAB" />
|
||||
<CertPublisher Value="Micro-Star Int'l Co. Ltd." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NTIOLIB" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VERISIGN_INSYDE" Name="VeriSign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="Insyde Software Corp." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_SEGWINDRVX64" />
|
||||
</Signer>
|
||||
</Signers>
|
||||
<!--Driver Signing Scenarios-->
|
||||
<SigningScenarios>
|
||||
<SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_DENIED_VULN_MAL_SIGNERS" FriendlyName="Signers of known vulnerable or malicious drivers">
|
||||
<ProductSigners>
|
||||
<DeniedSigners>
|
||||
<DeniedSigner SignerId="ID_SIGNER_MIMIKATZ_KERNEL" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_MIMIKATZ_USER" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NOVELL" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_RWEVERY" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SANDRA" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SPEEDFAN" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_CPUZ" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_ELBY" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_F_1" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_F_2" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_REALTEK" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_REALTEK_2" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2004" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_WINDOWS_3RD_PARTY_2014" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2009" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_BIOSTAR" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_GLOBALSIGN_G2_MICROSTAR" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_TOSHIBA" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_GLOBALSIGN_MICROSTAR" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_INSYDE" />
|
||||
</DeniedSigners>
|
||||
<FileRulesRef>
|
||||
<FileRuleRef RuleID="ID_ALLOW_ALL_1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA1_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA256_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA1_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA256_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDDRV64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_FIDPCIDRV64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GDRV" />
|
||||
<FileRuleRef RuleID="ID_DENY_GLCKIO2_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GLCKIO2_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GLCKIO2_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GLCKIO2_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GVCIDRV64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GVCIDRV64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GVCIDRV64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_GVCIDRV64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_WINFLASH64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_WINFLASH64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_WINFLASH64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_WINFLASH64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_AMIFLDRV64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_AMIFLDRV64_SHA256C"/>
|
||||
<FileRuleRef RuleID="ID_DENY_AMIFLDRV64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_AMIFLDRV64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_ASUPIO64_SHA1F" />
|
||||
<FileRuleRef RuleID="ID_DENY_ASUPIO64_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_ASUPIO64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_ASUPIO64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSFLASH64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSFLASH64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSFLASH64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSFLASH64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSHWMIO64_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_BSHWMIO64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSHWMIO64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_BSHWMIO64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MSIO64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MSIO64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MSIO64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MSIO64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_PIDDRV64_SHA256_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_SEMAV6MSR64_SHA1"/>
|
||||
<FileRuleRef RuleID="ID_DENY_SEMAV6MSR64_SHA256"/>
|
||||
<FileRuleRef RuleID="ID_DENY_SEMAV6MSR64_SHA1_PAGE"/>
|
||||
<FileRuleRef RuleID="ID_DENY_SEMAV6MSR64_SHA256_PAGE"/>
|
||||
</FileRulesRef>
|
||||
</ProductSigners>
|
||||
</SigningScenario>
|
||||
<SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_WINDOWS" FriendlyName="">
|
||||
<ProductSigners>
|
||||
<FileRulesRef>
|
||||
<FileRuleRef RuleID="ID_ALLOW_ALL_2" />
|
||||
</FileRulesRef>
|
||||
</ProductSigners>
|
||||
</SigningScenario>
|
||||
</SigningScenarios>
|
||||
<UpdatePolicySigners />
|
||||
<CiSigners />
|
||||
<HvciOptions>0</HvciOptions>
|
||||
<Settings>
|
||||
<Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
|
||||
<Value>
|
||||
<String>Microsoft Windows Driver Policy</String>
|
||||
</Value>
|
||||
</Setting>
|
||||
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
|
||||
<Value>
|
||||
<String>10.0.19565.0</String>
|
||||
</Value>
|
||||
</Setting>
|
||||
</Settings>
|
||||
</SiPolicy>
|
||||
```
|
||||
<br />
|
||||
|
||||
|
||||
## More information
|
||||
|
||||
- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md)
|
||||
@ -12,7 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 10/13/2017
|
||||
ms.date: 10/21/2020
|
||||
ms.reviewer:
|
||||
ms.custom: asr
|
||||
---
|
||||
@ -20,8 +20,9 @@ ms.custom: asr
|
||||
# Windows Defender Firewall with Advanced Security
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows Server 2019
|
||||
|
||||
This is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features.
|
||||
|
||||
@ -48,4 +49,3 @@ To help address your organizational network security challenges, Windows Defende
|
||||
|
||||
- **Extends the value of existing investments.** Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API).
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user