diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bd183c2b97..75cb7255c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -18,7 +18,7 @@ We've tried to make editing an existing, public file as simple as possible. **To edit a topic** -1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. +1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. ![GitHub Web, showing the Edit link](images/contribute-link.png) @@ -30,12 +30,12 @@ We've tried to make editing an existing, public file as simple as possible. ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) -4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: +4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) -5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. +5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) @@ -45,19 +45,19 @@ We've tried to make editing an existing, public file as simple as possible. The **Comparing changes** screen appears to see what the changes are between your fork and the original content. -7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. +7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. If there are no problems, you’ll see the message, **Able to merge**. ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) -8. Click **Create pull request**. +8. Click **Create pull request**. -9. Enter a title and description to give the approver the appropriate context about what’s in the request. +9. Enter a title and description to give the approver the appropriate context about what’s in the request. -10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. +10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. -11. Click **Create pull request** again to actually submit the pull request. +11. Click **Create pull request** again to actually submit the pull request. The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: diff --git a/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md b/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md index 2d6285a59d..e5a7ff9155 100644 --- a/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md +++ b/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md @@ -11,7 +11,7 @@ ms.topic: include | | | |----------|------| -|**Single-app**

![thumbnail](../images/Picture1-sm.png)

**Digital/interactive signage**

Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data.

**Policy setting** = Not configured (0 default)

|

 

![thumbnail](../images/Picture2-sm.png)

Public browsing

Runs a limited multi-tab version of Microsoft Edge, protecting user data. Microsoft Edge is the only app users can use on the device, preventing them from customizing Microsoft Edge. Users can only browse publically or end their browsing session.

The single-app public browsing mode is the only kiosk mode that has an End session button. Microsoft Edge also resets the session after a specified time of user inactivity. Both restart Microsoft Edge and clear the user’s session.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | -| **Multi-app**

![thumbnail](../images/Picture5-sm.png)

**Normal browsing**

Runs a full-version of Microsoft Edge with all browsing features and preserves the user data and state between sessions.

Some features may not work depending on what other apps you have configured in assigned access. For example, installing extensions or books from the Microsoft store are not allowed if the store is not available. Also, if Internet Explorer 11 is set up in assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

**Policy setting** = Not configured (0 default) |

 

![thumbnail](../images/Picture6-sm.png)

Public browsing

Runs a multi-tab version of Microsoft Edge InPrivate with a tailored experience for kiosks that runs in full-screen mode. Users can open and close Microsoft Edge and launch other apps if allowed by assigned access. Instead of an End session button to clear their browsing session, the user closes Microsoft Edge normally.

In this configuration, Microsoft Edge can interact with other applications. For example, if Internet Explorer 11 is set up in multi-app assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | +|**Single-app**

![thumbnail](../images/Picture1-sm.png)

**Digital/interactive signage**

Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data.

**Policy setting** = Not configured (0 default)

|

 

![thumbnail](../images/Picture2-sm.png)

Public browsing

Runs a limited multi-tab version of Microsoft Edge, protecting user data. Microsoft Edge is the only app users can use on the device, preventing them from customizing Microsoft Edge. Users can only browse publically or end their browsing session.

The single-app public browsing mode is the only kiosk mode that has an End session button. Microsoft Edge also resets the session after a specified time of user inactivity. Both restart Microsoft Edge and clear the user’s session.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | +| **Multi-app**

![thumbnail](../images/Picture5-sm.png)

**Normal browsing**

Runs a full-version of Microsoft Edge with all browsing features and preserves the user data and state between sessions.

Some features may not work depending on what other apps you have configured in assigned access. For example, installing extensions or books from the Microsoft store are not allowed if the store is not available. Also, if Internet Explorer 11 is set up in assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

**Policy setting** = Not configured (0 default) |

 

![thumbnail](../images/Picture6-sm.png)

Public browsing

Runs a multi-tab version of Microsoft Edge InPrivate with a tailored experience for kiosks that runs in full-screen mode. Users can open and close Microsoft Edge and launch other apps if allowed by assigned access. Instead of an End session button to clear their browsing session, the user closes Microsoft Edge normally.

In this configuration, Microsoft Edge can interact with other applications. For example, if Internet Explorer 11 is set up in multi-app assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | --- diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index 15858b4039..c90d6b1c59 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -154,11 +154,11 @@ If you choose to use WMI as your data output, you need to make sure that your WM **To set up your firewall** -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. -3. Restart your computer to start collecting your WMI data. +3. Restart your computer to start collecting your WMI data. ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index d634c34fd0..3a2826187a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -154,11 +154,11 @@ If you choose to use WMI as your data output, you need to make sure that your WM **To set up your firewall** -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. -3. Restart your computer to start collecting your WMI data. +3. Restart your computer to start collecting your WMI data. ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md index 91517251f0..77eb2fa5b1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md @@ -24,7 +24,7 @@ IE11 works differently with search, based on whether your organization is domain - **Non-domain-joined computers.** A single word entry is treated as an intranet site. However, if the term doesn't resolve to a site, IE11 then treats the entry as a search term and opens your default search provider. -To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like ` contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. +To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like `contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. **To enable single-word intranet search** diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md index 7e475887ce..ca25c64f0e 100644 --- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md @@ -75,8 +75,8 @@ If you cannot uninstall IE using **Uninstall or change a program** in the Contro ## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp). -1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. -2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory. +1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**. +2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory.   ## Unicode characters are not supported in IEAK 11 path names diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md index 8c74b3b97e..dfe9539b1b 100644 --- a/devices/hololens/hololens-cortana.md +++ b/devices/hololens/hololens-cortana.md @@ -31,13 +31,13 @@ Here are some things you can try saying (remember to say "Hey Cortana" first): - Restart. - Go to sleep. - Mute. -- Launch . -- Move here (gaze at the spot you want the app to move to). +- Launch ``. +- Move `` here (gaze at the spot you want the app to move to). - Go to Start. - Take a picture. - Start recording. (Starts recording a video.) - Stop recording. (Stops recording a video.) -- Call . (Requires Skype.) +- Call ``. (Requires Skype.) - What time is it? - Show me the latest NBA scores. - How much battery do I have left? diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md index 25bf786333..8cbeaf26eb 100644 --- a/devices/hololens/hololens-encryption.md +++ b/devices/hololens/hololens-encryption.md @@ -45,7 +45,7 @@ Provisioning packages are files created by the Windows Configuration Designer to ![Require device encryption setting configured to yes](images/device-encryption.png) -2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. +2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. >[!NOTE] >You can configure [additional settings in the provisioning package](hololens-provisioning.md). diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md index 226a0c18ff..77bb29070f 100644 --- a/devices/hololens/hololens-setup.md +++ b/devices/hololens/hololens-setup.md @@ -59,7 +59,7 @@ HoloLens doesn't have an on-device command line. With that in mind, the setting Open settings by opening the start menu and clicking on the **Settings** in the top bar. You can also ask Cortana to open settings. -Follow [this guide](https://docs.microsoft.com/en-us/windows/mixed-reality/navigating-the-windows-mixed-reality-home) to navigate around the HoloLens home. +Follow [this guide](https://docs.microsoft.com/windows/mixed-reality/navigating-the-windows-mixed-reality-home) to navigate around the HoloLens home. ### Connect bluetooth devices diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md index bfafb1d925..57bf3d0e04 100644 --- a/devices/hololens/hololens-upgrade-enterprise.md +++ b/devices/hololens/hololens-upgrade-enterprise.md @@ -47,7 +47,7 @@ Provisioning packages are files created by the Windows Configuration Designer to ![Upgrade edition with license setting selected](images/icd1.png) -2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. +2. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. >[!NOTE] >You can configure [additional settings in the provisioning package](hololens-provisioning.md). diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 7eac6565e2..d9bdb48c3a 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -5,7 +5,7 @@ ## Overview ### [What's new in Surface Hub 2S for IT admins](surface-hub-2s-whats-new.md) ### [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) -### [Operating system essentials (Surface Hub) ](differences-between-surface-hub-and-windows-10-enterprise.md) +### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md) ### [Adjust Surface Hub 2S brightness, volume, and input](surface-hub-2s-onscreen-display.md) ## Plan diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index 27ebc7924e..00620b9f7c 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -534,7 +534,7 @@ if ($status.Count -gt 0) elseif ($v[0] -eq "F") { $color = "red" - $v += " Go to http://aka.ms/shubtshoot" + $v += " Go to https://aka.ms/shubtshoot" } Write-Host -NoNewline $k -ForegroundColor $color @@ -978,7 +978,7 @@ if ($status.Count -gt 0) elseif ($v[0] -eq "F") { $color = "red" - $v += " Go to http://aka.ms/shubtshoot for help" + $v += " Go to https://aka.ms/shubtshoot for help" } Write-Host -NoNewline $k -ForegroundColor $color diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md index 09c4b1ea60..2075507bd4 100644 --- a/devices/surface-hub/device-reset-surface-hub.md +++ b/devices/surface-hub/device-reset-surface-hub.md @@ -44,15 +44,15 @@ If you see a blank screen for long periods of time during the **Reset device** p ## Reset a Surface Hub from Settings **To reset a Surface Hub** -1. On your Surface Hub, open **Settings**. +1. On your Surface Hub, open **Settings**. ![Image showing Settings app for Surface Hub.](images/sh-settings.png) -2. Click **Update & Security**. +2. Click **Update & Security**. ![Image showing Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png) -3. Click **Recovery**, and then, under **Reset device**, click **Get started**. +3. Click **Recovery**, and then, under **Reset device**, click **Get started**. ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md index cf30261837..73a50f66c9 100644 --- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md +++ b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md @@ -127,7 +127,7 @@ The administrative features in Windows 10 Enterprise, such as the Microsoft Mana ### Remote management and monitoring -Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/en-us/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). +Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). *Organization policies that this may affect:*
Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools, such as System Center Operations Manager. diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md index d559575749..20c6c45925 100644 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ b/devices/surface-hub/install-apps-on-surface-hub.md @@ -40,10 +40,10 @@ By enabling developer mode, you can also install developer-signed UWP apps. > After developer mode has been enabled, you will need to reset the Surface Hub to disable it. Resetting the device removes all local user files and configurations and then reinstalls Windows. **To turn on developer mode** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **Update & security** > **For developers**. -4. Select **Developer mode** and accept the warning prompt. +1. From your Surface Hub, start **Settings**. +2. Type the device admin credentials when prompted. +3. Navigate to **Update & security** > **For developers**. +4. Select **Developer mode** and accept the warning prompt. ### Visual Studio During development, the easiest way to test your app on a Surface Hub is using Visual Studio. Visual Studio's remote debugging feature helps you discover issues in your app before deploying it broadly. For more information, see [Test Surface Hub apps using Visual Studio](https://msdn.microsoft.com/windows/uwp/debug-test-perf/test-surface-hub-apps-using-visual-studio). @@ -102,10 +102,10 @@ To evaluate apps released on the Microsoft Store, use the Microsoft Store app on > - To install apps, you will need to manually sign in to the Microsoft Store app on each Surface Hub you own. **To browse the Microsoft Store on Surface Hub** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **This device** > **Apps & features**. -4. Select **Open Store**. +1. From your Surface Hub, start **Settings**. +2. Type the device admin credentials when prompted. +3. Navigate to **This device** > **Apps & features**. +4. Select **Open Store**. ### Download app packages from Microsoft Store for Business To download the app package you need to install apps on your Surface Hub, visit the [Microsoft Store for Business](https://www.microsoft.com/business-store). The Store for Business is where you can find, acquire, and manage apps for the Windows 10 devices in your organization, including Surface Hub. diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md index f030a801e9..e90e7d8f95 100644 --- a/devices/surface-hub/monitor-surface-hub.md +++ b/devices/surface-hub/monitor-surface-hub.md @@ -95,10 +95,10 @@ This table describes the sample queries in the Surface Hub solution: | Hardware | Error | **Contact Microsoft support**.
Indicates impact to core functionality (such as Skype, projection, touch, and internet connectivity).
**Note** Some events, including heartbeat, include the device’s serial number that you can use when contacting support.| Triggers when there is an error with any of the following hardware components.
**Components that affect Skype**:
- Speaker driver
- Microphone driver
- Camera driver
**Components that affect wired and wireless projection**:
- Wired touchback driver
- Wired ingest driver
- Wireless adapter driver
- Wi-Fi Direct error
**Other components**:
- Touch digitizer driver
- Network adapter error (not reported to OMS)| **To set up an alert** -1. From the Surface Hub solution, select one of the sample queries. -2. Modify the query as desired. See Log Analytics search reference to learn more. -3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert. -4. Click **Save** to complete the alert rule. It will start running immediately. +1. From the Surface Hub solution, select one of the sample queries. +2. Modify the query as desired. See Log Analytics search reference to learn more. +3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert. +4. Click **Save** to complete the alert rule. It will start running immediately. ## Enroll your Surface Hub diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md index a6fa631e1b..c60e7826dc 100644 --- a/devices/surface-hub/skype-hybrid-voice.md +++ b/devices/surface-hub/skype-hybrid-voice.md @@ -80,14 +80,14 @@ If you deployed Skype for Business Cloud PBX with one of the hybrid voice option Set-Mailbox surfacehub2@adatum.com -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true ``` -10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties. +10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties. ``` Set-CalendarProcessing surfacehub2@adatum.com -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false Set-CalendarProcessing surfacehub2@adatum.com -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" ``` -11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. +11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. ``` Get-CsTenant | select registrarpool diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md index 1225c31187..1b6f56eda7 100644 --- a/devices/surface-hub/surface-hub-2s-phone-authenticate.md +++ b/devices/surface-hub/surface-hub-2s-phone-authenticate.md @@ -40,4 +40,4 @@ Password-less phone sign-in simplifies signing-in to your meetings and files on 3. If prompted, enter the PIN or biometric ID on your phone to complete sign-in. ## Learn more -For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-phone-sign-in). +For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-phone-sign-in). diff --git a/devices/surface-hub/surface-hub-2s-prepare-environment.md b/devices/surface-hub/surface-hub-2s-prepare-environment.md index efe6fa26b5..10b5238246 100644 --- a/devices/surface-hub/surface-hub-2s-prepare-environment.md +++ b/devices/surface-hub/surface-hub-2s-prepare-environment.md @@ -45,6 +45,6 @@ If you affiliate Surface Hub 2S with on-premises Active Directory Domain Service ## Azure Active Directory -When choosing to affiliate your Surface Hub 2S with Azure AD, any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Alternatively, you can configure the Device Administrator role to sign in to the Settings app. For more information, see [Administrator role permissions in Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#device-administrators). Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S. +When choosing to affiliate your Surface Hub 2S with Azure AD, any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Alternatively, you can configure the Device Administrator role to sign in to the Settings app. For more information, see [Administrator role permissions in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles#device-administrators). Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S. If you enabled Intune Automatic Enrollment for your organization, Surface Hub 2S will automatically enroll itself with Intune. The device’s Bitlocker key is automatically saved in Azure AD. When affiliating Surface Hub 2S with Azure AD, single sign-on and Easy Authentication will not work. diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md index aa4816960b..6329c3b696 100644 --- a/devices/surface-hub/surface-hub-2s-setup.md +++ b/devices/surface-hub/surface-hub-2s-setup.md @@ -44,7 +44,7 @@ When you first start Surface Hub 2S, the device automatically enters first time ## Configuring device admin accounts -You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/en-us/surface-hub/surface-hub-2s-prepare-environment#device-affiliation). +You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/surface-hub/surface-hub-2s-prepare-environment#device-affiliation). In the **Setup admins for this device** window, select one of the following options: Active Directory Domain Services, Azure Active Directory, or Local admin. @@ -92,7 +92,7 @@ If you insert a USB thumb drive with a provisioning package into one of the USB ![* Choose provisioning package to use*](images/sh2-run13.png)
-3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/en-us/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file). +3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file). ![* Select a device account and friendly name from your configuration file*](images/sh2-run14.png)
diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md index 525c84acb2..2c8a3793a6 100644 --- a/devices/surface-hub/whiteboard-collaboration.md +++ b/devices/surface-hub/whiteboard-collaboration.md @@ -44,14 +44,14 @@ To get Whiteboard to Whiteboard collaboration up and running, you’ll need to m To start a collaboration session: -1. In the Whiteboard app, tap the **Sign in** button. -2. Sign in with your organization ID. -3. Tap the **Invite** button next to your name at the top of the app. -4. Tap **Start session**. Whiteboard will generate a link that you can share. +1. In the Whiteboard app, tap the **Sign in** button. +2. Sign in with your organization ID. +3. Tap the **Invite** button next to your name at the top of the app. +4. Tap **Start session**. Whiteboard will generate a link that you can share. ![screenshot of the link dialog box on whiteboard](images/wb-collab-link.png) -5. Copy and paste this link into a Skype chat with another Surface Hub +5. Copy and paste this link into a Skype chat with another Surface Hub When the other Surface Hub receives the link, the recipient can tap on the link, sign in to Whiteboard, and then begin collaborating. You can copy and paste other content, use smart ink features like Ink to Shape, and co-author together. diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index 9448059c5b..5c4cc7c4a3 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -54,7 +54,7 @@ Before users can install or deploy an app from a company’s Microsoft Store for ![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")
*Figure 1. Enable apps for offline use* -4. Add Surface app to your Microsoft Store for Business account by following this procedure: +4. Add Surface app to your Microsoft Store for Business account by following this procedure: * Click the **Shop** menu. * In the search box, type **Surface app**, and then click the search icon. * After the Surface app is presented in the search results, click the app’s icon. @@ -99,21 +99,21 @@ Figure 5 shows the required frameworks for the Surface app. >The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Microsoft Store for Business. Always use the Surface app and recommended framework versions as provided by Microsoft Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. To download the required frameworks for the Surface app, follow these steps: -1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. -2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. +1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. +2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. >[!NOTE] >Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. ## Install Surface app on your computer with PowerShell The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards. -1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. -2. Begin an elevated PowerShell session. +1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. +2. Begin an elevated PowerShell session. >[!NOTE] >If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app. -3. In the elevated PowerShell session, copy and paste the following command: +3. In the elevated PowerShell session, copy and paste the following command: ``` Add-AppxProvisionedPackage –Online –PackagePath \ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath \ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml ``` @@ -125,7 +125,7 @@ The following procedure provisions the Surface app onto your computer and makes Add-AppxProvisionedPackage –Online –PackagePath c:\Temp\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath c:\Temp\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml ``` -4. The Surface app will now be available on your current Windows computer. +4. The Surface app will now be available on your current Windows computer. Before the Surface app is functional on the computer where it has been provisioned, you must also provision the frameworks described earlier in this article. To provision these frameworks, use the following procedure in the elevated PowerShell session you used to provision the Surface app. @@ -151,18 +151,18 @@ The following procedure uses MDT to automate installation of the Surface app at * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp For the Surface app to function on the target computer, it will also require the frameworks described earlier in this article. Use the following procedure to import the frameworks required for the Surface app into MDT and to configure them as dependencies. -1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder. -2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. -3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory. +1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder. +2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. +3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory. To configure the frameworks as dependencies of the Surface app, use this process: -1. Open the properties of the Surface app in the MDT Deployment Workbench. -2. Click the **Dependencies** tab, and then click **Add**. -3. Select the check box for each framework using the name you provided in the New Application Wizard. +1. Open the properties of the Surface app in the MDT Deployment Workbench. +2. Click the **Dependencies** tab, and then click **Add**. +3. Select the check box for each framework using the name you provided in the New Application Wizard. After import, the Surface app will be available for selection in the **Applications** step of the Windows Deployment Wizard. You can also install the application automatically by specifying the application in the deployment task sequence by following this process: -1. Open your deployment task sequence in the MDT Deployment Workbench. -2. Add a new **Install Application** task in the **State Restore** section of deployment. -3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. +1. Open your deployment task sequence in the MDT Deployment Workbench. +2. Add a new **Install Application** task in the **State Restore** section of deployment. +3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit). diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index e749f22972..ea5592fb85 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -579,10 +579,10 @@ After the task sequence is created it can be modified for increased automation, 8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field. 9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. -11. Repeat Steps 6 through 10 for the Surface app. -12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. -13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. +10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**. +11. Repeat Steps 6 through 10 for the Surface app. +12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step. +13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu. 14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options: * **Name** – Set DriverGroup001 * **Task Sequence Variable** – DriverGroup001 @@ -592,8 +592,8 @@ After the task sequence is created it can be modified for increased automation, *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence* -15. Select the **Inject Drivers** step, the next step in the task sequence. -16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: +15. Select the **Inject Drivers** step, the next step in the task sequence. +16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options: * In the **Choose a selection profile** drop-down menu, select **Nothing**. * Click the **Install all drivers from the selection profile** button. @@ -601,7 +601,7 @@ After the task sequence is created it can be modified for increased automation, *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows* -17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. +17. Click **OK** to apply changes to the task sequence and close the task sequence properties window. ### Configure deployment share rules diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 3d04792b01..7eb53c4ec9 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -63,15 +63,15 @@ To create a Surface UEFI configuration package, follow these steps: *Figure 4. Disable or enable individual Surface components* -11. Click **Next**. -12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. +11. Click **Next**. +12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. ![Control advanced Surface UEFI settings and Surface UEFI pages](images/surface-ent-mgmt-fig4-advancedsettings.png "Control advanced Surface UEFI settings and Surface UEFI pages") *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM* -13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. -14. When the package is created and saved, the **Successful** page is displayed. +13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. +14. When the package is created and saved, the **Successful** page is displayed. >[!NOTE] >Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md index 8b78717d6c..cd0812b2d9 100644 --- a/devices/surface/surface-diagnostic-toolkit-business.md +++ b/devices/surface/surface-diagnostic-toolkit-business.md @@ -59,9 +59,9 @@ SDT for Business is supported on Surface 3 and later devices, including: To create an SDT package that you can distribute to users in your organization: -1. Sign in to your Surface device using the Administrator account. -2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop. -3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. +1. Sign in to your Surface device using the Administrator account. +2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop. +3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. >[!NOTE] >If the setup wizard does not appear, ensure that you are signed into the Administrator account on your computer. @@ -72,15 +72,15 @@ To create an SDT package that you can distribute to users in your organization: 4. When the SDT setup wizard appears, click **Next**, accept the End User License Agreement (EULA) -5. On the Install Options screen, change the default install location if desired. -6. Under Setup Type, select **Advanced**. +5. On the Install Options screen, change the default install location if desired. +6. Under Setup Type, select **Advanced**. >[!NOTE] >The standard option allows users to run the diagnostic tool directly on their Surface device provided they are signed into their device using an Administrator account. ![Install Options: Advanced](images/sdt-install.png) -7. Click **Next** and then click **Install**. +7. Click **Next** and then click **Install**. ## Installing using the command line If desired, you can install SDT at a command prompt and set a custom flag to install the tool in admin mode. SDT contains the following install option flags: @@ -90,7 +90,7 @@ If desired, you can install SDT at a command prompt and set a custom flag to ins ### To install SDT from the command line: -1. Open a command prompt and enter: +1. Open a command prompt and enter: ``` msiexec.exe /i ADMINMODE=1. @@ -116,8 +116,8 @@ In addition to the .exe file, SDT installs a JSON file and an admin.dll file (mo Creating a custom package allows you to target the tool to specific known issues. -1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. -2. When the tool opens, click **Create Custom Package**, as shown in figure 3. +1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. +2. When the tool opens, click **Create Custom Package**, as shown in figure 3. ![Create custom package option](images/sdt-3.png) diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md index abce43dabc..9022fb4770 100644 --- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md +++ b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md @@ -16,9 +16,9 @@ manager: dansimp This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. -1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. +1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. -2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. +2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. ![Start SDT in desktop mode](images/sdt-desk-1.png) @@ -63,9 +63,9 @@ For each test, if functionality does not work as expected and the user clicks ** *Figure 4. Running hardware diagnostics* -1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. -2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. -3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution. +1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. +2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. +3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution. ### Repairing applications diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index 9244515eb1..df65b6c73d 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -226,8 +226,16 @@ create a reset package using PowerShell to reset SEMM. ## Version History + + +### Version 2.43.136.0 +* Support to enable/disable simulatenous multithreating +* Separate options for WiFi and Bluetooth for some devices +* Battery Limit removed for Surface Studio + ### Version 2.26.136.0 * Add support to Surface Studio 2 +* Battery Limit feature ### Version 2.21.136.0 * Add support to Surface Pro 6 diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md index 6531857a06..edcfcdf120 100644 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ b/devices/surface/unenroll-surface-devices-from-semm.md @@ -118,9 +118,9 @@ To initiate a Recovery Request, follow these steps: *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request* -11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. -12. Browse to and select your SEMM certificate file, and then click **OK**. -13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. +11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. +12. Browse to and select your SEMM certificate file, and then click **OK**. +13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. ![Type password for SEMM certificate](images/surface-semm-unenroll-fig11.png "Type password for SEMM certificate") @@ -137,7 +137,7 @@ To initiate a Recovery Request, follow these steps: * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field. * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**. -16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. +16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. ![Display of the reset verification code](images/surface-semm-unenroll-fig13.png "Display of the reset verification code") @@ -145,13 +145,13 @@ To initiate a Recovery Request, follow these steps: * Click the **Share** button to send the reset verification code by email. -17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. -18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. +17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. +18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. ![Example display of successful unenrollment from SEMM](images/surface-semm-unenroll-fig14.png "Example display of successful unenrollment from SEMM") *Figure 14. Successful unenrollment from SEMM* -19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. +19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md index de79c73b49..52e96859b3 100644 --- a/devices/surface/using-the-sda-deployment-share.md +++ b/devices/surface/using-the-sda-deployment-share.md @@ -141,23 +141,23 @@ In the previous example for including drivers for a POS system, you would also n 9. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. -10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**. +10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**. -11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. +11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. ![A new Install Application step for Sample POS App](images/using-sda-newinstall-fig3.png "A new Install Application step for Sample POS App") *Figure 3. A new Install Application step for Sample POS App* -12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app. +12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app. -13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. +13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. -14. Select your app from the list of applications, and then click **OK**. +14. Select your app from the list of applications, and then click **OK**. -15. Click **OK** to close the task sequence properties. +15. Click **OK** to close the task sequence properties. -16. Close the Deployment Workbench. +16. Close the Deployment Workbench. ## Work with existing deployment shares diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index 5e23d71b86..f1d88dc8c8 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -182,9 +182,9 @@ Use video to create a project summary. 9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**. -10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**. Drag the trim handle on the left to shorten the duration of the clip and select **Done**. +10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**. Drag the trim handle on the left to shorten the duration of the clip and select **Done**. -11. Select the last card on the Storyboard and select **3D effects**. +11. Select the last card on the Storyboard and select **3D effects**. 1. Position the playback indicator to be roughly 1 second into the video clip, or when the boy moves down to examine the laser. 2. Find the **lightning bolt** effect and click or drag to add it to the scene. Rotate, scale, and position the effect so it looks like the lightning is coming out of the laser beam and hitting the black back of the mirror. 3. Position the blue anchor over the end of the laser pointer in the video and toggle on **Attach to a point** for the lightning bolt effect to anchor the effect in the scene. diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 16dfd33925..bb621c32d8 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -1247,7 +1247,7 @@ You can use Windows Deployment Services in conjunction with System Center Config To support PXE boot requests, you install the PXE service point site system role. Then, you must configure one or more distribution points to respond to PXE boot request. For more information about how to perform this step, see [Install site system roles for System Center Configuration Manager](https://technet.microsoft.com/library/mt704036.aspx), [Use PXE to deploy Windows over the network with System Center Configuration Manager](https://technet.microsoft.com/library/mt627940.aspx), and [Configuring distribution points to accept PXE requests](https://technet.microsoft.com/library/mt627944.aspx#BKMK_PXEDistributionPoint). -3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point. +3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point. Before a device can start a boot image from a PXE-enabled distribution point, you must change the properties of the boot image to enable PXE booting. Typically, you create this boot image when you created your MDT task sequence in the Configuration Manager console. diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index 5ddc9d7456..cb30050aa8 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -123,10 +123,10 @@ If you want to delete either (or both) the Skype and the Xbox accounts, here’s To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515) If you need help deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you’ve signed in, you can: -1. Select a help topic (**Account and Password**) -2. Select a related problem (**Deleting an account**) -3. Click **Next**. -4. Select a contact method to get answers to your questions. +1. Select a help topic (**Account and Password**) +2. Select a related problem (**Deleting an account**) +3. Click **Next**. +4. Select a contact method to get answers to your questions. #### Xbox diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 3432624379..838aa85226 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -49,9 +49,9 @@ You can purchase individual Minecraft: Education Edition subscriptions for you a To purchase individual Minecraft: Education Edition subscriptions (i.e. direct purchase): -1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account. -2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it) -3. Click **Buy** +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account. +2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it) +3. Click **Buy** >[!Note] >Administrators can restrict the ability for teachers to purchase applications in the Microsoft Store for Education. If you do not have the ability to Buy, contact your school administration or IT administrator. diff --git a/it-client b/it-client deleted file mode 160000 index 61e0a21977..0000000000 --- a/it-client +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 61e0a21977430f3c0eef1c32e398999dc090c332 diff --git a/mdop/appv-v4/delete-package.md b/mdop/appv-v4/delete-package.md index b5f9062d59..925e63a5c9 100644 --- a/mdop/appv-v4/delete-package.md +++ b/mdop/appv-v4/delete-package.md @@ -19,7 +19,7 @@ ms.date: 06/16/2016 Removes a package record and the applications associated with it. -` SFTMIME DELETE PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` +`SFTMIME DELETE PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` diff --git a/mdop/appv-v4/sfttray-command-reference.md b/mdop/appv-v4/sfttray-command-reference.md index 0b72c8c94c..38b1c28072 100644 --- a/mdop/appv-v4/sfttray-command-reference.md +++ b/mdop/appv-v4/sfttray-command-reference.md @@ -31,23 +31,23 @@ There is only one Application Virtualization Client Tray instance for each user -` Sfttray.exe /?` +`Sfttray.exe /?` ### Command Usage -` Sfttray.exe [/HIDE | /SHOW]` +`Sfttray.exe [/HIDE | /SHOW]` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL` -` Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT /LAUNCH app [args]` +`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT /LAUNCH app [args]` -` Sfttray.exe /EXIT` +`Sfttray.exe /EXIT` ### Command-Line Switches diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md index d9862868d2..ee45693fca 100644 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md +++ b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md @@ -51,21 +51,16 @@ Use the following procedure to install the publishing server on a separate compu 9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - `` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - `` + ```xml + + + + + + + + + ``` **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md index b304366dd1..c9ed253251 100644 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md +++ b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md @@ -51,21 +51,16 @@ Use the following procedure to install the publishing server on a separate compu 9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - `` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - ` ` - - `` + ```xml + + + + + + + + + ``` **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md index b300c0341b..e0dec01036 100644 --- a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md +++ b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md @@ -88,49 +88,55 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab Modify the MBAM Recovery and Hardware Database to use the full recovery mode. - `USE master;` + ```sql + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Recovery and Hardware"` + ALTER DATABASE "MBAM Recovery and Hardware" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO + ``` Create MBAM Recovery and Hardware Database Data and MBAM Recovery logical backup devices. - `USE master` + ```sql + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - `'Z:\MBAM Recovery and Hardware Database Data.bak';` + 'Z:\MBAM Recovery and Hardware Database Data.bak'; - `GO` + GO + ``` Back up the full MBAM Recovery and Hardware database. - `BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];` + ```sql + BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - `GO` + GO - `BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]` + BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - `TO FILE = 'Z:\SQLServerInstanceCertificateFile'` + TO FILE = 'Z:\SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` ENCRYPTION BY PASSWORD = '$PASSWORD$'` + ENCRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO + ``` **Note** Replace the values from the preceding example with those that match your environment: @@ -181,43 +187,51 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab 4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - `-- Restore MBAM Recovery and Hardware Database. ` + ```sql + -- Restore MBAM Recovery and Hardware Database. - `USE master` + USE master - `GO` + GO + ``` Drop the certificate created by MBAM Setup. - `DROP CERTIFICATE [MBAM Recovery Encryption Certificate]` + ```sql + DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - `GO` + GO + ``` Add certificate - `CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]` + ```sql + CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - `FROM FILE = 'Z: \SQLServerInstanceCertificateFile'` + FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` DECRYPTION BY PASSWORD = '$PASSWORD$'` + DECRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO + ``` Restore the MBAM Recovery and Hardware database data and the log files. - `RESTORE DATABASE [MBAM Recovery and Hardware]` + ```sql + RESTORE DATABASE [MBAM Recovery and Hardware] - ` FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak'` + FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` **Note** Replace the values from the preceding example with those that match your environment: @@ -354,35 +368,37 @@ If you choose to move the MBAM Compliance Status Database feature from one compu 2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Modify the MBAM Compliance Status Database to use the full recovery model.` + ```sql + -- Modify the MBAM Compliance Status Database to use the full recovery model. - `USE master;` + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Compliance Status"` + ALTER DATABASE "MBAM Compliance Status" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO - `-- Create MBAM Compliance Status Data logical backup devices.` + -- Create MBAM Compliance Status Data logical backup devices. - `USE master` + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - `'Z: \MBAM Compliance Status Database Data.bak';` + 'Z: \MBAM Compliance Status Database Data.bak'; - `GO` + GO -- Back up the full MBAM Recovery and Hardware database. - `BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];` + BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - `GO` + GO + ``` 3. Run the SQL file with a command that is similar to the following one, by using the SQL Server PowerShell: @@ -422,19 +438,21 @@ If you choose to move the MBAM Compliance Status Database feature from one compu 3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Create MBAM Compliance Status Database Data logical backup devices. ` + ```sql + -- Create MBAM Compliance Status Database Data logical backup devices. - `Use master` + Use master - `GO` + GO -- Restore the MBAM Compliance Status database data files. - `RESTORE DATABASE [MBAM Compliance Status Database]` + RESTORE DATABASE [MBAM Compliance Status Database] - ` FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'` + FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` 4. Run the SQL File with a command that is similar to the following one, by using the SQL Server PowerShell: diff --git a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md index 46aeb38af7..7888f34d72 100644 --- a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md +++ b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md @@ -88,49 +88,51 @@ To move the Recovery Database from one computer to another (for example, from Se Modify the MBAM Recovery Database to use the full recovery mode. - `USE master;` + ```sql + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Recovery and Hardware"` + ALTER DATABASE "MBAM Recovery and Hardware" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices. - `USE master` + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - `'Z:\MBAM Recovery Database Data.bak';` + 'Z:\MBAM Recovery Database Data.bak'; - `GO` + GO -- Back up the full MBAM Recovery Database. - `BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];` + BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - `GO` + GO - `BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]` + BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - `TO FILE = 'Z:\SQLServerInstanceCertificateFile'` + TO FILE = 'Z:\SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` ENCRYPTION BY PASSWORD = '$PASSWORD$'` + ENCRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO + ``` **Note** Replace the following values in the example above with those that match your environment: @@ -183,43 +185,45 @@ To move the Recovery Database from one computer to another (for example, from Se 4. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Restore MBAM Recovery Database. ` + ```sql + -- Restore MBAM Recovery Database. - `USE master` + USE master - `GO` + GO -- Drop certificate created by MBAM Setup. - `DROP CERTIFICATE [MBAM Recovery Encryption Certificate]` + DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - `GO` + GO --Add certificate - `CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]` + CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - `FROM FILE = 'Z: \SQLServerInstanceCertificateFile'` + FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - `WITH PRIVATE KEY` + WITH PRIVATE KEY - `(` + ( - ` FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',` + FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - ` DECRYPTION BY PASSWORD = '$PASSWORD$'` + DECRYPTION BY PASSWORD = '$PASSWORD$' - `);` + ); - `GO` + GO -- Restore the MBAM Recovery Database data and log files. - `RESTORE DATABASE [MBAM Recovery and Hardware]` + RESTORE DATABASE [MBAM Recovery and Hardware] - ` FROM DISK = 'Z:\MBAM Recovery Database Data.bak'` + FROM DISK = 'Z:\MBAM Recovery Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` **Note** Replace the following values in the example above with those that match your environment: @@ -362,35 +366,37 @@ If you want to move the MBAM Compliance and Audit Database from one computer to 2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Modify the MBAM Compliance Status Database to use the full recovery model.` + ```sql + -- Modify the MBAM Compliance Status Database to use the full recovery model. - `USE master;` + USE master; - `GO` + GO - `ALTER DATABASE "MBAM Compliance Status"` + ALTER DATABASE "MBAM Compliance Status" - ` SET RECOVERY FULL;` + SET RECOVERY FULL; - `GO` + GO - `-- Create MBAM Compliance Status Data logical backup devices.` + -- Create MBAM Compliance Status Data logical backup devices. - `USE master` + USE master - `GO` + GO - `EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',` + EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - `'Z: \MBAM Compliance Status Database Data.bak';` + 'Z: \MBAM Compliance Status Database Data.bak'; - `GO` + GO -- Back up the full MBAM Recovery database. - `BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];` + BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - `GO` + GO + ``` 3. Run the SQL file by using a Windows PowerShell command line that is similar to the following: @@ -430,19 +436,21 @@ If you want to move the MBAM Compliance and Audit Database from one computer to 3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - `-- Create MBAM Compliance Status Database Data logical backup devices. ` + ```sql + -- Create MBAM Compliance Status Database Data logical backup devices. - `Use master` + Use master - `GO` + GO -- Restore the MBAM Compliance Status database data files. - `RESTORE DATABASE [MBAM Compliance Status]` + RESTORE DATABASE [MBAM Compliance Status] - ` FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'` + FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - ` WITH REPLACE` + WITH REPLACE + ``` 4. Run the SQL File by using a Windows PowerShell command line that is similar to the following: diff --git a/mdop/mbam-v25/TOC.md b/mdop/mbam-v25/TOC.md index 22008a42bb..a33c126e12 100644 --- a/mdop/mbam-v25/TOC.md +++ b/mdop/mbam-v25/TOC.md @@ -83,6 +83,7 @@ #### [Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) ### [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) ## [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) +## [Applying hotfixes on MBAM 2.5 SP1](apply-hotfix-for-mbam-25-sp1.md) ## [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) ### [Client Event Logs](client-event-logs.md) ### [Server Event Logs](server-event-logs.md) diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md index cf5d567d3a..fd3074b66a 100644 --- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md @@ -240,7 +240,7 @@ Version identifies the version of the settings location template for administrat **Hint:** You can save notes about version changes using XML comment tags ``, for example: -``` syntax +```xml `, for example: -``` syntax - - 4 + Version 1 Jul 05, 2012 Initial template created by Generator - Denise@Contoso.com + Version 2 Jul 31, 2012 Added support for app.exe v2.1.3 - Mark@Contoso.com + Version 3 Jan 01, 2013 Added font settings support - Mark@Contoso.com + Version 4 Jan 31, 2013 Added support for plugin settings - Tony@Contoso.com + --> +4 ``` **Important**   @@ -1216,25 +1215,25 @@ Author identifies the creator of the settings location template. Two optional ch Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: -``` syntax - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - +```xml + + MyApplication.exe + Win64 + MyApplication + MyApplication.exe + + + + + + + + + + + + + ``` ### Filename @@ -1291,14 +1290,14 @@ UE-V does not support ARM processors in this version. ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: -``` syntax - - MyApplication.exe - My Application 6.x by Contoso.com - - - - +```xml + + MyApplication.exe + My Application 6.x by Contoso.com + + + + ``` ### FileDescription @@ -1311,23 +1310,22 @@ FileDescription is an optional tag that allows for an administrative description For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: -``` syntax +```xml - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - + + MyApplication.exe + My Application Main Engine + + + + + + MyApplicationHelper.exe + My Application Background Process Executable + + + + ``` @@ -1345,44 +1343,44 @@ The product and file version elements may be left unspecified. Doing so makes th Product version: 1.0 specified in the UE-V Generator produces the following XML: -``` syntax - - - - +```xml + + + + ``` **Example 2:** File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML: -``` syntax - - - - - - +```xml + + + + + + ``` **Incorrect Example 1 – incomplete range:** Only the Minimum attribute is present. Maximum must be included in a range as well. -``` syntax - - - +```xml + + + ``` **Incorrect Example 2 – Minor specified without Major element:** Only the Minor element is present. Major must be included as well. -``` syntax - - - +```xml + + + ``` ### FileVersion @@ -1399,19 +1397,19 @@ Including a FileVersion element for an application allows for more granular fine The child elements and syntax rules for FileVersion are identical to those of ProductVersion. -``` syntax - - MSACCESS.EXE - Win32 - - - - - - - - - +```xml + + MSACCESS.EXE + Win32 + + + + + + + + + ``` ### Application Element diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index 3b6a6ab7cf..cfbb3dcb99 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -61,13 +61,13 @@ People in your org can request license for apps that they need, or that others n ## Acquire apps **To acquire an app** -1. Sign in to http://businessstore.microsoft.com -2. Select **Shop for my group**, or use Search to find an app. -3. Select the app you want to purchase. -4. On the product description page, choose your license type - either online or offline. +1. Sign in to http://businessstore.microsoft.com +2. Select **Shop for my group**, or use Search to find an app. +3. Select the app you want to purchase. +4. On the product description page, choose your license type - either online or offline. 5. Free apps will be added to **Products & services**. For apps with a price, you can set the quantity you want to buy. Type the quantity and select **Next**. -6. If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one. -7. Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**. +6. If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one. +7. Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**. You’ll also need to have your business address saved on **My organization - Profile**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings#organization-tax-information). diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md index c7b0c2dce6..17369a8148 100644 --- a/store-for-business/app-inventory-management-microsoft-store-for-business.md +++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md @@ -75,10 +75,10 @@ For online-licensed apps, you can assign apps directly to people in your organiz **To assign an app to an employee** -1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). -2. Click **Manage**, and then choose **Inventory**. -3. Find an app, click the ellipses, and then choose **Assign to people**. -4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. +1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com). +2. Click **Manage**, and then choose **Inventory**. +3. Find an app, click the ellipses, and then choose **Assign to people**. +4. Type the email address for the employee that you're assigning the app to, and click **Confirm**. Employees will receive an email with a link that will install the app on their device. Click the link to start the Microsoft Store app, and then click **Install**. Also, in the Microsoft Store app, they can find the app under **My Library**. @@ -103,9 +103,9 @@ Employees can claim apps that admins added to the private store by doing the fol ### Get and remove private store apps **To claim an app from the private store** -1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Microsoft Store app. -2. Click the private store tab. -3. Click the app you want to install, and then click **Install**. +1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Microsoft Store app. +2. Click the private store tab. +3. Click the app you want to install, and then click **Install**. Another way to distribute apps is by assigning them to people in your organization. diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md index 50f43122c5..d45e508ac3 100644 --- a/store-for-business/distribute-apps-from-your-private-store.md +++ b/store-for-business/distribute-apps-from-your-private-store.md @@ -43,13 +43,11 @@ Microsoft Store adds the app to **Products and services**. Click **Manage**, **A -3. Use **Refine results** to search for online-licensed apps under **License type**. -4. From the list of online-licensed apps, click the ellipses for the app you want, and then choose **Add to private store**. +3. Click on the application to open the application settings, then select **Private store availability**. +4. Select **Everyone** to make application available for all people in your organization. -The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store. - >[!Note] > If you are working with a new Line-of-Business (LOB) app, you have to wait for the app to be available in **Products & services** before adding it to your private store. For more information, see [Working with line-of-business apps](working-with-line-of-business-apps.md). diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md index 696f1be75a..52c8ea4a6b 100644 --- a/store-for-business/distribute-offline-apps.md +++ b/store-for-business/distribute-offline-apps.md @@ -66,8 +66,8 @@ There are several items to download or create for offline-licensed apps. The app 1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. -3. Under **Shopping Experience**, set **Show offline apps** to **On**. -4. Click **Shop for my group**. Search for the required inbox-app, select it, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory. +3. Click **Settings**. +4. Click **Shop**. Search for the **Shopping experience** section, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory. 5. Click **Manage**. You now have access to download the appx bundle package metadata and license file. 6. Go to **Products & services**, and select **Apps & software**. (The list may be empty, but it will auto-populate after some time.) diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md index 6a2f39e62d..115dd3fa5b 100644 --- a/store-for-business/manage-orders-microsoft-store-for-business.md +++ b/store-for-business/manage-orders-microsoft-store-for-business.md @@ -55,10 +55,10 @@ Refunds work a little differently for free apps, and apps that have a price. In Reclaim licenses, and then request a refund. If you haven't assigned licenses, start on step 5. 1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**, and then choose **Apps & software**. -3. Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**. +2. Click **Manage**, and then choose **Apps & software**. +3. Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**. 4. Select the people who you want to reclaim license from, click the ellipses under **Actions**, and then choose **Reclaim licenses**. -5. Click **Order history**, click the order you want to refund, and click **Refund order**. +5. Click **Order history**, click the order you want to refund, and click **Refund order**. For free apps, the app will be removed from your inventory in **Apps & software**. diff --git a/store-for-business/update-microsoft-store-for-business-account-settings.md b/store-for-business/update-microsoft-store-for-business-account-settings.md index 495b200df1..1cb95fa906 100644 --- a/store-for-business/update-microsoft-store-for-business-account-settings.md +++ b/store-for-business/update-microsoft-store-for-business-account-settings.md @@ -94,7 +94,7 @@ If you qualify for tax-exempt status in your market, start a service request to **To start a service request** 1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com). -2. Select **Manage**, click **Support**, and then under **Store settings & configuration** select **Create technical support ticket**. +2. Select **Manage**, click **Support**, and then under **Store settings & configuration** select **Create technical support ticket**. You’ll need this documentation: diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index 90350a2913..f4075f53b1 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -42,7 +42,7 @@ Before attempting this procedure, you should read and understand the information 2. To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - ``` syntax + ```powershell <# .SYNOPSIS This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. @@ -59,9 +59,6 @@ Before attempting this procedure, you should read and understand the information .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 #> - []() - - []() function ConvertSIDToHexFormat {    param([System.Security.Principal.SecurityIdentifier]$sidToConvert) diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index dddf40f87f..58e0e60b57 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -40,8 +40,8 @@ Benefits of this design change include: >**Try This** > > To see the refactoring behavior, create a Windows 10 version 1703 VM and configure the memory settings as follows: -> 1. To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. -> 2. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. +> 1. To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. +> 2. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. Refactoring also makes it easier to view running processes in Task Manager. You can look at Task Manager and know exactly which service is using what resources, without having to expand many separate host groups. diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index f8b87748fa..9761cd0e66 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -60,13 +60,13 @@ When managing over OMA DM, make sure to always use a unique GUID. Provisioning w Braces { } are required around the GUID. In OMA Client Provisioning, you can type the braces. For example: -``` syntax +```xml ``` For OMA DM, you must use the ASCII values of %7B and %7D for the opening and closing braces, respectively. For example, if the GUID is "C556E16F-56C4-4EDB-9C64-D9469EE1FBE0", type: -``` syntax +```xml ./Vendor/MSFT/ActiveSync/Accounts/%7BC556E16F-56C4-4EDB-9C64-D9469EE1FBE0%7D diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index ed052860e4..d1e42bc7aa 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -14,6 +14,7 @@ ms.date: 09/18/2018 # AssignedAccess CSP +**Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.** The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. @@ -134,7 +135,7 @@ Additionally, the Status payload includes the following fields: Supported operation is Get. **./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** -Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. Shell Launcher V2 is introduced in Windows 10, version 1903 to support both UWP and Win32 apps as the custom shell. For more information, see [Shell Launcher](https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher). +Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. Shell Launcher V2 is introduced in Windows 10, version 1903 to support both UWP and Win32 apps as the custom shell. For more information, see [Shell Launcher](https://docs.microsoft.com/windows/configuration/kiosk-shelllauncher). > [!Note] > You cannot set both ShellLauncher and KioskModeApp at the same time on the device. @@ -246,6 +247,8 @@ KioskModeApp Replace ## AssignedAccessConfiguration XSD +Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + ```xml + + + @@ -270,6 +278,7 @@ KioskModeApp Replace + @@ -286,6 +295,10 @@ KioskModeApp Replace + + + + @@ -304,7 +317,13 @@ KioskModeApp Replace + + + + + + @@ -322,7 +341,8 @@ KioskModeApp Replace - + + @@ -340,6 +360,7 @@ KioskModeApp Replace + @@ -365,6 +386,22 @@ KioskModeApp Replace + + + + + + + + + + + + + + + + @@ -385,7 +422,94 @@ KioskModeApp Replace +``` +Here is the schema for new features introduced in Windows 10 1809 release +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +Schema for Windows 10 prerelease +```xml + + + + + + + + + + + + + + + + + + +``` + +To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. e.g. to configure auto-launch feature which is added in 1809 release, use below sample, notice an alias r1809 is given to the 201810 namespace for 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +```xml + + + + + + ``` ## Example AssignedAccessConfiguration XML @@ -796,7 +920,7 @@ StatusConfiguration Get StatusConfiguration Replace On -```syntax +```xml @@ -1219,7 +1343,7 @@ ShellLauncherConfiguration Get ## AssignedAccessAlert XSD -```syntax +```xml 1 @@ -379,7 +379,7 @@ Add a root certificate to the MDM server. Get all installed client certificates. -``` syntax +```xml 1 @@ -394,7 +394,7 @@ Get all installed client certificates. Delete a root certificate. -``` syntax +```xml 1 @@ -409,7 +409,7 @@ Delete a root certificate. Configure the device to enroll a client certificate through SCEP. -``` syntax +```xml 100 @@ -588,7 +588,7 @@ Configure the device to enroll a client certificate through SCEP. Configure the device to automatically renew an MDM client certificate with the specified renew period and retry interval. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 6ef3f48d8b..567dfd207e 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -198,7 +198,7 @@ The following diagram shows the CM\_CellularEntries configuration service provid To delete a connection, you must first delete any associated proxies and then delete the connection. The following example shows how to delete the proxy and then the connection. -``` syntax +```xml @@ -214,7 +214,7 @@ To delete a connection, you must first delete any associated proxies and then de Configuring a GPRS connection: -``` syntax +```xml @@ -231,7 +231,7 @@ Configuring a GPRS connection: Configuring an LTE connection: -``` syntax +```xml @@ -250,7 +250,7 @@ Configuring an LTE connection: Configuring a CDMA connection: -``` syntax +```xml diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index e9c0f37c15..1dfca8abb1 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -240,7 +240,7 @@ Specifies the type of connection being referenced. The following list describes Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -285,7 +285,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -334,7 +334,7 @@ Adding a host-based mapping policy. In this example, the ConnectionId for type C Adding an application-based mapping policy: -``` syntax +```xml @@ -401,7 +401,7 @@ Adding an application-based mapping policy: Adding a host-based mapping policy: -``` syntax +```xml diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index f601f858de..08d0040594 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -240,7 +240,7 @@ Specifies the type of connection being referenced. The following list describes Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -285,7 +285,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. -``` syntax +```xml @@ -334,7 +334,7 @@ Adding a host-based mapping policy. In this example, the ConnectionId for type C Adding an application-based mapping policy: -``` syntax +```xml @@ -401,7 +401,7 @@ Adding an application-based mapping policy: Adding a host-based mapping policy: -``` syntax +```xml diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 6e5b89a1b1..05add93e6a 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -38,7 +38,7 @@ Package Full Name of the App that needs be launched in the background. This can **Set StartupAppID** -``` syntax +```xml @@ -60,7 +60,7 @@ Package Full Name of the App that needs be launched in the background. This can **Get all background tasks** -``` syntax +```xml @@ -78,7 +78,7 @@ Package Full Name of the App that needs be launched in the background. This can **Add background task** -``` syntax +```xml diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 0888128b87..13a78b2032 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -648,7 +648,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego Example -``` syntax +```xml $CmdID$ @@ -919,7 +919,7 @@ The following screenshots of the administrator console shows the list of update Set auto update to notify and defer. -``` syntax +```xml diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 40379541ed..09d6af05e4 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -70,7 +70,7 @@ The parent node to group SIM2 specific information in case of dual SIM mode. The following sample shows how to query roaming status and phone number on the device. -``` syntax +```xml 2 @@ -88,7 +88,7 @@ The following sample shows how to query roaming status and phone number on the d Response from the phone. -``` syntax +```xml 3 1 diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index b2cf37371d..246408076e 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -126,7 +126,7 @@ Required. This node has the same set of policy nodes as the **ProviderID** node. Set device lock policies: -``` syntax +```xml 13 diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 98c675ebf6..44c558fde0 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -420,7 +420,7 @@ Default value is 0 meaning no keyword. Get provider **Keywords** -``` syntax +```xml @@ -440,7 +440,7 @@ Get provider **Keywords** Set provider **Keywords** -``` syntax +```xml diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 6c7e0be2f3..3cb1682333 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -105,7 +105,7 @@ After the previous package is sent, the unenrollment process begins. When the server initiates disconnection, all undergoing sessions for the enrollment ID are aborted immediately to avoid deadlocks. The server will not get a response for the unenrollment, instead a generic alert notification is sent with messageid=1. -``` syntax +```xml 4 1226 diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 4dd6ad8b3d..7946edba39 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -70,7 +70,7 @@ Supported operation is Get. The following is a Get command example. -``` syntax +```xml 12 @@ -173,7 +173,7 @@ To work around the timeout, you can use this setting to keep the session alive b Here is an example of DM message sent by the device when it is in pending state: -``` syntax +```xml 1.2 @@ -229,7 +229,7 @@ Added in Windows 10, version 1607. The list of management server URLs in the fo -``` syntax +```xml 101 @@ -770,7 +770,7 @@ Note that <LocURI>./Vendor/MSFT/DMClient/Unenroll</LocURI> is suppor The following SyncML shows how to remotely unenroll the device. Note that this command should be inserted in the general DM packages sent from the server to the device. -``` syntax +```xml 2 diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index d8747df10d..e7d55aedc0 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -29,7 +29,7 @@ The following diagram shows the DynamicManagement configuration service provider

Default value is False. Supported operations are Get and Replace.

Example to turn on NotificationsEnabled:

-``` syntax +```xml 100 @@ -84,7 +84,7 @@ The following diagram shows the DynamicManagement configuration service provider Disable Cortana based on Geo location and time, From 9am-5pm, when in the 100 meters radius of the specified latitude/longitude -``` syntax +```xml 200 @@ -138,7 +138,7 @@ Disable Cortana based on Geo location and time, From 9am-5pm, when in the 100 me Disable camera using network trigger with time trigger, from 9-5, when ip4 gateway is 192.168.0.1 -``` syntax +```xml 300 @@ -193,7 +193,7 @@ Disable camera using network trigger with time trigger, from 9-5, when ip4 gatew Delete a context -``` syntax +```xml 400 @@ -206,7 +206,7 @@ Delete a context Get ContextStatus and SignalDefinition from a specific context -``` syntax +```xml 400 diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 0080b3d273..49635be46f 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -142,11 +142,11 @@ The following list describes the prerequisites for a certificate to be used with - The certificate must have at least one of the following EKU (Extended Key Usage) properties: - Client Authentication - - As defined by RFC 5280, this is a well-defined OID with Value 1.3.6.1.5.5.7.3.2 + - As defined by RFC 5280, this is a well-defined OID with Value 1.3.6.1.5.5.7.3.2 - Any Purpose - - An EKU Defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that additional non-critical or custom EKUs can still be added to the certificate for effective filtering. + - An EKU Defined and published by Microsoft, is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that additional non-critical or custom EKUs can still be added to the certificate for effective filtering. - All Purpose - - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but does not want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. + - As defined by RFC 5280, If a CA includes extended key usages to satisfy some application needs, but does not want to restrict usage of the key, the CA can add an Extended Key Usage Value of 0. A certificate with such an EKU can be used for all purposes. - The user or the computer certificate on the client chains to a trusted root CA - The user or the computer certificate does not fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy. - The user or the computer certificate does not fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server. diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index 8e61116fdd..f97a70c2f7 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -64,7 +64,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( > [!NOTE] > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. -``` syntax +```xml @@ -114,7 +114,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( Here is the snippet from appv.admx: - ``` syntax + ```xml @@ -226,7 +226,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( > [!NOTE] > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. - ``` syntax + ```xml @@ -264,7 +264,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( The \ payload is \. Here is an example to disable AppVirtualization/PublishingAllowServer2. -``` syntax +```xml diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index 645484d8fa..e05ab31e6f 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -275,7 +275,7 @@ After the installation of updates is completed, the IT Admin can use the DURepor ## Example PowerShell script -``` syntax +```powershell param ( # [Parameter (Mandatory=$true, HelpMessage="Input File")] [String]$inputFile, diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 1d7810f0e3..f374eaec31 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -50,7 +50,7 @@ Requirements: - Enterprise has MDM service already configured - Enterprise AD must be registered with Azure AD -1. Run GPEdit.msc +1. Run GPEdit.msc Click Start, then in the text box type gpedit. @@ -62,11 +62,11 @@ Requirements: ![MDM policies](images/autoenrollment-mdm-policies.png) -4. Double-click **Auto MDM Enrollment with AAD Token**. +4. Double-click **Auto MDM Enrollment with AAD Token**. ![MDM autoenrollment policy](images/autoenrollment-policy.png) -5. Click **Enable**, then click **OK**. +5. Click **Enable**, then click **OK**. A task is created and scheduled to run every 5 minutes for the duration of 1 day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." @@ -76,9 +76,9 @@ Requirements: ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) -6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. +6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. -7. Click **Info** to see the MDM enrollment information. +7. Click **Info** to see the MDM enrollment information. ![Work School Settings](images/autoenrollment-settings-work-school.png) @@ -91,9 +91,9 @@ Requirements: ![Task Scheduler search result](images/autoenrollment-task-schedulerapp.png) -2. Under **Best match**, click **Task Scheduler** to launch it. +2. Under **Best match**, click **Task Scheduler** to launch it. -3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. +3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) @@ -122,11 +122,11 @@ Requirements: > 5. Restart the Primary Domain Controller for the policy to be available. > This procedure will work for any future version as well. -1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. -2. Create a Security Group for the PCs. -3. Link the GPO. -4. Filter using Security Groups. -5. Enforce a GPO link. +1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. +2. Create a Security Group for the PCs. +3. Link the GPO. +4. Filter using Security Groups. +5. Enforce a GPO link. > [!NOTE] > Version 1903 (March 2019) is actually on the Insider program and doesn't yet contain a downloadable version of Templates (version 1903). diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index 2502635341..b809041a65 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -78,7 +78,7 @@ Note that performing a full inventory of a device can be resource intensive on t Here is an example of a query for all apps on the device. -``` syntax +```xml 1 @@ -92,7 +92,7 @@ Here is an example of a query for all apps on the device. Here is an example of a query for a specific app for a user. -``` syntax +```xml 1 @@ -121,7 +121,7 @@ For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP]( Here is an example of a query for all app licenses on a device. -``` syntax +```xml 1 @@ -135,7 +135,7 @@ Here is an example of a query for all app licenses on a device. Here is an example of a query for all app licenses for a user. -``` syntax +```xml 1 @@ -161,7 +161,7 @@ For more information about the AllowAllTrustedApps policy, see [Policy CSP](poli Here are some examples. -``` syntax +```xml 1 @@ -199,7 +199,7 @@ For more information about the AllowDeveloperUnlock policy, see [Policy CSP](pol Here is an example. -``` syntax +```xml 1 @@ -244,7 +244,7 @@ Here are the requirements for this scenario: Here are some examples. -``` syntax +```xml 1 @@ -281,7 +281,7 @@ In the SyncML, you need to specify the following information in the Exec command Here is an example of an offline license installation. -``` syntax +```xml 1 @@ -315,7 +315,7 @@ The Add command for the package family name is required to ensure proper removal Here is an example of a line-of-business app installation. -``` syntax +```xml 0 @@ -342,7 +342,7 @@ Here is an example of a line-of-business app installation. Here is an example of an app installation with dependencies. -``` syntax +```xml 0 @@ -376,7 +376,7 @@ Here is an example of an app installation with dependencies. Here is an example of an app installation with dependencies and optional packages. -``` syntax +```xml 0 @@ -438,7 +438,7 @@ Here is an example of app installation. > **Note**  This is only supported in Windows 10 for desktop editions. -``` syntax +```xml 0 @@ -475,7 +475,7 @@ Here is an example of app installation with dependencies. > **Note**  This is only supported in Windows 10 for desktop editions. -``` syntax +```xml 0 @@ -526,7 +526,7 @@ When an app is installed successfully, the node is cleaned up and no longer pres Here is an example of a query for a specific app installation. -``` syntax +```xml 2 @@ -540,7 +540,7 @@ Here is an example of a query for a specific app installation. Here is an example of a query for all app installations. -``` syntax +```xml 2 @@ -558,7 +558,7 @@ Application installations can take some time to complete, hence they are done as Here is an example of an alert. -``` syntax +```xml 4 1226 @@ -594,7 +594,7 @@ To uninstall an app, you delete it under the origin node, package family name, a Here is an example for uninstalling all versions of an app for a user. -``` syntax +```xml 1 @@ -608,7 +608,7 @@ Here is an example for uninstalling all versions of an app for a user. Here is an example for uninstalling a specific version of the app for a user. -``` syntax +```xml 1 @@ -631,7 +631,7 @@ Removing provisioned app occurs in the device context. Here is an example for removing a provisioned app from a device. -``` syntax +```xml 1 @@ -645,7 +645,7 @@ Here is an example for removing a provisioned app from a device. Here is an example for removing a specific version of a provisioned app from a device: -``` syntax +```xml 1 @@ -663,7 +663,7 @@ You can remove app licenses from a device per app based on the content ID. Here is an example for removing an app license for a user. -``` syntax +```xml 1 @@ -677,7 +677,7 @@ Here is an example for removing an app license for a user. Here is an example for removing an app license for a provisioned package (device context). -``` syntax +```xml 1 @@ -697,7 +697,7 @@ For user-based uninstallation, use ./User in the LocURI, and for provisioning, u Here is an example. There is only one uninstall for hosted and store apps. -``` syntax +```xml 1226 @@ -723,7 +723,7 @@ To update an app from Microsoft Store, the device requires contact with the stor Here is an example of an update scan. -``` syntax +```xml 1 @@ -737,7 +737,7 @@ Here is an example of an update scan. Here is an example of a status check. -``` syntax +```xml 1 @@ -766,7 +766,7 @@ Turning off updates only applies to updates from the Microsoft Store at the devi Here is an example. -``` syntax +```xml 1 @@ -795,7 +795,7 @@ You can install app on non-system volumes, such as a secondary partition or remo Here is an example. -``` syntax +```xml 1 @@ -832,7 +832,7 @@ The RestrictAppDataToSystemVolume policy in [Policy CSP](policy-configuration-se Here is an example. -``` syntax +```xml 1 @@ -873,7 +873,7 @@ The valid values are 0 (off, default value) and 1 (on). Here is an example. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index 2b091686b2..d2b3bddc1d 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -132,7 +132,7 @@ The following image shows the EnterpriseAPN configuration service provider in tr ## Examples -``` syntax +```xml diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index e5e5177782..486334505b 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -209,7 +209,7 @@ The Microsoft Store application has a GUID of d5dc1ebb-a7f1-df11-9264-00237de2db Use the following SyncML format to query to see if the application is installed on a managed device: -``` syntax +```xml 1 @@ -222,7 +222,7 @@ Use the following SyncML format to query to see if the application is installed Response from the device (it contains list of subnodes if this app is installed in the device). -``` syntax +```xml 3 1 @@ -266,7 +266,7 @@ The value actually applied to the device can be queried via the nodes under the Enroll enterprise ID “4000000001” for the first time: -``` syntax +```xml 2 @@ -293,7 +293,7 @@ Enroll enterprise ID “4000000001” for the first time: Update the enrollment token (for example, to update an expired application enrollment token): -``` syntax +```xml 2 @@ -310,7 +310,7 @@ Update the enrollment token (for example, to update an expired application enrol Query all installed applications that belong to enterprise id “4000000001”: -``` syntax +```xml 2 @@ -325,7 +325,7 @@ Query all installed applications that belong to enterprise id “4000000001”: Response from the device (that contains two installed applications): -``` syntax +```xml 3 1 @@ -444,7 +444,7 @@ To perform an XAP update, create the Name, URL, Version, and DownloadInstall nod -``` syntax +```xml 2 ` node among with other `` nodes, it shares most grammar with the Application Node, **folderId** is mandatory, **folderName** is optional, which is the folder name displayed on Start. **folderId** is a unique unsigned integer for each folder. Folder example: -``` syntax +```xml Large @@ -123,7 +123,7 @@ Folder example: ``` An application that belongs in the folder would add an optional attribute **ParentFolderId**, which maps to **folderId** of the folder. In this case, the location of this application will be located inside the folder. -``` syntax +```xml Medium @@ -252,7 +252,7 @@ For example, in place of SettingPageDisplay, you would use ms-settings:display. Here is an example for Windows 10, version 1703. -``` syntax +```xml @@ -327,14 +327,14 @@ Starting in Windows 10, version 1703, Quick action settings no longer require an In this example, all settings pages and quick action settings are allowed. An empty \ node indicates that none of the settings are blocked. -``` syntax +```xml ``` In this example for Windows 10, version 1511, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names. -``` syntax +```xml @@ -350,7 +350,7 @@ In this example for Windows 10, version 1511, all System setting pages are ena ``` Here is an example for Windows 10, version 1703. -``` syntax +```xml @@ -382,7 +382,7 @@ Buttons | The following list identifies the hardware buttons on the device that > Custom buttons are hardware buttons that can be added to devices by OEMs. Buttons example: -``` syntax +```xml @@ -407,7 +407,7 @@ The Search and custom buttons can be remapped or configured to open a s To remap a button in lockdown XML, you supply the button name, the button event (typically "press"), and the product ID for the application the button will open. -``` syntax +```xml
- @@ -72,7 +71,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -83,7 +81,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -94,7 +91,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -105,7 +101,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -116,7 +111,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -130,7 +124,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -141,7 +134,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -152,7 +144,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -163,7 +154,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -174,7 +164,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -185,7 +174,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -196,7 +184,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -207,7 +194,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -218,18 +204,16 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - - - - + + + @@ -237,11 +221,10 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - - - + + + @@ -250,9 +233,8 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - + @@ -262,7 +244,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -276,7 +257,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -285,9 +265,8 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - +
Home Basic
Home Premium
Professional
Ultimate
Enterprise
Windows 8.1
Connected
Pro
Pro Student
Pro WMC
Enterprise
Embedded Industry
Windows RT
Windows Phone 8.1
Windows 10
Home
Pro D
D D
Mobile Enterprise D
diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md index de23e1d507..e1e7522f96 100644 --- a/windows/deployment/usmt/usmt-customize-xml-files.md +++ b/windows/deployment/usmt/usmt-customize-xml-files.md @@ -89,7 +89,7 @@ In addition, note the following functionality with the Config.xml file: - If a parent component is removed from the migration in the Config.xml file by specifying `migrate="no"`, all of its child components will automatically be removed from the migration, even if the child component is set to `migrate="yes"`. -- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no" `and the other line specifies `migrate="yes"`, the component will be migrated. +- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no"` and the other line specifies `migrate="yes"`, the component will be migrated. - In USMT there are several migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. For more information, see the [Config.xml File](usmt-configxml-file.md) topic. diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md index 6b9330d5ec..daad6f47ed 100644 --- a/windows/deployment/usmt/usmt-general-conventions.md +++ b/windows/deployment/usmt/usmt-general-conventions.md @@ -50,7 +50,7 @@ Before you modify the .xml files, become familiar with the following guidelines: - **File names with brackets** - If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named File.txt, you must specify `c:\documents\mydocs [file^].txt] `instead of `c:\documents\mydocs [file].txt]`. + If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named File.txt, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. - **Using quotation marks** diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index 84d7c89277..13fcf0effc 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -1499,7 +1499,7 @@ For example: - **MergeMultiSzContent** - The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and` String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. + The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. Syntax: MergeMultiSzContent (*Instruction*,*String*,*Instruction*,*String*,…) @@ -3618,7 +3618,7 @@ The return value that is required by <script> depends on the parent elemen Syntax: <script>MigXmlHelper.GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*")</script> - Example:` ` + Example: `` - You can use [GenerateUserPatterns](#scriptfunctions) when <script> is within <objectSet>. diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index 385a3ca858..e38607bd29 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -67,9 +67,9 @@ You'll be prompted to save your files before the switch starts. Follow the promp Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. -1. Start Microsoft Intune. -2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. -3. Follow the instructions to complete the switch. +1. Start Microsoft Intune. +2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. +3. Follow the instructions to complete the switch. ## Block users from switching diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 914c40a5d6..cb36507a31 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -8,6 +8,7 @@ ms.localizationpriority: medium ms.sitesec: library ms.pagetype: mdt author: greg-lindsay +manager: laurawi ms.collection: M365-modern-desktop search.appverid: - MET150 @@ -92,10 +93,10 @@ If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade ben ### Windows 10 Education requirements -1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. -2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security> Activation. -3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. -4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. +1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. +2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security> Activation. +3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. +4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. >If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. @@ -136,8 +137,8 @@ After Windows 10, version 1903:
![1903](images/after.png) Note: -1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). -2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). +1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). +2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). ### Scenarios diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index f2f6408b2f..86812d946a 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -244,7 +244,7 @@ Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see Follow these steps to run the PS script: -1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: +1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: ```powershell md c:\HWID @@ -647,9 +647,9 @@ Note: A 64-bit operating system is required to run Hyper-V. Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool: -1. The source folder for your application -2. The name of the setup executable file -3. The output folder for the new file +1. The source folder for your application +2. The name of the setup executable file +3. The output folder for the new file For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. diff --git a/windows/deployment/windows-autopilot/registration-auth.md b/windows/deployment/windows-autopilot/registration-auth.md index 452de96733..efa12958dc 100644 --- a/windows/deployment/windows-autopilot/registration-auth.md +++ b/windows/deployment/windows-autopilot/registration-auth.md @@ -36,7 +36,7 @@ CSP partners can get customer authorization to register Windows Autopilot device For a CSP to register Windows Autopilot devices on behalf of a customer, the customer must first grant that CSP partner permission using the following process: -1. CSP sends link to customer requesting authorization/consent to register/manage devices on their behalf. To do so: +1. CSP sends link to customer requesting authorization/consent to register/manage devices on their behalf. To do so: - CSP logs into Microsoft Partner Center - Click **Dashboard** on the top menu - Click **Customer** on the side menu @@ -54,8 +54,8 @@ For a CSP to register Windows Autopilot devices on behalf of a customer, the cus ![Not global admin](images/csp4.png) -3. Customer selects the **Yes** checkbox, followed by the **Accept** button. Authorization happens instantaneously. -4. The CSP will know that this consent/authorization request has been completed because the customer will show up in the CSP’s MPC account under their **customers** list, for example: +3. Customer selects the **Yes** checkbox, followed by the **Accept** button. Authorization happens instantaneously. +4. The CSP will know that this consent/authorization request has been completed because the customer will show up in the CSP’s MPC account under their **customers** list, for example: ![Customers](images/csp5.png) @@ -63,17 +63,17 @@ For a CSP to register Windows Autopilot devices on behalf of a customer, the cus Each OEM has a unique link to provide to their respective customers, which the OEM can request from Microsoft via msoemops@microsoft.com. -1. OEM emails link to their customer. -2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link once they receive it from the OEM, which takes them directly to the following MSfB page: +1. OEM emails link to their customer. +2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link once they receive it from the OEM, which takes them directly to the following MSfB page: ![Global admin](images/csp6.png) NOTE: A user without global admin privileges who clicks the link will see a message similar to the following: ![Not global admin](images/csp7.png) -3. Customer selects the **Yes** checkbox, followed by the **Accept** button, and they’re done. Authorization happens instantaneously. +3. Customer selects the **Yes** checkbox, followed by the **Accept** button, and they’re done. Authorization happens instantaneously. -4. The OEM can use the Validate Device Submission Data API to verify the consent has completed. This API is discussed in the latest version of the API Whitepaper, p. 14ff [https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx](https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx). **Note**: this link is only accessible by Microsoft Device Partners. As discussed in this whitepaper, it’s a best practice recommendation for OEM partners to run the API check to confirm they’ve received customer consent before attempting to register devices, thus avoiding errors in the registration process. +4. The OEM can use the Validate Device Submission Data API to verify the consent has completed. This API is discussed in the latest version of the API Whitepaper, p. 14ff [https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx](https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx). **Note**: this link is only accessible by Microsoft Device Partners. As discussed in this whitepaper, it’s a best practice recommendation for OEM partners to run the API check to confirm they’ve received customer consent before attempting to register devices, thus avoiding errors in the registration process. ## Summary diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md index 642497fe48..4c997d322d 100644 --- a/windows/deployment/windows-autopilot/white-glove.md +++ b/windows/deployment/windows-autopilot/white-glove.md @@ -8,6 +8,7 @@ ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy author: greg-lindsay +manager: laurawi ms.author: greg-lindsay ms.collection: M365-modern-desktop ms.topic: article @@ -110,4 +111,4 @@ If the pre-provisioning process completed successfully and the device was reseal ## Related topics -[White glove video](https://youtu.be/nE5XSOBV0rI) \ No newline at end of file +[White glove video](https://youtu.be/nE5XSOBV0rI) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md index 3422c91127..938d13c7dc 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md @@ -26,14 +26,13 @@ Windows Autopilot includes support for a growing list of scenarios, designed to The following Windows Autopilot scenarios are described in this guide: - -
ScenarioMore information -
Deploy devices that will be set up by a member of the organization and configured for that person[Windows Autopilot user-driven mode](user-driven.md) -
Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.[Windows Autopilot self-deploying mode](self-deploying.md) -
Re-deploy a device in a business-ready state.[Windows Autopilot Reset](windows-autopilot-reset.md) -
Pre-provision a device with up-to-date applications, policies and settings.[White glove](white-glove.md) -
Deploy Windows 10 on an existing Windows 7 or 8.1 device[Windows Autopilot for existing devices](existing-devices.md) -
+| Scenario | More information | +| --- | --- | +| Deploy devices that will be set up by a member of the organization and configured for that person | [Windows Autopilot user-driven mode](user-driven.md) | +| Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.| [Windows Autopilot self-deploying mode](self-deploying.md) | +| Re-deploy a device in a business-ready state.| [Windows Autopilot Reset](windows-autopilot-reset.md) | +| Pre-provision a device with up-to-date applications, policies and settings.| [White glove](white-glove.md) | +| Deploy Windows 10 on an existing Windows 7 or 8.1 device | [Windows Autopilot for existing devices](existing-devices.md) | ## Windows Autopilot capabilities diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index b9d06453a0..acef50c475 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -405,7 +405,7 @@ In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data ### Enable limiting enhanced diagnostic data to the minimum required by Windows Analytics -1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM. +1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM. a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**. @@ -415,9 +415,9 @@ In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data -AND- -2. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM. +2. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM. - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**. + a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**. -OR- diff --git a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md index 58c89a6256..8fa6e44dc7 100644 --- a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md +++ b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md @@ -46,7 +46,7 @@ d) use the software in any way that is against the law or to create or propagate e) share, publish, distribute, or lend the software, provide the software as a stand-alone hosted solution for others to use, or transfer the software or this agreement to any third party. -4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit http://aka.ms/exporting. +4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit https://aka.ms/exporting. 5. SUPPORT SERVICES. Microsoft is not obligated under this agreement to provide any support services for the software. Any support provided is “as is”, “with all faults”, and without warranty of any kind. @@ -62,9 +62,9 @@ b) Canada. If you acquired this software in Canada, you may stop receiving updat c) Germany and Austria. -i. Warranty. The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation to the licensed software. +i. Warranty. The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation to the licensed software. -ii. Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory law. +ii. Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory law. Subject to the foregoing clause ii., Microsoft will only be liable for slight negligence if Microsoft is in breach of such material contractual obligations, the fulfillment of which facilitate the due performance of this agreement, the breach of which would endanger the purpose of this agreement and the compliance with which a party may constantly trust in (so-called "cardinal obligations"). In other cases of slight negligence, Microsoft will not be liable for slight negligence. diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index 843d0975aa..84112c5107 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -107,7 +107,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt | | [Defender/SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent) | Stop sending file samples back to Microsoft. **Set to 2 (two)** | 23.1 Windows Defender Smartscreen | [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) | Disable Windows Defender Smartscreen. **Set to 0 (zero)** | 23.2 Windows Defender Smartscreen EnableAppInstallControl | [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol) | Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** -| 23.3 Windows Defender Potentially Unwanted Applications(PUA) Protection | [Defender/PUAProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-puaprotection) | Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** +| 23.3 Windows Defender Potentially Unwanted Applications(PUA) Protection | [Defender/PUAProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-puaprotection) | Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** | 24. Windows Spotlight | [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight) | Disable Windows Spotlight. **Set to 0 (zero)** | 25. Microsoft Store | [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps)| Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. **Set to 1 (one)** | | [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate)| Specifies whether automatic update of apps from Microsoft Store are allowed. **Set to 0 (zero)** @@ -115,8 +115,8 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt | 26. Windows Update Delivery Optimization | | The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). | | [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode)| Lets you choose where Delivery Optimization gets or sends updates and apps. **Set to 100 (one hundred)** | 27. Windows Update | [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) | Control automatic updates. **Set to 5 (five)** -| 27.1 Windows Update Allow Update Service | [Update/AllowUpdateService](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-allowupdateservice) | Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** -| 27.2 Windows Update Service URL| [Update/UpdateServiceUrl](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-updateserviceurl) | Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with this Value: +| 27.1 Windows Update Allow Update Service | [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice) | Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** +| 27.2 Windows Update Service URL| [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl) | Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with this Value: $CmdID$ diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 1d4984ab8f..4f007d6da6 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -35,10 +35,10 @@ Where applicable, each endpoint covered in this topic includes a link to specifi We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 4c1d88e554..c8c4bffe0c 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -35,10 +35,10 @@ Where applicable, each endpoint covered in this topic includes a link to specifi We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 3fad7e54b2..2f2f90b82d 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -35,10 +35,10 @@ Where applicable, each endpoint covered in this topic includes a link to specifi We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index fa8392963d..5400e152f2 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -34,10 +34,10 @@ Where applicable, each endpoint covered in this topic includes a link to the spe The following methodology was used to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. 7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md index d886aa19d1..2d1b7a1a36 100644 --- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md @@ -27,10 +27,10 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-e We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. diff --git a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md index 574818973c..885bdb44c7 100644 --- a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md @@ -27,10 +27,10 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-e We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md index fc7a408f5a..d7ad47c4a1 100644 --- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md @@ -27,10 +27,10 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-1 We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index eae4bd3cf3..96f81d22ed 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -26,10 +26,10 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-1 The following methodology was used to derive the network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. -4. Compile reports on traffic going to public IP addresses. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. 7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. diff --git a/windows/security/identity-protection/access-control/dynamic-access-control.md b/windows/security/identity-protection/access-control/dynamic-access-control.md index 86cb99ce3b..73b4f343aa 100644 --- a/windows/security/identity-protection/access-control/dynamic-access-control.md +++ b/windows/security/identity-protection/access-control/dynamic-access-control.md @@ -96,10 +96,6 @@ By default, devices running any of the supported versions of Windows are able to Every domain controller needs to have the same Administrative Template policy setting, which is located at **Computer Configuration\\Policies\\Administrative Templates\\System\\KDC\\Support Dynamic Access Control and Kerberos armoring**. -### Support for using the Key Distribution Center (KDC) Group Policy setting to enable Dynamic Access Control for a domain. - -Every domain controller needs to have the same Administrative Template policy setting, which is located at **Computer Configuration\\Policies\\Administrative Templates\\System\\KDC\\Support Dynamic Access Control and Kerberos armoring**. - ### Support in Active Directory to store user and device claims, resource properties, and central access policy objects. ### Support for using Group Policy to deploy central access policy objects. diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index d63ee0bd86..65a665503d 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -250,7 +250,7 @@ You can use Local Users and Groups to assign rights and permissions on the local You cannot use Local Users and Groups on a domain controller. However, you can use Local Users and Groups on a domain controller to target remote computers that are not domain controllers on the network. **Note**   -You use Active Directory Users and Computers to manage users and groups in Active Directory.loca +You use Active Directory Users and Computers to manage users and groups in Active Directory. You can also manage local users by using NET.EXE USER and manage local groups by using NET.EXE LOCALGROUP, or by using a variety of PowerShell cmdlets and other scripting technologies. diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index b6f34703f8..4579829e90 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 3923238254..c23f167615 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index 57524af4a3..fb9a2e4abd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -30,13 +30,13 @@ ms.reviewer: ## How many is adequate -How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2019 includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged. +How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged. -Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2019 domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2019 domain controller. +Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 and above domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller. -Determining an adequate number of Windows Server 2019 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2019) to a deployment of existing domain controllers (Windows Server 2008R2, Windows Server 2012R2 or Windows Server 2016) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario: +Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2019) to a deployment of existing domain controllers (Windows Server 2008R2, Windows Server 2012R2 or Windows Server 2016) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario: Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index f0642dac90..2eb9365b7b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 8e27516437..3c60042dd6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -9,8 +9,8 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 8d6b7d474a..60e829af0c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,7 +19,7 @@ ms.reviewer: # Prepare and Deploy Windows Server 2016 Active Directory Federation Services **Applies to** -- Windows 10, version 1703 or later +- Windows 10, version 1703 or later - On-premises deployment - Certificate trust @@ -41,8 +41,8 @@ Prepare the Active Directory Federation Services deployment by installing and up ## Update Windows Server 2016 Sign-in the federation server with _local admin_ equivalent credentials. -1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please advise the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. -2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). +1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please advise the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. +2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). >[!IMPORTANT] >The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers. @@ -92,15 +92,15 @@ The Active Directory Federation Service (AD FS) role provides the following serv Windows Hello for Business depends on proper device registration. For on-premises deployments, Windows Server 2016 AD FS handles device registration. Sign-in the federation server with _Enterprise Admin_ equivalent credentials. -1. Start **Server Manager**. Click **Local Server** in the navigation pane. -2. Click **Manage** and then click **Add Roles and Features**. -3. Click **Next** on the **Before you begin** page. -4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. -5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. -6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. -7. Click **Next** on the **Select features** page. -8. Click **Next** on the **Active Directory Federation Service** page. -9. Click **Install** to start the role installation. +1. Start **Server Manager**. Click **Local Server** in the navigation pane. +2. Click **Manage** and then click **Add Roles and Features**. +3. Click **Next** on the **Before you begin** page. +4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. +5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. +6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. +7. Click **Next** on the **Select features** page. +8. Click **Next** on the **Active Directory Federation Service** page. +9. Click **Install** to start the role installation. ## Review @@ -123,7 +123,7 @@ The service account used for the device registration server depends on the domai Windows Server 2012 or later domain controllers support Group Managed Service Accounts—the preferred way to deploy service accounts for services that support them. Group Managed Service Accounts, or GMSA have security advantages over normal user accounts because Windows handles password management. This means the password is long, complex, and changes periodically. The best part of GMSA is all this happens automatically. AD FS supports GMSA and should be configured using them for additional defense in depth security. -GSMA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GSMA. Before you can create a GSMA, you must first create a root key for the service. You can skip this if your environment already uses GSMA. +GMSA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GMSA. Before you can create a GMSA, you must first create a root key for the service. You can skip this if your environment already uses GMSA. #### Create KDS Root Key @@ -138,11 +138,11 @@ Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key #### Create an AD FS Service Account Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Right-click the **Users** container, Click **New**. Click **User**. -3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. -4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. -5. Click **Next** and then click **Finish**. +1. Open **Active Directory Users and Computers**. +2. Right-click the **Users** container, Click **New**. Click **User**. +3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. +4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. +5. Click **Next** and then click **Finish**. ## Configure the Active Directory Federation Service Role @@ -205,8 +205,8 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 7. Right-click **Windows Hello for Business Users** group 8. Click the **Members** tab and click **Add…** 9. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. -10. Click **OK** to return to **Active Directory Users and Computers**. -11. Change to server hosting the AD FS role and restart it. +10. Click **OK** to return to **Active Directory Users and Computers**. +11. Change to server hosting the AD FS role and restart it. ### Configure Permissions for Key Registration @@ -299,7 +299,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. 9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Close the console. +10. Close the console. ### Configure the Windows Hello for Business Authentication Certificate template @@ -315,13 +315,13 @@ Sign-in a certificate authority or management workstations with _domain administ 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. -10. On the **Request Handling** tab, select the **Renew with same key** check box. -11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. -12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. -14. Click on the **Apply** to save changes and close the console. +10. On the **Request Handling** tab, select the **Renew with same key** check box. +11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. +14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template @@ -470,9 +470,9 @@ Sign-in the domain controller or administrative workstation with _Domain Admin_ ### Deploy the Intranet Zone Group Policy object -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. ## Review @@ -526,12 +526,3 @@ For detailed information about the certificate, use `Certutil -q -v Applications and Service Logs\Microsoft\Windows\User Device Registration\Admin | | **ID:** | 300 | | **Source:** | Microsoft Azure Device Registration Service | | **Version:** | 10 | diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index 107b3b238b..d1ba25aae2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -36,7 +36,7 @@ Windows Hello for Business deployments using System Center Configuration Manager ## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. -## How can PIN be more secure than a Password? +## How can a PIN be more secure than a password? When using Windows Hello for Business, the PIN is not a symmetric key where is the password is a symmetric key. With passwords, there is a server that has some representation of the password. With Windows Hello for Business, the PIN is user provided entropy used to load the private key in the TPM. The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM protected key, and the TPM that generated that key to successfully have access to the private key. The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It is about the difference of providing entropy vs continuing the use of a symmetric key (the password). The TPM has anti-hammering features which thwart brute-force PIN attacks (an attackers continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increased the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. @@ -44,8 +44,8 @@ The statement "PIN is stronger than Password" is not directed at the strength of ## Why is the Key Admins group missing, I have Windows Server 2016 domain controller(s)? The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. -## Can I use convenience PIN with Azure AD? -No. If you want to use PIN or biometrics with Azure Active Directory identities on Azure AD registered, Azure AD joined, or hybrid Azure AD joined devices, then you must deploy Windows Hello for Business. +## Can I use a convenience PIN with Azure AD? +It is currently possible to set a convience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users. ## Can I use an external camera when my laptop is closed or docked? No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. @@ -79,7 +79,7 @@ If your environment uses Microsoft Intune, you need these additional URLs: - portal.manage-beta.microsoft.com - portal.manage.microsoft.com -## What is the difference between non-destructive and destructive PIN Reset? +## What is the difference between non-destructive and destructive PIN reset? Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-features.md#pin-reset) from our [Windows Hello for Business Features](hello-features.md) page for more information. Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. @@ -104,28 +104,32 @@ Windows Hello for Business is two-factor authentication based the observed authe ## What are the biometric requirements for Windows Hello for Business? Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. -## Can I use PIN and biometrics to unlock my device? +## Can I use both a PIN and biometrics to unlock my device? Starting in Windows 10, version 1709, you can use multi-factor unlock to require the user to provide an additional factor to unlock the device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. Read more about [multifactor unlock](feature-multifactor-unlock.md). ## What is the difference between Windows Hello and Windows Hello for Business? Windows Hello represents the biometric framework provided in Windows 10. Windows Hello enables users to use biometrics to sign into their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. -## Why can I not enroll biometrics for my local built-in Administrator? +## Why can't I enroll biometrics for my local built-in Administrator? Windows 10 does not allow the local administrator to enroll biometric gestures(face or fingerprint). ## I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? No. If your organization is federated or using on-line services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organization who need more time before moving to the cloud and exclusively use Active Directory. ## Does Windows Hello for Business prevent the use of simple PINs? -Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. This prevents repeating numbers, sequential numbers and simple patterns. +Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). So, for example: -* 1111 has a constant delta of 0, so it is not allowed -* 1234 has a constant delta of 1, so it is not allowed -* 1357 has a constant delta of 2, so it is not allowed -* 9630 has a constant delta of -3, so it is not allowed -* 1231 does not have a constant delta, so it is okay -* 1593 does not have a constant delta, so it is okay +* The PIN 1111 has a constant delta of (0,0,0), so it is not allowed +* The PIN 1234 has a constant delta of (1,1,1), so it is not allowed +* The PIN 1357 has a constant delta of (2,2,2), so it is not allowed +* The PIN 9630 has a constant delta of (7,7,7), so it is not allowed +* The PIN 1593 has a constant delta of (4,4,4), so it is not allowed +* The PIN 7036 has a constant delta of (3,3,3), so it is not allowed +* The PIN 1231 does not have a constant delta (1,1,8), so it is allowed +* The PIN 1872 does not have a constant delta (7,9,5), so it is allowed +This prevents repeating numbers, sequential numbers, and simple patterns. +It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm does not apply to alphanumeric PINs. ## How does PIN caching work with Windows Hello for Business? @@ -139,12 +143,12 @@ The smart card emulation feature of Windows Hello for Business verifies the PIN ## Can I disable the PIN while using Windows Hello for Business? No. The movement away from passwords is accomplished by gradually reducing the use of the password. In the occurrence where you cannot authenticate with biometrics, you need a fall back mechanism that is not a password. The PIN is the fall back mechanism. Disabling or hiding the PIN credential provider disabled the use of biometrics. -## How keys are protected? +## How are keys protected? Wherever possible, Windows Hello for Business takes advantage of trusted platform module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business does not require a TPM. Administrators can choose to allow key operations in software Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to re-authenticate to the IDP before the IDP allows him or her to re-register). -## Can Windows Hello for Business work in air gapped environments? +## Can Windows Hello for Business work in air-gapped environments? Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require Internet connectivity to achieve an air-gapped Windows Hello for Business deployment. ## Can I use third-party authentication providers with Windows Hello for Business? diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md index cc796078e6..1a029f2dc9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ b/windows/security/identity-protection/hello-for-business/hello-features.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index cabdfe9676..d30031df7d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md index 58616c9d65..4cbec54f34 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index a3ff61d617..9a2711dc1c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -28,9 +28,6 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Azure AD joined provisioning in a Managed environment](#azure-ad-joined-provisioning-in-a-managed-environment)
[Azure AD joined provisioning in a Federated environment](#azure-ad-joined-provisioning-in-a-federated-environment)
[Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-key-trust-deployment-in-a-managed-environment)
-[Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-certificate-trust-deployment-in-a-managed-environment)
-[Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Federated environment](#hybrid-azure-ad-joined-provisioning-in-a-certificate-trust-deployment-in-a-managed-environment)
-[Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-synchronous-certificate-trust-deployment-in-a-managed-environment)
[Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](#hybrid-azure-ad-joined-provisioning-in-a-synchronous-certificate-trust-deployment-in-a-federated-environment)
[Domain joined provisioning in an On-premises Key Trust deployment](#domain-joined-provisioning-in-an-on-premises-key-trust-deployment)
[Domain joined provisioning in an On-premises Certificate Trust deployment](#domain-joined-provisioning-in-an-on-premises-certificate-trust-deployment)
@@ -75,45 +72,6 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, -[Return to top](#windows-hello-for-business-provisioning) -## Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment](images/howitworks/prov-haadj-certtrust-managed.png) - - -| Phase | Description | -|:-----:|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services provides the second factor of authentication. If the user has performed Azure MFA within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they are not prompted for MFA because the current MFA remains valid.
Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | -| B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv). | -| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID to the application, which represents the end of user key registration. | -| D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
The application sends the certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys. | -| E | The registration authority validates the public key in the certificate request matches a registered key for the user.
If the public key in the certificate is not found in the list of registered public keys, certificate enrollment is deferred until Phase F completes. The application is informed of the deferment and exits to the user's desktop. The automatic certificate enrollment client triggers the Azure AD Web Account Manager plug-in to retry the certificate enrollment at 24, 85, 145, 205, 265, and 480 minutes after phase C successfully completes. The user must remain signed in for automatic certificate enrollment to trigger certificate enrollment. If the user signs out, automatic certificate enrollment is triggered approximately 30 minutes after the user's next sign in.
After validating the public key, the registration authority signs the certificate request using its enrollment agent certificate. | -| G | The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application. | -| H | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning. | -| F | Azure AD Connect requests updates on its next synchronization cycle. Azure Active Directory sends the user's public key that was securely registered through provisioning. AAD Connect receives the public key and writes it to user's msDS-KeyCredentialLink attribute in Active Directory. | - -> [!IMPORTANT] -> The newly provisioned user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory. - - -[Return to top](#windows-hello-for-business-provisioning) -## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment](images/howitworks/prov-haadj-instant-certtrust-managed.png) - - -| Phase | Description | -|:-----:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services provides the second factor of authentication. If the user has performed Azure MFA within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they are not prompted for MFA because the current MFA remains valid.
Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | -| B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv). | -| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID and a key receipt to the application, which represents the end of user key registration. | -| D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
The application sends the key receipt and certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys. | -| E | The registration authority validates the public key in the certificate request matches a registered key for the user.
If the public key in the certificate is not found in the list of registered public keys, it then validates the key receipt to confirm the key was securely registered with Azure.
After validating the key receipt or public key, the registration authority signs the certificate request using its enrollment agent certificate. | -| F | The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application. | -| G | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning. | - -> [!IMPORTANT] -> Synchronous certificate enrollment does not depend on Azure AD Connect to synchronize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not shown in this flow. - - [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment ![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](images/howitworks/prov-haadj-instant-certtrust-federated.png) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md index ef7fb31fff..723a2e1e54 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index fe8e1659ff..26b5607798 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 2b3da46104..cec799fa3d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 24f1ffb00b..847bbfdf0e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 4baae2e5a4..2fc0996eb0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -90,16 +90,16 @@ The deployment uses the **NDES Servers** security group to assign the NDES servi Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. -1. Open **Active Directory Users and Computers**. -2. Expand the domain node from the navigation pane. -3. Right-click the **Users** container. Hover over **New** and click **Group**. -4. Type **NDES Servers** in the **Group Name** text box. -5. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Expand the domain node from the navigation pane. +3. Right-click the **Users** container. Hover over **New** and click **Group**. +4. Type **NDES Servers** in the **Group Name** text box. +5. Click **OK**. ### Add the NDES server to the NDES Servers global security group Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. -1. Open **Active Directory Users and Computers**. +1. Open **Active Directory Users and Computers**. 2. Expand the domain node from the navigation pane. 3. Click **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Click **Add to a group...**. 4. Type **NDES Servers** in **Enter the object names to select**. Click **OK**. Click **OK** on the **Active Directory Domain Services** success dialog. @@ -189,9 +189,9 @@ NDES uses a server authentication certificate to authenticate the server endpoin Sign-in to the issuing certificate authority or management workstations with _Domain Admin_ equivalent credentials. 1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and click **Duplicate Template**. -4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and click **Duplicate Template**. +4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the lab. 5. On the **Subject** tab, select **Supply in the request**. 6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**. @@ -214,10 +214,10 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Subject** tab, select **Supply in the request**. -9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. -10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. -12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. Close the console. +9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. +10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. +12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. Close the console. ### Publish certificate templates The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. @@ -227,12 +227,12 @@ The certificate authority may only issue certificates for certificate templates Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. Close the console. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. Close the console. ## Install and Configure the NDES Role This section includes the following topics: diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index aec91cdd20..c0d84c47c0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 0a8ef8fa68..c2550cdfa7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -66,12 +66,12 @@ Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 o 1. Open an elevated Windows PowerShell prompt. 2. Use the following command to install the Active Directory Certificate Services role. ```PowerShell - Add-WindowsFeature Adcs-Cert-Authority -IncludeManageTools + Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools ``` 3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration. ```PowerShell - Install-AdcsCertificateAuthority + Install-AdcsCertificationAuthority ``` ### Configure a Production Public Key Infrastructure diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 8a74c77ed5..1df71e5f3d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -126,7 +126,7 @@ If your AD FS farm is not already configured for Device Authentication (you can 2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: `Import-module activedirectory` - `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "" ` + `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName ""` 3. On the pop-up window click **Yes**. > [!NOTE] @@ -150,7 +150,7 @@ The above PSH creates the following objects: If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS 1. Open Windows PowerShell and execute the following: - `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" ` + `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1"` > [!NOTE] > If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep @@ -165,7 +165,7 @@ If you plan to use Windows 10 domain join (with automatic registration to Azure 3. Run the following PowerShell command - `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred ` + `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred` Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory. @@ -176,7 +176,7 @@ To ensure AD DS objects and containers are in the correct state for write back o 1. Open Windows PowerShell and execute the following: - `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name] ` + `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name]` Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index 36316a2a44..71517e7da8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -112,6 +112,9 @@ Organizations wanting to deploy hybrid certificate trust need their domain joine Hybrid certificate trust deployments need the device write back feature. Authentication to the Windows Server 2016 Active Directory Federation Services needs both the user and the computer to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the computer and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature. +> [!NOTE] +> Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory, and therefore the device writeback is used to update the msDS-KeyCredentialLink on the computer object. + ### Section Checklist ### > [!div class="checklist"] > * Azure Active Directory Device writeback diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index f372681839..ea04aadb72 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index eaf63601ae..8b3b535bc4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index e47893d235..a6df7720f8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -39,12 +39,12 @@ Azure Active Directory Connect synchronizes the public key on the user object cr Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advance Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **KeyCredential Admins** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advance Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **KeyCredential Admins** in the **Group Name** text box. +6. Click **OK**. #### Create the Windows Hello for Business Users Security Group @@ -52,12 +52,12 @@ The Windows Hello for Business Users group is used to make it easy to deploy Win Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ### Section Review diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index c4d3011a16..388da08d52 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -35,8 +35,8 @@ The Windows Hello for Business Authentication certificate template is configured Sign-in the AD FS server with *Domain Admin* equivalent credentials. -1. Open a **Windows PowerShell** prompt. -2. Type the following command +1. Open a **Windows PowerShell** prompt. +2. Type the following command ```PowerShell Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication -WindowsHelloCertificateProxyEnabled $true @@ -58,8 +58,8 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 3. Right-click **Windows Hello for Business Users** group 4. Click the **Members** tab and click **Add** 5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. -6. Click **OK** to return to **Active Directory Users and Computers**. -7. Restart the AD FS server. +6. Click **OK** to return to **Active Directory Users and Computers**. +7. Restart the AD FS server. ### Section Review > [!div class="checklist"] diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index cc29823ac9..2e7fe96f8c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 3a8ba5db87..1629f3eb9a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -45,15 +45,15 @@ By default, the Active Directory Certificate Authority provides and publishes th Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template @@ -65,15 +65,15 @@ The auto-enrollment feature in Windows enables you to effortlessly replace these Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -104,9 +104,9 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. 9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. -10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. -11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -12. Close the console. +10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. +11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +12. Close the console. #### Creating an Enrollment Agent certificate for typical Service Acconts @@ -121,7 +121,7 @@ Sign-in a certificate authority or management workstations with *Domain Admin* e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. 9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Close the console. +10. Close the console. ### Creating Windows Hello for Business authentication certificate template @@ -138,13 +138,13 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Issuance Requirements** tab, select the **This number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. -10. On the **Request Handling** tab, select the **Renew with same key** check box. -11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. -12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. -14. Click on the **Apply** to save changes and close the console. +10. On the **Request Handling** tab, select the **Renew with same key** check box. +11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. +14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template @@ -164,12 +164,12 @@ The certificate authority may only issue certificates for certificate templates #### Publish Certificate Templates to the Certificate Authority Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. Close the console. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. Close the console. #### Unpublish Superseded Certificate Templates @@ -180,11 +180,11 @@ The newly created domain controller authentication certificate template supersed Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Section Review diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index bb1beb3d0b..05a4294ad7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -48,26 +48,26 @@ To continue automatic enrollment and renewal of domain controller certificates t Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. #### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Windows Hello for Business Group Policy @@ -118,7 +118,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 7. Select **Enabled** from the **Configuration Model** list. 8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. 9. Select the **Update certificates that use certificate templates** check box. -10. Click **OK**. Close the **Group Policy Management Editor**. +10. Click **OK**. Close the **Group Policy Management Editor**. #### Configure Security in the Windows Hello for Business Group Policy object diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 7d1b384963..eb54aba4fd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index c8c3fee1a5..653af360e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index f2c6123b17..aa99101b75 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 874528d09a..abb29a0a18 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index d1342ab11f..e0c85f3020 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -98,11 +98,9 @@ Organizations using older directory synchronization technology, such as DirSync
-## Federation with Azure -You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/hybrid/whatis-phs) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2. - -### Section Review +## Federation with Azure ## +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) or [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. > [!div class="checklist"] > * Non-federated environments diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 66a1dfd080..cdc50b7691 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 07a435da9d..99e9682540 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 4ecd43dee9..3d7c456790 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -37,12 +37,12 @@ The Windows Hello for Business Users group is used to make it easy to deploy Win Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ### Section Review diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index e1e56d33f9..149f51780f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index bda944c54a..9e2635b984 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -45,15 +45,15 @@ By default, the Active Directory Certificate Authority provides and publishes th Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template @@ -65,15 +65,15 @@ The autoenrollment feature in Windows enables you to effortlessly replace these Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -103,11 +103,11 @@ The newly created domain controller authentication certificate template supersed Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Section Review > [!div class="checklist"] diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 161f924588..c38ab35a87 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -46,26 +46,26 @@ To continue automatic enrollment and renewal of domain controller certificates t Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. #### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. >[!IMPORTANT] >If you don't find options in GPO, you have to load the [PolicyDefinitions folder](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index db581c1ffb..48f2e98a5d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index ba1e004510..f00875d1a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 0c493ddc5d..161c10f243 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -41,8 +41,8 @@ Prepare the Active Directory Federation Services deployment by installing and up ## Update Windows Server 2016 Sign-in the federation server with _local admin_ equivalent credentials. -1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. -2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). +1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. +2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). >[!IMPORTANT] >The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers. @@ -91,15 +91,15 @@ The Active Directory Federation Service (AD FS) role provides the following serv Windows Hello for Business depends on proper device registration. For on-premises key trust deployments, Windows Server 2016 AD FS handles device and key registration. Sign-in the federation server with _Enterprise Admin_ equivalent credentials. -1. Start **Server Manager**. Click **Local Server** in the navigation pane. -2. Click **Manage** and then click **Add Roles and Features**. -3. Click **Next** on the **Before you begin** page. -4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. -5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. -6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. -7. Click **Next** on the **Select features** page. -8. Click **Next** on the **Active Directory Federation Service** page. -9. Click **Install** to start the role installation. +1. Start **Server Manager**. Click **Local Server** in the navigation pane. +2. Click **Manage** and then click **Add Roles and Features**. +3. Click **Next** on the **Before you begin** page. +4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. +5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. +6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. +7. Click **Next** on the **Select features** page. +8. Click **Next** on the **Active Directory Federation Service** page. +9. Click **Install** to start the role installation. ## Review @@ -137,11 +137,11 @@ Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key #### Create an AD FS Service Account Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Right-click the **Users** container, Click **New**. Click **User**. -3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. -4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. -5. Click **Next** and then click **Finish**. +1. Open **Active Directory Users and Computers**. +2. Right-click the **Users** container, Click **New**. Click **User**. +3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. +4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. +5. Click **Next** and then click **Finish**. ## Configure the Active Directory Federation Service Role @@ -165,8 +165,8 @@ Sign-in the federation server with _Domain Admin_ equivalent credentials. These 8. On the **Specify Service Account** page, select **Create a Group Managed Service Account**. In the **Account Name** box, type **adfssvc**. 9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. 10. On the **Review Options** page, click **Next**. -11. On the **Pre-requisite Checks** page, click **Configure**. -12. When the process completes, click **Close**. +11. On the **Pre-requisite Checks** page, click **Configure**. +12. When the process completes, click **Close**. ### Windows Server 2008 or 2008 R2 Domain Controllers @@ -184,11 +184,11 @@ Sign-in the federation server with _Domain Admin_ equivalent credentials. These 7. Type the Federation Service Display Name in the text box. This is the name users see when signing in. Click **Next**. 8. On the **Specify Service Account** page, Select **Use an existing domain user account or group Managed Service Account** and click **Select**. * In the **Select User or Service Account** dialog box, type the name of the previously created AD FS service account (example adfssvc) and click **OK**. Type the password for the AD FS service account and click **Next**. -9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. -10. On the **Review Options** page, click **Next**. -11. On the **Pre-requisite Checks** page, click **Configure**. -12. When the process completes, click **Close**. -13. Do not restart the AD FS server. You will do this later. +9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. +10. On the **Review Options** page, click **Next**. +11. On the **Pre-requisite Checks** page, click **Configure**. +12. When the process completes, click **Close**. +13. Do not restart the AD FS server. You will do this later. ### Add the AD FS Service account to the KeyAdmins group @@ -319,9 +319,9 @@ Sign-in the domain controller or administrative workstation with _Domain Admin_ ### Deploy the Intranet Zone Group Policy object -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. ## Review diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md index eb46ba61fe..b2c377057f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -46,15 +46,15 @@ The primary MFA server is also responsible for synchronizing from Active Directo The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. +1. Start the Local Computer **Certificate Manager** (certlm.msc). +2. Expand the **Personal** node in the navigation pane. +3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. +4. Click **Next** on the **Before You Begin** page. +5. Click **Next** on the **Select Certificate Enrollment Policy** page. +6. On the **Request Certificates** page, Select the **Internal Web Server** check box. +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. +9. Click **Enroll**. A server authentication certificate should appear in the computer’s Personal certificate store. @@ -86,12 +86,12 @@ Update the server using Windows Update until the server has no required or optio The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. +1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console +2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. +3. In the **Actions** pane, click **Bindings**. +4. In the **Site Bindings** dialog, Click **Add**. +5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. +6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. #### Configure the Web Service’s Security @@ -150,17 +150,17 @@ Internal and external users use the User Portal to manage their multifactor auth For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. +1. Start the Local Computer **Certificate Manager** (certlm.msc). +2. Expand the **Personal** node in the navigation pane. +3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. +4. Click **Next** on the **Before You Begin** page. +5. Click **Next** on the **Select Certificate Enrollment Policy** page. +6. On the **Request Certificates** page, Select the **Internal Web Server** check box. +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). +9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). +10. Click **Add**. Click **OK** when finished. +11. Click **Enroll**. A server authentication certificate should appear in the computer’s Personal certificate store. @@ -247,9 +247,9 @@ Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. 8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. 9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. 10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. +11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. +12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. +13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. ![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) @@ -334,9 +334,9 @@ Sign in the primary MFA server with _MFA administrator_ equivalent credentials. 7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. 8. Select **Add new users and Update existing users**. 9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. +10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. +11. Select **Enabled** and select **Only New Users with Phone Number** from the list. +12. Select **Send email** and select **New and Updated Users**. ##### Configure synchronization item defaults @@ -367,12 +367,12 @@ Additional MFA servers provided redundancy of the MFA configuration. The MFA ser Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. +1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. +2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. +3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. +4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. +5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. ### Review @@ -421,12 +421,12 @@ Sign in the User Portal server with _local administrator_ equivalent credentials ### Create a DNS entry for the User Portal web site Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. +1. Open the **DNS Management** console. +2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. +3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. +4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. +5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. +6. Close the **DNS Management** console. ### Review @@ -533,10 +533,10 @@ Before you continue with the deployment, validate your deployment progress by re Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. +1. In the **Multi-Factor Authentication** server, on the left, click **Users**. +2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. +3. Click **Test**. +4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 810cd02d3e..73e64d3e70 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index e2a3e69554..0a0ef7ef5b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -35,12 +35,12 @@ The Windows Hello for Business Users group is used to make it easy to deploy Win Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ## Follow the Windows Hello for Business on premises certificate trust deployment guide diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 732aada2b0..19a03daf36 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 00329dad82..8845f97509 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -63,15 +63,15 @@ Domain controllers automatically request a domain controller certificate (if pub By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. **Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. ### Superseding the existing Domain Controller certificate @@ -80,15 +80,15 @@ Many domain controllers may have an existing domain controller certificate. The The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -97,17 +97,17 @@ The certificate template is configured to supersede all the certificate template Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Request Handling** tab, select **Allow private key to be exported**. -7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. -8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. -9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -10. Close the console. +6. On the **Request Handling** tab, select **Allow private key to be exported**. +7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. +8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. +9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +10. Close the console. ### Unpublish Superseded Certificate Templates @@ -116,50 +116,50 @@ The certificate authority only issues certificates based on published certificat The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Publish Certificate Templates to the Certificate Authority The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. * To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. -7. Close the console. +7. Close the console. ### Configure Domain Controllers for Automatic Certificate Enrollment Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. ### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Validating your work diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index e9c7937ed9..6534a2b0bb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 295be4d248..07989c7579 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: conceptual @@ -50,6 +50,12 @@ As an administrator in an enterprise or educational organization, you can create Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. +## From Windows 10 version 1803, the Windows Hello feature can be used as a safe and secure sign-in method. +Fingerprint scan can be enabled on laptop computers using a built-in fingerprint reader or an external USB fingerprint reader, as follows: +1. Go to **Settings** > **Accounts** > **Sign-in-options** > **Windows Hello Fingerprint** > **Add fingerprint** +2. Users will need to add a PIN after adding their fingerprint(s) to the reader configuration. +3. Windows Biometric data is located in the `C:\Windows\System32\WinBioDatabase\` folder (fingerprint data is stored with the .DAT file name extension). +4. If you are unable to sign in with previously registered fingerprints, delete the entire content of this folder and register your fingerprints again. ## The difference between Windows Hello and Windows Hello for Business diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index c61e51d04e..68ee7e67cf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 1cf24cc40f..3ff85f511f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 7dfea19a30..d9ecb9798b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 49bac59449..375f2be134 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md index d827e5a5e9..3878a9b907 100644 --- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md +++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 284982d26b..062ad20bc7 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/reset-security-key.md b/windows/security/identity-protection/hello-for-business/reset-security-key.md index 0cfc09e68c..d2a4db9205 100644 --- a/windows/security/identity-protection/hello-for-business/reset-security-key.md +++ b/windows/security/identity-protection/hello-for-business/reset-security-key.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: dulcemontemayor -ms.author: dolmont +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 3eb38638f5..f3d95ae6ee 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -5,9 +5,9 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: mapalko ms.localizationpriority: high -ms.author: dolmont +ms.author: mapalko ms.date: 10/16/2017 ms.reviewer: manager: dansimp @@ -79,14 +79,14 @@ These keys are used to sign requests that are sent to the IDP, requesting access For example, the authentication process for Azure Active Directory works like this: -1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) -2. The IDP returns a challenge, known as a nonce. -3. The device signs the nonce with the appropriate private key. -4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. -5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. -6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. -7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. -8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. +1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) +2. The IDP returns a challenge, known as a nonce. +3. The device signs the nonce with the appropriate private key. +4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. +5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. +6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. +7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. +8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 2af7ccc7a9..2a85725c2c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -113,9 +113,9 @@ You can use the System Information desktop app (MSINFO32) to check if a device h If kernel DMA protection *not* enabled, follow these steps to protect Thunderbolt™ 3 enabled ports: -1. Require a password for BIOS changes -2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings. Please refer to [Intel Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating System documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) -3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607): +1. Require a password for BIOS changes +2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings. Please refer to [Intel Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating System documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) +3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607): - MDM: [DataProtection/AllowDirectMemoryAccess](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dataprotection#dataprotection-allowdirectmemoryaccess) policy - Group Policy: [Disable new DMA devices when this computer is locked](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#disable-new-dma-devices-when-this-computer-is-locked) (This setting is not configured by default.) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 8dd40cf580..6545ca0992 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -97,7 +97,7 @@ The BitLocker Network Unlock feature will install the WDS role if it is not alre To install the role using Windows PowerShell, use the following command: -``` syntax +```powershell Install-WindowsFeature WDS-Deployment ``` @@ -109,7 +109,7 @@ To confirm the WDS service is running, use the Services Management Console or Wi To confirm the service is running using Windows PowerShell, use the following command: -``` syntax +```powershell Get-Service WDSServer ``` ### Install the Network Unlock feature @@ -118,7 +118,7 @@ To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Windows PowerShell, use the following command: -``` syntax +```powershell Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Create the certificate template for Network Unlock @@ -184,7 +184,7 @@ To create a self-signed certificate, you can either use the New-SelfSignedCertif Windows PowerShell example: -```syntax +```powershell New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "CN=BitLocker Network Unlock certificate" -Provider "Microsoft Software Key Storage Provider" -KeyUsage KeyEncipherment -KeyUsageProperty Decrypt,Sign -KeyLength 2048 -HashAlgorithm sha512 -TextExtension @("1.3.6.1.4.1.311.21.10={text}OID=1.3.6.1.4.1.311.67.1.1","2.5.29.37={text}1.3.6.1.4.1.311.67.1.1") ``` @@ -193,7 +193,7 @@ Certreq example: 1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf. 2. Add the following contents to the previously created file: - ``` syntax + ```ini [NewRequest] Subject="CN=BitLocker Network Unlock certificate" ProviderType=0 @@ -267,24 +267,27 @@ The configuration file, called bde-network-unlock.ini, must be located in the sa The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names. - [SUBNETS] - SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon - SUBNET2=10.185.252.200/28 - SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet - SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. - ``` - Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. +```ini +[SUBNETS] +SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon +SUBNET2=10.185.252.200/28 +SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet +SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. +``` +Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. - >**Note:**  When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. - - Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. - Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. - [‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] - ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. - ;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. - SUBNET1 - ;SUBNET2 - SUBNET3 +>**Note:**  When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. + +Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. +Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. +```ini +[‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] +;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. +;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. +SUBNET1 +;SUBNET2 +SUBNET3 +``` To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md index dd0439236b..a6622c810c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md @@ -51,6 +51,11 @@ Two partitions are required to run BitLocker because pre-startup authentication BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device. +> [!NOTE] +> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + +> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. + ## How can I tell if a TPM is on my computer? Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 138a9d5422..d15b81c76a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -60,6 +60,11 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!NOTE] +> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + +> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. + The hard disk must be partitioned with at least two drives: - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index b058f905a9..a1a64bebe4 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -72,7 +72,7 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. -> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/en-us/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. +> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. ## Discrete, Integrated or Firmware TPM? diff --git a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md index dff04d8807..f38a7aa7c0 100644 --- a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md +++ b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md @@ -160,9 +160,9 @@ Use Windows Event Forwarding to collect and aggregate your WIP audit events. You >Windows 10 Mobile requires you to use the [Reporting CSP process](#collect-wip-audit-logs-by-using-the-reporting-configuration-service-provider-csp) instead. **To view the WIP events in the Event Viewer** -1. Open Event Viewer. +1. Open Event Viewer. -2. In the console tree under **Application and Services Logs\Microsoft\Windows**, click **EDP-Audit-Regular** and **EDP-Audit-TCB**. +2. In the console tree under **Application and Services Logs\Microsoft\Windows**, click **EDP-Audit-Regular** and **EDP-Audit-TCB**. ## Collect WIP audit logs using Azure Monitor You can collect audit logs using Azure Monitor. See [Windows event log data sources in Azure Monitor.](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 7bde4e34bf..704773750d 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -32,15 +32,15 @@ The recovery process included in this topic only works for desktop devices. WIP ## Manually create an EFS DRA certificate -1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. +1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. -2. Run this command: +2. Run this command: cipher /r:EFSRA Where *EFSRA* is the name of the .cer and .pfx files that you want to create. -3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. +3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. @@ -61,15 +61,15 @@ The recovery process included in this topic only works for desktop devices. WIP Where *filename* is the name of the file you created in Step 1. -4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. +4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. ## Recover your data using the EFS DRA certificate in a test environment -1. Copy your WIP-encrypted file to a location where you have admin access. +1. Copy your WIP-encrypted file to a location where you have admin access. -2. Install the EFSDRA.pfx file, using its password. +2. Install the EFSDRA.pfx file, using its password. -3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: +3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: cipher /d encryptedfile.extension @@ -127,15 +127,15 @@ The employee experience is based on sign in with an Azure AD work account. The e After signing in, the necessary WIP key info is automatically downloaded and employees are able to access the files again. **To test what the employee sees during the WIP key recovery process** -1. Attempt to open a work file on an unenrolled device. +1. Attempt to open a work file on an unenrolled device. The **Connect to Work to access work files** box appears. -2. Click **Connect**. +2. Click **Connect**. The **Access work or school settings** page appears. -3. Sign-in to Azure AD as the employee and verify that the files now open +3. Sign-in to Azure AD as the employee and verify that the files now open ## Related topics - [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 47cc545f94..85c7bfae87 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -103,11 +103,11 @@ To add multiple Store apps, click the ellipsis **…**. If you don't know the Store app publisher or product name, you can find them by following these steps. -1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Power BI Mobile App*. +1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Power BI Mobile App*. -2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`. +2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`. -3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value. +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value. The API runs and opens a text editor with the app details. @@ -131,19 +131,19 @@ If you need to add Windows 10 mobile apps that aren't distributed through the St >**Note**
Your PC and phone must be on the same wireless network. -1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. +1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. -2. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. +2. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. -3. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. +3. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. -4. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. +4. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. -6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. -7. Start the app for which you're looking for the publisher and product name values. +7. Start the app for which you're looking for the publisher and product name values. -8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. >[!Important] >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
@@ -225,13 +225,13 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com #### Create a Packaged App rule for Store apps -1. Open the Local Security Policy snap-in (SecPol.msc). +1. Open the Local Security Policy snap-in (SecPol.msc). -2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. +2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. ![Local security snap-in, showing the Packaged app Rules](images/wip-applocker-secpol-1.png) -3. Right-click in the right-hand blade, and then click **Create New Rule**. +3. Right-click in the right-hand blade, and then click **Create New Rule**. The **Create Packaged app Rules** wizard appears. @@ -243,7 +243,7 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ![Create Packaged app Rules wizard, showing the Before You Begin page](images/wip-applocker-secpol-wizard-2.png) -6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. ![Create Packaged app Rules wizard, showing the Publisher](images/wip-applocker-secpol-wizard-3.png) @@ -263,13 +263,13 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ![Local security snap-in, showing the new rule](images/wip-applocker-secpol-create.png) -10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. +10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. ![Local security snap-in, showing the Export Policy option](images/wip-applocker-secpol-export.png) -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. The policy is saved and you’ll see a message that says 1 rule was exported from the policy. @@ -295,7 +295,7 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ``` -12. After you’ve created your XML file, you need to import it by using Microsoft Intune. +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. ## Create an Executable rule for unsigned apps @@ -323,17 +323,17 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com 9. On the **Name** page, type a name and description for the rule and then click **Create**. -10. In the left pane, right-click **AppLocker** > **Export policy**. +10. In the left pane, right-click **AppLocker** > **Export policy**. -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. The policy is saved and you’ll see a message that says 1 rule was exported from the policy. -12. After you’ve created your XML file, you need to import it by using Microsoft Intune. +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. **To import a list of protected apps using Microsoft Intune** -1. In **Protected apps**, click **Import apps**. +1. In **Protected apps**, click **Import apps**. ![Import protected apps](images/import-protected-apps.png) @@ -341,22 +341,22 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/wip-azure-import-apps.png) -2. Browse to your exported AppLocker policy file, and then click **Open**. +2. Browse to your exported AppLocker policy file, and then click **Open**. The file imports and the apps are added to your **Protected apps** list. ### Exempt apps from a WIP policy If your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. -1. In **Client apps - App protection policies**, click **Exempt apps**. +1. In **Client apps - App protection policies**, click **Exempt apps**. ![Exempt apps](images/exempt-apps.png) -2. In **Exempt apps**, click **Add apps**. +2. In **Exempt apps**, click **Add apps**. Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. -3. Fill out the rest of the app info, based on the type of app you’re adding: +3. Fill out the rest of the app info, based on the type of app you’re adding: - [Add Recommended apps](#add-recommended-apps) @@ -373,7 +373,7 @@ After you've added the apps you want to protect with WIP, you'll need to apply a We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, **Block**. -1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. +1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. ![Microsoft Intune, Required settings blade showing Windows Information Protection mode](images/wip-azure-required-settings-protection-mode.png) @@ -384,7 +384,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| -2. Click **Save**. +2. Click **Save**. ## Define your enterprise-managed corporate identity Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. @@ -554,7 +554,7 @@ After you create and deploy your WIP policy to your employees, Windows begins to >Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate) topic. **To upload your DRA certificate** -1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. +1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. The **Advanced settings** blade appears. diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md index 02e58a7acf..e880c6b05b 100644 --- a/windows/security/threat-protection/auditing/audit-application-generated.md +++ b/windows/security/threat-protection/auditing/audit-application-generated.md @@ -20,24 +20,22 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Application Generated generates events for actions related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx). Audit Application Generated subcategory is out of scope of this document, because [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) is very rarely in use and it is deprecated starting from Windows Server 2012. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF – if you use [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) in your environment and you need to monitor events related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx), enable this subcategory. | | Member Server | IF | IF | IF | IF | IF – if you use [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) in your environment and you need to monitor events related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx), enable this subcategory. | | Workstation | IF | IF | IF | IF | IF – if you use [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) in your environment and you need to monitor events related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx), enable this subcategory. | **Events List:** -## 4665: An attempt was made to create an application client context. +- 4665: An attempt was made to create an application client context. -## 4666: An application attempted an operation. +- 4666: An application attempted an operation. -## 4667: An application client context was deleted. - -## 4668: An application was initialized. +- 4667: An application client context was deleted. +- 4668: An application was initialized. diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md index 07fe9cb88d..870ef553dd 100644 --- a/windows/security/threat-protection/auditing/audit-application-group-management.md +++ b/windows/security/threat-protection/auditing/audit-application-group-management.md @@ -20,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Application Group Management generates events for actions related to [application groups](https://technet.microsoft.com/library/cc771579.aspx), such as group creation, modification, addition or removal of group member and some other actions. [Application groups](https://technet.microsoft.com/library/cc771579.aspx) are used by [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx). @@ -33,23 +32,22 @@ Audit Application Group Management subcategory is out of scope of this document, | Member Server | - | - | - | - | This subcategory is outside the scope of this document. | | Workstation | - | - | - | - | This subcategory is outside the scope of this document. | -## 4783(S): A basic application group was created. +- 4783(S): A basic application group was created. -## 4784(S): A basic application group was changed. +- 4784(S): A basic application group was changed. -## 4785(S): A member was added to a basic application group. +- 4785(S): A member was added to a basic application group. -## 4786(S): A member was removed from a basic application group. +- 4786(S): A member was removed from a basic application group. -## 4787(S): A non-member was added to a basic application group. +- 4787(S): A non-member was added to a basic application group. -## 4788(S): A non-member was removed from a basic application group. +- 4788(S): A non-member was removed from a basic application group. -## 4789(S): A basic application group was deleted. +- 4789(S): A basic application group was deleted. -## 4790(S): An LDAP query group was created. +- 4790(S): An LDAP query group was created. -## 4791(S): An LDAP query group was changed. - -## 4792(S): An LDAP query group was deleted. +- 4791(S): An LDAP query group was changed. +- 4792(S): An LDAP query group was deleted. diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md index 2b7957cb67..1dd10ad26a 100644 --- a/windows/security/threat-protection/auditing/audit-certification-services.md +++ b/windows/security/threat-protection/auditing/audit-certification-services.md @@ -20,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Certification Services determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. Examples of AD CS operations include: @@ -59,65 +58,64 @@ Role-specific subcategories are outside the scope of this document. | Member Server | IF | IF | IF | IF | IF – if a server has the [Active Directory Certificate Services](https://technet.microsoft.com/windowsserver/dd448615.aspx) (AD CS) role installed and you need to monitor AD CS related events, enable this subcategory. | | Workstation | No | No | No | No | [Active Directory Certificate Services](https://technet.microsoft.com/windowsserver/dd448615.aspx) (AD CS) role cannot be installed on client OS. | -## 4868: The certificate manager denied a pending certificate request. +- 4868: The certificate manager denied a pending certificate request. -## 4869: Certificate Services received a resubmitted certificate request. +- 4869: Certificate Services received a resubmitted certificate request. -## 4870: Certificate Services revoked a certificate. +- 4870: Certificate Services revoked a certificate. -## 4871: Certificate Services received a request to publish the certificate revocation list (CRL). +- 4871: Certificate Services received a request to publish the certificate revocation list (CRL). -## 4872: Certificate Services published the certificate revocation list (CRL). +- 4872: Certificate Services published the certificate revocation list (CRL). -## 4873: A certificate request extension changed. +- 4873: A certificate request extension changed. -## 4874: One or more certificate request attributes changed. +- 4874: One or more certificate request attributes changed. -## 4875: Certificate Services received a request to shut down. +- 4875: Certificate Services received a request to shut down. -## 4876: Certificate Services backup started. +- 4876: Certificate Services backup started. -## 4877: Certificate Services backup completed. +- 4877: Certificate Services backup completed. -## 4878: Certificate Services restore started. +- 4878: Certificate Services restore started. -## 4879: Certificate Services restore completed. +- 4879: Certificate Services restore completed. -## 4880: Certificate Services started. +- 4880: Certificate Services started. -## 4881: Certificate Services stopped. +- 4881: Certificate Services stopped. -## 4882: The security permissions for Certificate Services changed. +- 4882: The security permissions for Certificate Services changed. -## 4883: Certificate Services retrieved an archived key. +- 4883: Certificate Services retrieved an archived key. -## 4884: Certificate Services imported a certificate into its database. +- 4884: Certificate Services imported a certificate into its database. -## 4885: The audit filter for Certificate Services changed. +- 4885: The audit filter for Certificate Services changed. -## 4886: Certificate Services received a certificate request. +- 4886: Certificate Services received a certificate request. -## 4887: Certificate Services approved a certificate request and issued a certificate. +- 4887: Certificate Services approved a certificate request and issued a certificate. -## 4888: Certificate Services denied a certificate request. +- 4888: Certificate Services denied a certificate request. -## 4889: Certificate Services set the status of a certificate request to pending. +- 4889: Certificate Services set the status of a certificate request to pending. -## 4890: The certificate manager settings for Certificate Services changed. +- 4890: The certificate manager settings for Certificate Services changed. -## 4891: A configuration entry changed in Certificate Services. +- 4891: A configuration entry changed in Certificate Services. -## 4892: A property of Certificate Services changed. +- 4892: A property of Certificate Services changed. -## 4893: Certificate Services archived a key. +- 4893: Certificate Services archived a key. -## 4894: Certificate Services imported and archived a key. +- 4894: Certificate Services imported and archived a key. -## 4895: Certificate Services published the CA certificate to Active Directory Domain Services. +- 4895: Certificate Services published the CA certificate to Active Directory Domain Services. -## 4896: One or more rows have been deleted from the certificate database. +- 4896: One or more rows have been deleted from the certificate database. -## 4897: Role separation enabled. - -## 4898: Certificate Services loaded a template. +- 4897: Role separation enabled. +- 4898: Certificate Services loaded a template. diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md index 6dea144077..83d36fa376 100644 --- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md +++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md @@ -20,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Distribution Group Management determines whether the operating system generates audit events for specific distribution-group management tasks. This subcategory generates events only on domain controllers. @@ -29,47 +28,46 @@ This subcategory generates events only on domain controllers. This subcategory allows you to audit events generated by changes to distribution groups such as the following: -- Distribution group is created, changed, or deleted. +- Distribution group is created, changed, or deleted. -- Member is added or removed from a distribution group. +- Member is added or removed from a distribution group. If you need to monitor for group type changes, you need to monitor for “[4764](event-4764.md): A group’s type was changed.” “Audit Security Group Management” subcategory success auditing must be enabled. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | No | IF | No | IF - Typically actions related to distribution groups have low security relevance, much more important to monitor Security Group changes. But if you want to monitor for critical distribution groups changes, such as member was added to internal critical distribution group (executives, administrative group, for example), you need to enable this subcategory for Success auditing.
Typically volume of these events is low on domain controllers.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | No | No | No | No | This subcategory generates events only on domain controllers. | -| Workstation | No | No | No | No | This subcategory generates events only on domain controllers. | +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| +| Domain Controller | IF | No | IF | No | IF - Typically, actions related to distribution groups have low security relevance. It is much more important to monitor Security Group changes. However, if you want to monitor for critical distribution groups changes, such as if a member was added to internal critical distribution group (executives, administrative group, for example), you need to enable this subcategory for Success auditing.
Typically, volume of these events is low on domain controllers.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | No | No | No | No | This subcategory generates events only on domain controllers. | +| Workstation | No | No | No | No | This subcategory generates events only on domain controllers. | **Events List:** -- [4749](event-4749.md)(S): A security-disabled global group was created. +- [4749](event-4749.md)(S): A security-disabled global group was created. -- [4750](event-4750.md)(S): A security-disabled global group was changed. +- [4750](event-4750.md)(S): A security-disabled global group was changed. -- [4751](event-4751.md)(S): A member was added to a security-disabled global group. +- [4751](event-4751.md)(S): A member was added to a security-disabled global group. -- [4752](event-4752.md)(S): A member was removed from a security-disabled global group. +- [4752](event-4752.md)(S): A member was removed from a security-disabled global group. -- [4753](event-4753.md)(S): A security-disabled global group was deleted. +- [4753](event-4753.md)(S): A security-disabled global group was deleted. -**4759(S): A security-disabled universal group was created.** See event “[4749](event-4749.md): A security-disabled global group was created.” Event 4759 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4759(S): A security-disabled universal group was created. See event _[4749](event-4749.md): A security-disabled global group was created._ Event 4759 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4760(S): A security-disabled universal group was changed.** See event “[4750](event-4750.md): A security-disabled global group was changed.” Event 4760 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4760(S): A security-disabled universal group was changed. See event _[4750](event-4750.md): A security-disabled global group was changed._ Event 4760 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4761(S): A member was added to a security-disabled universal group.** See event “[4751](event-4751.md): A member was added to a security-disabled global group.” Event 4761 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4761(S): A member was added to a security-disabled universal group. See event _[4751](event-4751.md): A member was added to a security-disabled global group._ Event 4761 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4762(S): A member was removed from a security-disabled universal group.** See event “[4752](event-4752.md): A member was removed from a security-disabled global group.” Event 4762 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4762(S): A member was removed from a security-disabled universal group. See event _[4752](event-4752.md): A member was removed from a security-disabled global group._ Event 4762 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4763(S): A security-disabled universal group was deleted.** See event “[4753](event-4753.md): A security-disabled global group was deleted.” Event 4763 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4763(S): A security-disabled universal group was deleted. See event _[4753](event-4753.md): A security-disabled global group was deleted._ Event 4763 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4744(S): A security-disabled local group was created.** See event “[4749](event-4749.md): A security-disabled global group was created.” Event 4744 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4744(S): A security-disabled local group was created. See event _[4749](event-4749.md): A security-disabled global group was created._ Event 4744 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4745(S): A security-disabled local group was changed.** See event “[4750](event-4750.md): A security-disabled global group was changed.” Event 4745 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4745(S): A security-disabled local group was changed. See event _[4750](event-4750.md): A security-disabled global group was changed._ Event 4745 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4746(S): A member was added to a security-disabled local group.** See event “[4751](event-4751.md): A member was added to a security-disabled global group.” Event 4746 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4746(S): A member was added to a security-disabled local group. See event _[4751](event-4751.md): A member was added to a security-disabled global group._ Event 4746 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4747(S): A member was removed from a security-disabled local group.** See event “[4752](event-4752.md): A member was removed from a security-disabled global group.” Event 4747 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. - -**4748(S): A security-disabled local group was deleted.** See event “[4753](event-4753.md): A security-disabled global group was deleted.” Event 4748 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4747(S): A member was removed from a security-disabled local group. See event _[4752](event-4752.md): A member was removed from a security-disabled global group._ Event 4747 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4748(S): A security-disabled local group was deleted. See event _[4753](event-4753.md): A security-disabled global group was deleted._ Event 4748 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md index 63e9821c12..6cd117429a 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md @@ -20,16 +20,15 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Filtering Platform Policy Change allows you to audit events generated by changes to the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510(v=vs.85).aspx) (WFP), such as the following: -- IPsec services status. +- IPsec services status. -- Changes to IPsec policy settings. +- Changes to IPsec policy settings. -- Changes to Windows Filtering Platform Base Filtering Engine policy settings. +- Changes to Windows Filtering Platform Base Filtering Engine policy settings. -- Changes to WFP providers and engine. +- Changes to WFP providers and engine. Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). @@ -41,83 +40,82 @@ This subcategory is outside the scope of this document. | Member Server | - | - | - | - | This subcategory is outside the scope of this document. | | Workstation | - | - | - | - | This subcategory is outside the scope of this document. | -## 4709(S): IPsec Services was started. +- 4709(S): IPsec Services was started. -## 4710(S): IPsec Services was disabled. +- 4710(S): IPsec Services was disabled. -## 4711(S): May contain any one of the following: +- 4711(S): May contain any one of the following: -## 4712(F): IPsec Services encountered a potentially serious failure. +- 4712(F): IPsec Services encountered a potentially serious failure. -## 5040(S): A change has been made to IPsec settings. An Authentication Set was added. +- 5040(S): A change has been made to IPsec settings. An Authentication Set was added. -## 5041(S): A change has been made to IPsec settings. An Authentication Set was modified. +- 5041(S): A change has been made to IPsec settings. An Authentication Set was modified. -## 5042(S): A change has been made to IPsec settings. An Authentication Set was deleted. +- 5042(S): A change has been made to IPsec settings. An Authentication Set was deleted. -## 5043(S): A change has been made to IPsec settings. A Connection Security Rule was added. +- 5043(S): A change has been made to IPsec settings. A Connection Security Rule was added. -## 5044(S): A change has been made to IPsec settings. A Connection Security Rule was modified. +- 5044(S): A change has been made to IPsec settings. A Connection Security Rule was modified. -## 5045(S): A change has been made to IPsec settings. A Connection Security Rule was deleted. +- 5045(S): A change has been made to IPsec settings. A Connection Security Rule was deleted. -## 5046(S): A change has been made to IPsec settings. A Crypto Set was added. +- 5046(S): A change has been made to IPsec settings. A Crypto Set was added. -## 5047(S): A change has been made to IPsec settings. A Crypto Set was modified. +- 5047(S): A change has been made to IPsec settings. A Crypto Set was modified. -## 5048(S): A change has been made to IPsec settings. A Crypto Set was deleted. +- 5048(S): A change has been made to IPsec settings. A Crypto Set was deleted. -## 5440(S): The following callout was present when the Windows Filtering Platform Base Filtering Engine started. +- 5440(S): The following callout was present when the Windows Filtering Platform Base Filtering Engine started. -## 5441(S): The following filter was present when the Windows Filtering Platform Base Filtering Engine started. +- 5441(S): The following filter was present when the Windows Filtering Platform Base Filtering Engine started. -## 5442(S): The following provider was present when the Windows Filtering Platform Base Filtering Engine started. +- 5442(S): The following provider was present when the Windows Filtering Platform Base Filtering Engine started. -## 5443(S): The following provider context was present when the Windows Filtering Platform Base Filtering Engine started. +- 5443(S): The following provider context was present when the Windows Filtering Platform Base Filtering Engine started. -## 5444(S): The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started. +- 5444(S): The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started. -## 5446(S): A Windows Filtering Platform callout has been changed. +- 5446(S): A Windows Filtering Platform callout has been changed. -## 5448(S): A Windows Filtering Platform provider has been changed. +- 5448(S): A Windows Filtering Platform provider has been changed. -## 5449(S): A Windows Filtering Platform provider context has been changed. +- 5449(S): A Windows Filtering Platform provider context has been changed. -## 5450(S): A Windows Filtering Platform sub-layer has been changed. +- 5450(S): A Windows Filtering Platform sub-layer has been changed. -## 5456(S): PAStore Engine applied Active Directory storage IPsec policy on the computer. +- 5456(S): PAStore Engine applied Active Directory storage IPsec policy on the computer. -## 5457(F): PAStore Engine failed to apply Active Directory storage IPsec policy on the computer. +- 5457(F): PAStore Engine failed to apply Active Directory storage IPsec policy on the computer. -## 5458(S): PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. +- 5458(S): PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. -## 5459(F): PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer. +- 5459(F): PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer. -## 5460(S): PAStore Engine applied local registry storage IPsec policy on the computer. +- 5460(S): PAStore Engine applied local registry storage IPsec policy on the computer. -## 5461(F): PAStore Engine failed to apply local registry storage IPsec policy on the computer. +- 5461(F): PAStore Engine failed to apply local registry storage IPsec policy on the computer. -## 5462(F): PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem. +- 5462(F): PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem. -## 5463(S): PAStore Engine polled for changes to the active IPsec policy and detected no changes. +- 5463(S): PAStore Engine polled for changes to the active IPsec policy and detected no changes. -## 5464(S): PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services. +- 5464(S): PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services. -## 5465(S): PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully. +- 5465(S): PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully. -## 5466(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied. +- 5466(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied. -## 5467(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used. +- 5467(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used. -## 5468(S): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used. +- 5468(S): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used. -## 5471(S): PAStore Engine loaded local storage IPsec policy on the computer. +- 5471(S): PAStore Engine loaded local storage IPsec policy on the computer. -## 5472(F): PAStore Engine failed to load local storage IPsec policy on the computer. +- 5472(F): PAStore Engine failed to load local storage IPsec policy on the computer. -## 5473(S): PAStore Engine loaded directory storage IPsec policy on the computer. +- 5473(S): PAStore Engine loaded directory storage IPsec policy on the computer. -## 5474(F): PAStore Engine failed to load directory storage IPsec policy on the computer. - -## 5477(F): PAStore Engine failed to add quick mode filter. +- 5474(F): PAStore Engine failed to load directory storage IPsec policy on the computer. +- 5477(F): PAStore Engine failed to add quick mode filter. diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 6642a9576a..4f4f0616af 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -20,24 +20,20 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Handle Manipulation enables generation of “4658: The handle to an object was closed” in [Audit File System](audit-file-system.md), [Audit Kernel Object](audit-kernel-object.md), [Audit Registry](audit-registry.md), [Audit Removable Storage](audit-removable-storage.md) and [Audit SAM](audit-sam.md) subcategories, and shows object’s handle duplication and close actions. **Event volume**: High. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | No | No | No | No | Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze.
There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level. | | Member Server | No | No | No | No | Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze.
There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level. | | Workstation | No | No | No | No | Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze.
There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level. | **Events List:** -- [4658](event-4658.md)(S): The handle to an object was closed. +- [4658](event-4658.md)(S): The handle to an object was closed. -- [4690](event-4690.md)(S): An attempt was made to duplicate a handle to an object. - -## 4658(S): The handle to an object was closed. - -This event doesn’t generate in this subcategory, but you can use this subcategory to enable it. For a description of the event, see “[4658](event-4658.md)(S): The handle to an object was closed” in the Audit File System subcategory. +- [4690](event-4690.md)(S): An attempt was made to duplicate a handle to an object. +- 4658(S): The handle to an object was closed. For a description of the event, see _[4658](event-4658.md)(S): The handle to an object was closed._ in the Audit File System subcategory. This event doesn’t generate in the Audit Handle Manipulation subcategory, but you can use this subcategory to enable it. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index e1ea4700ec..6b69b8a282 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -20,7 +20,6 @@ ms.date: 10/02/2018 - Windows 10 - Windows Server 2016 - Audit IPsec Driver allows you to audit events generated by IPSec driver such as the following: - Startup and shutdown of the IPsec services. @@ -37,9 +36,11 @@ Audit IPsec Driver allows you to audit events generated by IPSec driver such as A high rate of packet drops by the IPsec filter driver may indicate attempts to gain access to the network by unauthorized systems. -Failure to process IPsec filters poses a potential security risk because some network interfaces may not get the protection that is provided by the IPsec filter. +Failure to process IPsec filters poses a potential security risk because some network interfaces may not get the protection that is provided by the IPsec filter. This subcategory is outside the scope of this document. -This subcategory is outside the scope of this document. +**Event volume:** Medium + +**Default:** Not configured | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------| @@ -47,25 +48,26 @@ This subcategory is outside the scope of this document. | Member Server | - | - | - | - | There is no recommendation for this subcategory in this document, unless you know exactly what you need to monitor at IPsec Driver level. | | Workstation | - | - | - | - | There is no recommendation for this subcategory in this document, unless you know exactly what you need to monitor at IPsec Driver level. | -## 4960(S): IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. +**Events List:** -## 4961(S): IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. +- 4960(S): IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. -## 4962(S): IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. +- 4961(S): IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. -## 4963(S): IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. +- 4962(S): IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. -## 4965(S): IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. +- 4963(S): IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. -## 5478(S): IPsec Services has started successfully. +- 4965(S): IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. -## 5479(S): IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +- 5478(S): IPsec Services has started successfully. -## 5480(F): IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. +- 5479(S): IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. -## 5483(F): IPsec Services failed to initialize RPC server. IPsec Services could not be started. +- 5480(F): IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. -## 5484(F): IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +- 5483(F): IPsec Services failed to initialize RPC server. IPsec Services could not be started. -## 5485(F): IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. +- 5484(F): IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +- 5485(F): IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index 5e6f49e5b2..27e7cf7591 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -25,23 +25,22 @@ Audit IPsec Extended Mode allows you to audit events generated by Internet Key E Audit IPsec Extended Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Extended Mode troubleshooting. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | -## 4978(S): During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +- 4978(S): During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 4979(S): IPsec Main Mode and Extended Mode security associations were established. +- 4979(S): IPsec Main Mode and Extended Mode security associations were established. -## 4980(S): IPsec Main Mode and Extended Mode security associations were established. +- 4980(S): IPsec Main Mode and Extended Mode security associations were established. -## 4981(S): IPsec Main Mode and Extended Mode security associations were established. +- 4981(S): IPsec Main Mode and Extended Mode security associations were established. -## 4982(S): IPsec Main Mode and Extended Mode security associations were established. +- 4982(S): IPsec Main Mode and Extended Mode security associations were established. -## 4983(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. - -## 4984(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. +- 4983(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. +- 4984(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index 0cc0aa7340..84c5eda210 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -20,32 +20,30 @@ ms.date: 10/02/2018 - Windows 10 - Windows Server 2016 - Audit IPsec Main Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. Audit IPsec Main Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Main Mode troubleshooting. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | -## 4646(S): Security ID: %1 +- 4646(S): Security ID: %1 -## 4650(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. +- 4650(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. -## 4651(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. +- 4651(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. -## 4652(F): An IPsec Main Mode negotiation failed. +- 4652(F): An IPsec Main Mode negotiation failed. -## 4653(F): An IPsec Main Mode negotiation failed. +- 4653(F): An IPsec Main Mode negotiation failed. -## 4655(S): An IPsec Main Mode security association ended. +- 4655(S): An IPsec Main Mode security association ended. -## 4976(S): During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +- 4976(S): During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 5049(S): An IPsec Security Association was deleted. - -## 5453(S): An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. +- 5049(S): An IPsec Security Association was deleted. +- 5453(S): An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 4121e3101b..9f081e8e45 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -20,20 +20,18 @@ ms.date: 10/02/2018 - Windows 10 - Windows Server 2016 - Audit IPsec Quick Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. Audit IPsec Quick Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Quick Mode troubleshooting. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | -## 4977(S): During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +- 4977(S): During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 5451(S): An IPsec Quick Mode security association was established. - -## 5452(S): An IPsec Quick Mode security association ended. +- 5451(S): An IPsec Quick Mode security association was established. +- 5452(S): An IPsec Quick Mode security association ended. diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md index 0b76e614a1..cc023326da 100644 --- a/windows/security/threat-protection/auditing/audit-network-policy-server.md +++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md @@ -20,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Network Policy Server allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) activity related to user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this subcategory, an audit event is generated for each IAS and NAP user access request. @@ -33,27 +32,26 @@ NAP events can be used to help understand the overall health of the network. Role-specific subcategories are outside the scope of this document. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF – if a server has the [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role installed and you need to monitor access requests and other NPS-related events, enable this subcategory. | | Member Server | IF | IF | IF | IF | IF – if a server has the [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role installed and you need to monitor access requests and other NPS-related events, enable this subcategory. | -| Workstation | No | No | No | No | [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role cannot be installed on client OS. | +| Workstation | No | No | No | No | [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role cannot be installed on client OS. | -## 6272: Network Policy Server granted access to a user. +- 6272: Network Policy Server granted access to a user. -## 6273: Network Policy Server denied access to a user. +- 6273: Network Policy Server denied access to a user. -## 6274: Network Policy Server discarded the request for a user. +- 6274: Network Policy Server discarded the request for a user. -## 6275: Network Policy Server discarded the accounting request for a user. +- 6275: Network Policy Server discarded the accounting request for a user. -## 6276: Network Policy Server quarantined a user. +- 6276: Network Policy Server quarantined a user. -## 6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy. +- 6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy. -## 6278: Network Policy Server granted full access to a user because the host met the defined health policy. +- 6278: Network Policy Server granted full access to a user because the host met the defined health policy. -## 6279: Network Policy Server locked the user account due to repeated failed authentication attempts. - -## 6280: Network Policy Server unlocked the user account. +- 6279: Network Policy Server locked the user account due to repeated failed authentication attempts. +- 6280: Network Policy Server unlocked the user account. diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index 73b06e0091..91aef3a375 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -20,78 +20,86 @@ ms.date: 02/28/2019 - Windows 10 - Windows Server 2016 - Audit Security Group Management determines whether the operating system generates audit events when specific security group management tasks are performed. **Event volume**: Low. This subcategory allows you to audit events generated by changes to security groups such as the following: -- Security group is created, changed, or deleted. +- Security group is created, changed, or deleted. -- Member is added or removed from a security group. +- Member is added or removed from a security group. -- Group type is changed. +- Group type is changed. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory.| -| Member Server | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory.| -| Workstation | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory.| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| +| Domain Controller | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** -- [4731](event-4731.md)(S): A security-enabled local group was created. +- [4731](event-4731.md)(S): A security-enabled local group was created. -- [4732](event-4732.md)(S): A member was added to a security-enabled local group. +- [4732](event-4732.md)(S): A member was added to a security-enabled local group. -- [4733](event-4733.md)(S): A member was removed from a security-enabled local group. +- [4733](event-4733.md)(S): A member was removed from a security-enabled local group. -- [4734](event-4734.md)(S): A security-enabled local group was deleted. +- [4734](event-4734.md)(S): A security-enabled local group was deleted. -- [4735](event-4735.md)(S): A security-enabled local group was changed. +- [4735](event-4735.md)(S): A security-enabled local group was changed. -- [4764](event-4764.md)(S): A group’s type was changed. +- [4764](event-4764.md)(S): A group’s type was changed. -- [4799](event-4799.md)(S): A security-enabled local group membership was enumerated. +- [4799](event-4799.md)(S): A security-enabled local group membership was enumerated. -**4727(S): A security-enabled global group was created.** See event “[4731](event-4731.md): A security-enabled local group was created.” Event 4727 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4727(S): A security-enabled global group was created. See event _[4731](event-4731.md): A security-enabled local group was created._ Event 4727 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. + > [!IMPORTANT] + > Event 4727(S) generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. -**4737(S): A security-enabled global group was changed.** See event “[4735](event-4735.md): A security-enabled local group was changed.” Event 4737 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4737(S): A security-enabled global group was changed. See event _[4735](event-4735.md): A security-enabled local group was changed._ Event 4737 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. + > [!IMPORTANT] + > Event 4737(S) generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. -**4728(S): A member was added to a security-enabled global group.** See event “[4732](event-4732.md): A member was added to a security-enabled local group.” Event 4728 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4728(S): A member was added to a security-enabled global group. See event _[4732](event-4732.md): A member was added to a security-enabled local group._ Event 4728 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. + > [!IMPORTANT] + > Event 4728(S) generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. -**4729(S): A member was removed from a security-enabled global group.** See event “[4733](event-4733.md): A member was removed from a security-enabled local group.” Event 4729 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4729(S): A member was removed from a security-enabled global group. See event _[4733](event-4733.md): A member was removed from a security-enabled local group._ Event 4729 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. + > [!IMPORTANT] + > Event 4729(S) generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. -**4730(S): A security-enabled global group was deleted.** See event “[4734](event-4734.md): A security-enabled local group was deleted.” Event 4730 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4730(S): A security-enabled global group was deleted. See event _[4734](event-4734.md): A security-enabled local group was deleted._ Event 4730 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. + > [!IMPORTANT] + > Event 4730(S) generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. -**4754(S): A security-enabled universal group was created.** See event “[4731](event-4731.md): A security-enabled local group was created.”. Event 4754 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4754(S): A security-enabled universal group was created. See event _[4731](event-4731.md): A security-enabled local group was created._ Event 4754 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. + > [!IMPORTANT] + > Event 4754(S) generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. -**4755(S): A security-enabled universal group was changed.** See event “[4735](event-4735.md): A security-enabled local group was changed.”. Event 4737 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4755(S): A security-enabled universal group was changed. See event _[4735](event-4735.md): A security-enabled local group was changed._ Event 4737 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. + > [!IMPORTANT] + > Event 4755(S) generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. -**4756(S): A member was added to a security-enabled universal group.** See event “[4732](event-4732.md): A member was added to a security-enabled local group.”. Event 4756 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4756(S): A member was added to a security-enabled universal group. See event _[4732](event-4732.md): A member was added to a security-enabled local group._ Event 4756 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. + > [!IMPORTANT] + > Event 4756(S) generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. -**4757(S): A member was removed from a security-enabled universal group.** See event “[4733](event-4733.md): A member was removed from a security-enabled local group.”. Event 4757 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4757(S): A member was removed from a security-enabled universal group. See event _[4733](event-4733.md): A member was removed from a security-enabled local group._ Event 4757 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. + > [!IMPORTANT] + > Event 4757(S) generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. -**4758(S): A security-enabled universal group was deleted.** See event “[4734](event-4734.md): A security-enabled local group was deleted.”. Event 4758 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. - -**Important:** this event generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. +- 4758(S): A security-enabled universal group was deleted. See event _[4734](event-4734.md): A security-enabled local group was deleted._ Event 4758 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. + >[!IMPORTANT] + > Event 4758(S) generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md index 526f198904..ac8fcf4c32 100644 --- a/windows/security/threat-protection/auditing/audit-security-state-change.md +++ b/windows/security/threat-protection/auditing/audit-security-state-change.md @@ -39,5 +39,6 @@ Audit Security State Change contains Windows startup, recovery, and shutdown eve - [4621](event-4621.md)(S): Administrator recovered system from CrashOnAuditFail. ->**Note**  Event **4609(S): Windows is shutting down** currently doesn’t generate. It is a defined event, but it is never invoked by the operating system. +>[!NOTE] +>Event **4609(S): Windows is shutting down** doesn't currently generate. It is a defined event, but it is never invoked by the operating system. diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md index 7e2fcd6fba..c099b898d6 100644 --- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md @@ -71,6 +71,7 @@ If you configure this policy setting, an audit event is generated when sensitive - [4985](event-4985.md)(S): The state of a transaction has changed. ->**Note**  For some reason event “[4985](event-4985.md)(S): The state of a transaction has changed" from [Audit File System](audit-file-system.md) subcategory generates also in this subcategory. See description of event [4985](event-4985.md) in [Audit File System](audit-file-system.md) subcategory. +>[!NOTE] +> The event “[4985](event-4985.md)(S): The state of a transaction has changed" from [Audit File System](audit-file-system.md) subcategory also generates in this subcategory. See description of event [4985](event-4985.md) in [Audit File System](audit-file-system.md) subcategory. diff --git a/windows/security/threat-protection/intelligence/macro-malware.md b/windows/security/threat-protection/intelligence/macro-malware.md index 9bfd3d7244..f26e686027 100644 --- a/windows/security/threat-protection/intelligence/macro-malware.md +++ b/windows/security/threat-protection/intelligence/macro-malware.md @@ -45,4 +45,6 @@ We've seen macro malware download threats from the following families: * Enterprises can prevent macro malware from running executable content using [ASR rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#enable-and-audit-attack-surface-reduction-rules) -For more general tips, see [prevent malware infection](prevent-malware-infection.md). +For more tips on protecting yourself from suspicious emails, see [phishing](phishing.md). + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index 56f734dc44..07018d689f 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -23,13 +23,16 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from - [Download Microsoft Safety Scanner (64-bit)](https://go.microsoft.com/fwlink/?LinkId=212732) -> **NOTE** The security intelligence update version of the Microsoft Safety Scaner matches the version described [in this web page](https://www.microsoft.com/en-us/wdsi/definitions). +> [!NOTE] +> The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/en-us/wdsi/definitions). Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan. -> **NOTE:** This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/en-us/wdsi/help/troubleshooting-infection). -> -> **NOTE:** Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download. +> [!NOTE] +> This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/en-us/wdsi/help/troubleshooting-infection). + +> [!NOTE] +> Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download. ## System requirements diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index c22f668986..fbe2aa1d4c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -37,7 +37,7 @@ The following best practices serve as a guideline of query performance best prac - When joining between two tables, project only needed columns from both sides of the join. >[!Tip] ->For more guidance on improving query performance, read [Kusto query best practices](https://docs.microsoft.com/en-us/azure/kusto/query/best-practices). +>For more guidance on improving query performance, read [Kusto query best practices](https://docs.microsoft.com/azure/kusto/query/best-practices). ## Query tips and pitfalls diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index 919befad8e..1eadc36802 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -48,7 +48,7 @@ The goal is to remediate the issues in the security recommendations list to impr - **Related component** — **Accounts**, **Application**, **Network**, **OS**, or **Security controls** - **Remediation type** — **Configuration change** or **Software update** -See how you can [improve your security configuration](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios#improve-your-security-configuration), for details. +See how you can [improve your security configuration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios#improve-your-security-configuration), for details. ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md index 76fe3c070d..3c3fa5ffff 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md @@ -33,7 +33,7 @@ You need to make sure that all your devices are enrolled in Intune. You can use - IT Admin: For more information on how to enabling auto-enrollment, see [Windows Enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) -- End-user: For more information on how to enroll your Windows 10 device in Intune, see [Enroll your Windows 10 device in Intune]https://docs.microsoft.com/intune/quickstart-enroll-windows-device) +- End-user: For more information on how to enroll your Windows 10 device in Intune, see [Enroll your Windows 10 device in Intune](https://docs.microsoft.com/intune/quickstart-enroll-windows-device) - End-user alternative: For more information on joining an Azure AD domain, see [How to: Plan your Azure AD join implementation](https://docs.microsoft.com/azure/active-directory/devices/azureadjoin-plan). diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md index 133f0ecb0a..a381b9ef5a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md @@ -47,7 +47,7 @@ You can create rules that determine the machines and alert severities to send em 2. Click **Add notification rule**. -3. Specify the General information: +3. Specify the General information: - **Rule name** - Specify a name for the notification rule. - **Include organization name** - Specify the customer name that appears on the email notification. - **Include tenant-specific portal link** - Adds a link with the tenant ID to allow access to a specific tenant. @@ -93,9 +93,9 @@ This section lists various issues that you may encounter when using email notifi **Solution:** Make sure that the notifications are not blocked by email filters: -1. Check that the Microsoft Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk. -2. Check that your email security product is not blocking the email notifications from Microsoft Defender ATP. -3. Check your email application rules that might be catching and moving your Microsoft Defender ATP email notifications. +1. Check that the Microsoft Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk. +2. Check that your email security product is not blocking the email notifications from Microsoft Defender ATP. +3. Check your email application rules that might be catching and moving your Microsoft Defender ATP email notifications. ## Related topics - [Update data retention settings](data-retention-settings.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md index 54f60b64f4..5e84c75371 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md @@ -46,7 +46,7 @@ ms.date: 04/24/2018 d. Click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. 3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. @@ -98,7 +98,7 @@ For security reasons, the package used to Offboard machines will expire 30 days > [!NOTE] > Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. -1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): +1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): a. In the navigation pane, select **Settings** > **Offboarding**. @@ -108,21 +108,21 @@ For security reasons, the package used to Offboard machines will expire 30 days d. Click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. -3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. +3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. -4. In the **Group Policy Management Editor**, go to **Computer configuration,** then **Preferences**, and then **Control panel settings**. +4. In the **Group Policy Management Editor**, go to **Computer configuration,** then **Preferences**, and then **Control panel settings**. -5. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate task**. +5. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate task**. -6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account (BUILTIN\SYSTEM) under **Security options**. +6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account (BUILTIN\SYSTEM) under **Security options**. -7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check-box. +7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check-box. -8. Go to the **Actions** tab and click **New...**. Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd* file. +8. Go to the **Actions** tab and click **New...**. Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd* file. -9. Click **OK** and close any open GPMC windows. +9. Click **OK** and close any open GPMC windows. > [!IMPORTANT] > Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. @@ -132,9 +132,9 @@ For security reasons, the package used to Offboard machines will expire 30 days With Group Policy there isn’t an option to monitor deployment of policies on the machines. Monitoring can be done directly on the portal, or by using the different deployment tools. ## Monitor machines using the portal -1. Go to [Microsoft Defender Security Center](https://securitycenter.windows.com/). -2. Click **Machines list**. -3. Verify that machines are appearing. +1. Go to [Microsoft Defender Security Center](https://securitycenter.windows.com/). +2. Click **Machines list**. +3. Verify that machines are appearing. > [!NOTE] > It can take several days for machines to start showing on the **Machines list**. This includes the time it takes for the policies to be distributed to the machine, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index b1b6bdea64..f1e4b4412d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -103,7 +103,7 @@ For security reasons, the package used to Offboard machines will expire 30 days > [!NOTE] > Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. -1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): +1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): a. In the navigation pane, select **Settings** > **Offboarding**. @@ -113,7 +113,7 @@ For security reasons, the package used to Offboard machines will expire 30 days d. Click **Download package**, and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Deploy the package by following the steps in the [Packages and Programs in Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs) topic. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md index d18d805cd6..d326a4194b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md @@ -93,7 +93,7 @@ For security reasons, the package used to Offboard machines will expire 30 days > [!NOTE] > Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. -1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): +1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): a. In the navigation pane, select **Settings** > **Offboarding**. @@ -103,7 +103,7 @@ For security reasons, the package used to Offboard machines will expire 30 days d. Click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machines. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machines. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Open an elevated command-line prompt on the machine and run the script: @@ -127,11 +127,11 @@ You can follow the different verification steps in the [Troubleshoot onboarding Monitoring can also be done directly on the portal, or by using the different deployment tools. ### Monitor machines using the portal -1. Go to Microsoft Defender Security Center. +1. Go to Microsoft Defender Security Center. -2. Click **Machines list**. +2. Click **Machines list**. -3. Verify that machines are appearing. +3. Verify that machines are appearing. ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index 70cfffed50..5c01117055 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -65,11 +65,11 @@ From the overview, create a configuration profile specifically for the deploymen 3. After creating the profile, assign it to all your machines. You can review profiles and their deployment status anytime by accessing **Device configuration > Profiles** on Intune. - ![Profile assignment screen screen on Intune](images/secconmgmt_onboarding_3assignprofile.png)
+ ![Profile assignment screen on Intune](images/secconmgmt_onboarding_3assignprofile.png)
*Assigning the new agent profile to all machines* >[!TIP] ->To learn more about Intune profiles, read [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-profile-assign). +>To learn more about Intune profiles, read [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/device-profile-assign). >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md index cce444980a..05869b764d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md @@ -47,13 +47,13 @@ In doing so, you benefit from: Machine configuration management works closely with Intune device management to establish the inventory of the machines in your organization and the baseline security configuration. You will be able to track and manage configuration issues on Intune-managed Windows 10 machines. -Before you can ensure your machines are configured properly, enroll them to Intune management. Intune enrollment is robust and has several enrollment options for Windows 10 machines. For more information about Intune enrollment options, read [Set up enrollment for Windows devices](https://docs.microsoft.com/en-us/intune/windows-enroll). +Before you can ensure your machines are configured properly, enroll them to Intune management. Intune enrollment is robust and has several enrollment options for Windows 10 machines. For more information about Intune enrollment options, read [Set up enrollment for Windows devices](https://docs.microsoft.com/intune/windows-enroll). >[!NOTE] ->To enroll Windows devices to Intune, administrators must have already been assigned licenses. [Read about assigning licenses for device enrollment](https://docs.microsoft.com/en-us/intune/licenses-assign). +>To enroll Windows devices to Intune, administrators must have already been assigned licenses. [Read about assigning licenses for device enrollment](https://docs.microsoft.com/intune/licenses-assign). >[!TIP] ->To optimize machine management through Intune, [connect Intune to Microsoft Defender ATP](https://docs.microsoft.com/en-us/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). +>To optimize machine management through Intune, [connect Intune to Microsoft Defender ATP](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). ## Known issues and limitations in this preview During preview, you might encounter a few known limitations: diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 6e08192fa6..b9ff87202a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -172,6 +172,7 @@ If at least one of the connectivity options returns a (200) status, then the Mic However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure. > [!NOTE] +> The Connectivity Analyzer tool is not compatible with ASR rule [Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard#attack-surface-reduction-rules). You will need to temporarily disable this rule to run the connectivity tool. > When the TelemetryProxyServer is set, in Registry or via Group Policy, Microsoft Defender ATP will fall back to direct if it can't access the defined proxy. ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index ad8b37b921..2547032022 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -104,14 +104,14 @@ The following steps are required to enable this integration: ### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP -1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603). +1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603). -2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server: +2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server: - [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup)
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**. - [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script). -3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#configure-proxy-settings). +3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#configure-proxy-settings). Once completed, you should see onboarded servers in the portal within an hour. @@ -149,7 +149,7 @@ Supported tools include: 1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md). -2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly: +2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly: a. Set the following registry entry: - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 92914defd5..c3eaee164d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -28,13 +28,13 @@ Create custom detection rules from [Advanced hunting](overview-hunting.md) queri >[!NOTE] >To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. -1. In the navigation pane, select **Advanced hunting**. +1. In the navigation pane, select **Advanced hunting**. -2. Select an existing query that you'd like to base the monitor on or create a new query. +2. Select an existing query that you'd like to base the monitor on or create a new query. -3. Select **Create detection rule**. +3. Select **Create detection rule**. -4. Specify the alert details: +4. Specify the alert details: - Alert title - Severity @@ -42,7 +42,7 @@ Create custom detection rules from [Advanced hunting](overview-hunting.md) queri - Description - Recommended actions -5. Click **Create**. +5. Click **Create**. > [!TIP] > TIP #1: Running the query for the first time before saving it can help you find any mistakes or errors and give you a preview of the data you can expect to be returned.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md b/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md index 741e7bde03..fe6c7c7b35 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md +++ b/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md @@ -141,11 +141,11 @@ This step will guide you in simulating an event in connection to a malicious IP ## Step 4: Explore the custom alert in the portal This step will guide you in exploring the custom alert in the portal. -1. Open [Microsoft Defender Security Center](http://securitycenter.windows.com/) on a browser. +1. Open [Microsoft Defender Security Center](http://securitycenter.windows.com/) on a browser. -2. Log in with your Microsoft Defender ATP credentials. +2. Log in with your Microsoft Defender ATP credentials. -3. The dashboard should display the custom TI alert for the victim machine resulting from the simulated attack. +3. The dashboard should display the custom TI alert for the victim machine resulting from the simulated attack. ![Image of sample custom ti alert in the portal](images/atp-sample-custom-ti-alert.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index aa344ebf81..6cb6750c1c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -83,7 +83,7 @@ Use the slider or the range selector to quickly specify a time period that you w ## Deep analysis -The **Deep analysis** tab allows you to [submit the file for deep analysis](respond-file-alerts.md#deep-analysis), to uncover more details about the the file's behavior, as well as the effect it is having within your organizations. After you submit the file, the deep analysis report will appear in this tab once results are available. If deep analysis did not find anything, the report will be empty and the results space will remain blank. +The **Deep analysis** tab allows you to [submit the file for deep analysis](respond-file-alerts.md#deep-analysis), to uncover more details about the file's behavior, as well as the effect it is having within your organizations. After you submit the file, the deep analysis report will appear in this tab once results are available. If deep analysis did not find anything, the report will be empty and the results space will remain blank. ![Image of deep analysis tab](images/submit-file.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md b/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md index 31ca59c206..ea8a219a7d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md +++ b/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md @@ -130,25 +130,25 @@ For more information, see [Create a Power BI dashboard from a report](https://po You can create a custom dashboard in Power BI Desktop to create visualizations that cater to the specific views that your organization requires. ### Before you begin -1. Make sure you use Power BI Desktop June 2017 and above. [Download the latest version](https://powerbi.microsoft.com/en-us/desktop/). +1. Make sure you use Power BI Desktop June 2017 and above. [Download the latest version](https://powerbi.microsoft.com/en-us/desktop/). -2. In the Microsoft Defender Security Center navigation pane, select **Settings** > **Power BI reports**. +2. In the Microsoft Defender Security Center navigation pane, select **Settings** > **Power BI reports**. ![Image of settings Power BI reports](images/atp-settings-powerbi.png) -3. Click **Download connector** to download the WDATPPowerBI.zip file and extract it. +3. Click **Download connector** to download the WDATPPowerBI.zip file and extract it. ![Settings with download connector button](images/atp-download-connector.png) -4. Create a new directory `Microsoft Power BI Desktop\Custom Connectors` under the user's Documents folder. +4. Create a new directory `Microsoft Power BI Desktop\Custom Connectors` under the user's Documents folder. -5. Copy WDATPDataConnector.mez from the zip to the directory you just created. +5. Copy WDATPDataConnector.mez from the zip to the directory you just created. -6. Open Power BI Desktop. +6. Open Power BI Desktop. -7. Click **File** > **Options and settings** > **Custom data connectors**. +7. Click **File** > **Options and settings** > **Custom data connectors**. -8. Select **New table and matrix visuals** and **Custom data connectors** and click **OK**. +8. Select **New table and matrix visuals** and **Custom data connectors** and click **OK**. >[!NOTE] >If you are using Power BI Desktop July 2017 version (or later), you won't need to select **New table and matrix visuals**. You'll only need to select **Custom data connectors**. @@ -160,36 +160,36 @@ You can create a custom dashboard in Power BI Desktop to create visualizations t ## Customize the Microsoft Defender ATP Power BI dashboard After completing the steps in the Before you begin section, you can proceed with building your custom dashboard. -1. Open WDATPPowerBI.pbit from the zip with Power BI Desktop. +1. Open WDATPPowerBI.pbit from the zip with Power BI Desktop. -2. If this is the first time you’re using Power BI with Microsoft Defender ATP, you’ll need to sign in and give consent to Microsoft Defender ATP Power BI app. By providing consent, you’re allowing Microsoft Defender ATP Power BI to sign in and read your profile, and access your data. +2. If this is the first time you’re using Power BI with Microsoft Defender ATP, you’ll need to sign in and give consent to Microsoft Defender ATP Power BI app. By providing consent, you’re allowing Microsoft Defender ATP Power BI to sign in and read your profile, and access your data. ![Consent image](images/atp-powerbi-consent.png) -3. Click **Accept**. Power BI Desktop will start downloading your Microsoft Defender ATP data from Microsoft Graph. When all data has been downloaded, you can proceed to customize your reports. +3. Click **Accept**. Power BI Desktop will start downloading your Microsoft Defender ATP data from Microsoft Graph. When all data has been downloaded, you can proceed to customize your reports. ## Mashup Microsoft Defender ATP data with other data sources You can use Power BI Desktop to analyse data from Microsoft Defender ATP and mash that data up with other data sources to gain better security perspective in your organization. -1. In Power BI Desktop, in the Home ribbon, click **Get data** and search for **Microsoft Defender Advanced Threat Protection**. +1. In Power BI Desktop, in the Home ribbon, click **Get data** and search for **Microsoft Defender Advanced Threat Protection**. 2. Click **Connect**. -3. On the Preview Connector windows, click **Continue**. +3. On the Preview Connector windows, click **Continue**. -4. If this is the first time you’re using Power BI with Microsoft Defender ATP, you’ll need to sign in and give consent to Microsoft Defender ATP Power BI app. By providing consent, you’re allowing Microsoft Defender ATP Power BI to sign in and read your profile, and access your data. +4. If this is the first time you’re using Power BI with Microsoft Defender ATP, you’ll need to sign in and give consent to Microsoft Defender ATP Power BI app. By providing consent, you’re allowing Microsoft Defender ATP Power BI to sign in and read your profile, and access your data. ![Consent image](images/atp-powerbi-consent.png) -5. Click **Accept**. Power BI Desktop will start downloading your Microsoft Defender ATP data from Microsoft Graph. When all data has been downloaded, you can proceed to customize your reports. +5. Click **Accept**. Power BI Desktop will start downloading your Microsoft Defender ATP data from Microsoft Graph. When all data has been downloaded, you can proceed to customize your reports. -6. In the Navigator dialog box, select the Microsoft Defender ATP feeds you'd like to download and use in your reports and click Load. Data will start to be downloaded from the Microsoft Graph. +6. In the Navigator dialog box, select the Microsoft Defender ATP feeds you'd like to download and use in your reports and click Load. Data will start to be downloaded from the Microsoft Graph. -7. Load other data sources by clicking **Get data item** in the Home ribbon, and select another data source. +7. Load other data sources by clicking **Get data item** in the Home ribbon, and select another data source. -8. Add visuals and select fields from the available data sources. +8. Add visuals and select fields from the available data sources. ## Using the Power BI reports There are a couple of tabs on the report that's generated: diff --git a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md index 35352f18b7..abf6c2fb00 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md @@ -173,7 +173,7 @@ Here is an example return value: ### Get access token The following code example demonstrates how to obtain an access token and call the Microsoft Defender ATP API. -```syntax +```csharp AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}/oauth2", tenantId)); ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret); AuthenticationResult authenticationResult = context.AcquireToken(resource, clientCredentials); diff --git a/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md b/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md index d0dd4808c2..58a9f19fcf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md +++ b/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md @@ -39,7 +39,7 @@ The following example demonstrates how to obtain an Azure AD access token that y Replace the *auth_url*, *client_id*, and *client_secret* values with the ones you got from **Settings** page in the portal: -``` +```python import json import requests from pprint import pprint @@ -62,7 +62,7 @@ token = json.loads(response.text)["access_token"] ## Step 2: Create request session object Add HTTP headers to the session object, including the Authorization header with the token that was obtained. -``` +```python with requests.Session() as session: session.headers = { 'Authorization': 'Bearer {}'.format(token), @@ -74,7 +74,7 @@ with requests.Session() as session: ## Step 3: Create calls to the custom threat intelligence API After adding HTTP headers to the session object, you can now create calls to the API. The following example demonstrates how you can view all the alert definition entities: -``` +```python response = session.get("https://ti.securitycenter.windows.com/V1.0/AlertDefinitions") pprint(json.loads(response.text)) ``` @@ -85,7 +85,7 @@ The response is empty on initial use of the API. ## Step 4: Create a new alert definition The following example demonstrates how you to create a new alert definition. -``` +```python alert_definition = {"Name": "The alert's name", "Severity": "Low", "InternalDescription": "An internal description of the alert", @@ -104,7 +104,7 @@ The following example demonstrates how you to create a new alert definition. ## Step 5: Create a new indicator of compromise You can now use the alert ID obtained from creating a new alert definition to create a new indicator of compromise. -``` +```python alert_definition_id = json.loads(response.text)["Id"] ioc = {'Type': "Sha1", @@ -121,7 +121,7 @@ You can now use the alert ID obtained from creating a new alert definition to cr ## Complete code You can use the complete code to create calls to the API. -```syntax +```python import json import requests from pprint import pprint diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md index 74282e67bc..6dfcdb8e95 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md @@ -27,7 +27,7 @@ Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://w ## Before you begin: -1. Create an [event hub](https://docs.microsoft.com/en-us/azure/event-hubs/) in your tenant. +1. Create an [event hub](https://docs.microsoft.com/azure/event-hubs/) in your tenant. 2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights****. ## Enable raw data streaming: @@ -86,4 +86,4 @@ To get the data types for event properties do the following: - [Overview of Advanced Hunting](overview-hunting.md) - [Microsoft Defender ATP streaming API](raw-data-export.md) - [Stream Microsoft Defender ATP events to your Azure storage account](raw-data-export-storage.md) -- [Azure Event Hubs documentation](https://docs.microsoft.com/en-us/azure/event-hubs/) +- [Azure Event Hubs documentation](https://docs.microsoft.com/azure/event-hubs/) diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md index 1cea01f7d1..d969ecb9ab 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md @@ -27,7 +27,7 @@ Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://w ## Before you begin: -1. Create a [Storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) in your tenant. +1. Create a [Storage account](https://docs.microsoft.com/azure/storage/common/storage-account-overview) in your tenant. 2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights****. ## Enable raw data streaming: @@ -86,4 +86,4 @@ In order to get the data types for our events properties do the following: - [Overview of Advanced Hunting](overview-hunting.md) - [Microsoft Defender Advanced Threat Protection Streaming API](raw-data-export.md) - [Stream Microsoft Defender Advanced Threat Protection events to your Azure storage account](raw-data-export-storage.md) -- [Azure Storage Account documentation](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) +- [Azure Storage Account documentation](https://docs.microsoft.com/azure/storage/common/storage-account-overview) diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md index 1349b4a57b..3da3cdc512 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md @@ -27,7 +27,7 @@ ms.topic: article ## Stream Advanced Hunting events to Event Hubs and/or Azure storage account. -Microsoft Defender ATP supports streaming all the events available through [Advanced Hunting](overview-hunting.md) to an [Event Hubs](https://docs.microsoft.com/en-us/azure/event-hubs/) and/or [Azure storage account](https://docs.microsoft.com/en-us/azure/event-hubs/). +Microsoft Defender ATP supports streaming all the events available through [Advanced Hunting](overview-hunting.md) to an [Event Hubs](https://docs.microsoft.com/azure/event-hubs/) and/or [Azure storage account](https://docs.microsoft.com/azure/event-hubs/). ## In this section @@ -39,5 +39,5 @@ Topic | Description ## Related topics - [Overview of Advanced Hunting](overview-hunting.md) -- [Azure Event Hubs documentation](https://docs.microsoft.com/en-us/azure/event-hubs/) -- [Azure Storage Account documentation](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) +- [Azure Event Hubs documentation](https://docs.microsoft.com/azure/event-hubs/) +- [Azure Storage Account documentation](https://docs.microsoft.com/azure/storage/common/storage-account-overview) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index e2db21f7ff..230e57d75e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -170,7 +170,7 @@ The Deep analysis summary includes a list of observed *behaviors*, some of which Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. -Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available within the **Deep analysis** tab, on the the file's profile page. +Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available within the **Deep analysis** tab, on the file's profile page. **Submit for deep analysis** is enabled when the file is available in the Microsoft Defender ATP backend sample collection, or if it was observed on a Windows 10 machine that supports submitting to deep analysis. diff --git a/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md b/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md index add0504410..ad43e002b8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md @@ -103,11 +103,11 @@ Machines are considered "well configured" for Windows Defender EG if the followi ##### System level protection: The following system level configuration settings must be set to **On or Force On**: -1. Control Flow Guard -2. Data Execution Prevention (DEP) -3. Randomize memory allocations (Bottom-up ASLR) -4. Validate exception chains (SEHOP) -5. Validate heap integrity +1. Control Flow Guard +2. Data Execution Prevention (DEP) +3. Randomize memory allocations (Bottom-up ASLR) +4. Validate exception chains (SEHOP) +5. Validate heap integrity >[!NOTE] >The setting **Force randomization for images (Mandatory ASLR)** is currently excluded from the baseline. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index e3f2bdf6ef..499d34f2f0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -118,7 +118,7 @@ Security Administrators like you can request for the IT Administrator to remedia 4. Go to the **Remediation** page to view the status of your remediation request. -See [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/en-us/intune/atp-manage-vulnerabilities) for details. +See [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. >[!NOTE] >If your request involves remediating more than 10,000 machines, we can only send 10,000 machines for remediation to Intune. diff --git a/windows/security/threat-protection/microsoft-defender-atp/time-settings.md b/windows/security/threat-protection/microsoft-defender-atp/time-settings.md index c745b29ece..7f6c773756 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/time-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/time-settings.md @@ -56,9 +56,9 @@ The Microsoft Defender ATP time zone is set by default to UTC. Setting the time zone also changes the times for all Microsoft Defender ATP views. To set the time zone: -1. Click the **Time zone** menu ![Time zone settings icon](images/atp-time-zone.png). -2. Select the **Timezone UTC** indicator. -3. Select **Timezone UTC** or your local time zone, for example -7:00. +1. Click the **Time zone** menu ![Time zone settings icon](images/atp-time-zone.png). +2. Select the **Timezone UTC** indicator. +3. Select **Timezone UTC** or your local time zone, for example -7:00. ### Regional settings To apply different date formats for Microsoft Defender ATP, use regional settings for Internet Explorer (IE) and Microsoft Edge (Edge). If you're using another browser such as Google Chrome, follow the required steps to change the time and date settings for that browser. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md index c9f75c07aa..8e21eddb4d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-live-response.md @@ -29,7 +29,7 @@ This page provides detailed steps to troubleshoot live response issues. ## File cannot be accessed during live response sessions If while trying to take an action during a live response session, you encounter an error message stating that the file can't be accessed, you'll need to use the steps below to address the issue. -1. Copy the following script code snippet and save it as a PS1 file: +1. Copy the following script code snippet and save it as a PS1 file: ``` $copied_file_path=$args[0] @@ -47,10 +47,10 @@ If while trying to take an action during a live response session, you encounter ``` -2. Add the script to the live response library. -3. Run the script with one parameter: the file path of the file to be copied. -4. Navigate to your TEMP folder. -5. Run the action you wanted to take on the copied file. +2. Add the script to the live response library. +3. Run the script with one parameter: the file path of the file to be copied. +4. Navigate to your TEMP folder. +5. Run the action you wanted to take on the copied file. diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md index a923e76e1e..f78005ca01 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md @@ -28,11 +28,11 @@ ms.topic: article ## Create roles and assign the role to an Azure Active Directory group The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups. -1. In the navigation pane, select **Settings > Roles**. +1. In the navigation pane, select **Settings > Roles**. -2. Click **Add role**. +2. Click **Add role**. -3. Enter the role name, description, and permissions you'd like to assign to the role. +3. Enter the role name, description, and permissions you'd like to assign to the role. - **Role name** - **Description** @@ -49,23 +49,23 @@ The following steps guide you on how to create roles in Microsoft Defender Secur - **Live response capabilities** - Users can take basic or advanced live response commands.
- Basic commands allow users to: - - Start a live response session - - Run read only live response commands on a remote machine + - Start a live response session + - Run read only live response commands on a remote machine - Advanced commands allow users to: - - Run basic actions - - Download a file from the remote machine - - View a script from the files library - - Run a script on the remote machine from the files library take read and write commands. + - Run basic actions + - Download a file from the remote machine + - View a script from the files library + - Run a script on the remote machine from the files library take read and write commands. For more information on the available commands, see [Investigate machines using Live response](live-response.md). -4. Click **Next** to assign the role to an Azure AD group. +4. Click **Next** to assign the role to an Azure AD group. -5. Use the filter to select the Azure AD group that you'd like to add to this role. +5. Use the filter to select the Azure AD group that you'd like to add to this role. -6. Click **Save and close**. +6. Click **Save and close**. -7. Apply the configuration settings. +7. Apply the configuration settings. After creating roles, you'll need to create a machine group and provide access to the machine group by assigning it to a role that you just created. @@ -73,19 +73,19 @@ After creating roles, you'll need to create a machine group and provide access t ## Edit roles -1. Select the role you'd like to edit. +1. Select the role you'd like to edit. -2. Click **Edit**. +2. Click **Edit**. -3. Modify the details or the groups that are assigned to the role. +3. Modify the details or the groups that are assigned to the role. -4. Click **Save and close**. +4. Click **Save and close**. ## Delete roles -1. Select the role you'd like to delete. +1. Select the role you'd like to delete. -2. Click the drop-down button and select **Delete role**. +2. Click the drop-down button and select **Delete role**. ## Related topic diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md index ecf8f9c8eb..56c8938d8f 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -111,11 +111,11 @@ Audit only mode configures the SAMRPC protocol to do the access check against th ### Related events There are corresponding events that indicate when remote calls to the SAM are restricted, what accounts attempted to read from the SAM database, and more. The following workflow is recommended to identify applications that may be affected by restricting remote calls to SAM: -1. Dump event logs to a common share. -2. Parse them with the [Events 16962 - 16969 Reader](https://gallery.technet.microsoft.com/Events-16962-16969-Reader-2eae5f1d) script. -3. Review Event IDs 16962 to 16969, as listed in the following table, in the System log with event source Directory-Service-SAM. -4. Identify which security contexts are enumerating users or groups in the SAM database. -5. Prioritize the callers, determine if they should be allowed or not, then include the allowed callers in the SDDL string. +1. Dump event logs to a common share. +2. Parse them with the [Events 16962 - 16969 Reader](https://gallery.technet.microsoft.com/Events-16962-16969-Reader-2eae5f1d) script. +3. Review Event IDs 16962 to 16969, as listed in the following table, in the System log with event source Directory-Service-SAM. +4. Identify which security contexts are enumerating users or groups in the SAM database. +5. Prioritize the callers, determine if they should be allowed or not, then include the allowed callers in the SDDL string. |Event ID|Event Message Text|Explanation | |---|---|---| @@ -152,9 +152,9 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability The SAMRPC protocol has a default security posture that makes it possible for low-privileged attackers to query a machine on the network for data that is critical to their further hacking and penetration plans.

The following example illustrates how an attacker might exploit remote SAM enumeration: -1. A low-privileged attacker gains a foothold on a network. -2. The attacker then queries all machines on the network to determine which ones have a highly privileged domain user configured as a local administrator on that machine. -3. If the attacker can then find any other vulnerability on that machine that allows taking it over, the attacker can then squat on the machine waiting for the high-privileged user to logon and then steal or impersonate those credentials. +1. A low-privileged attacker gains a foothold on a network. +2. The attacker then queries all machines on the network to determine which ones have a highly privileged domain user configured as a local administrator on that machine. +3. If the attacker can then find any other vulnerability on that machine that allows taking it over, the attacker can then squat on the machine waiting for the high-privileged user to logon and then steal or impersonate those credentials. ### Countermeasure You can mitigate this vulnerability by enabling the **Network access: Restrict clients allowed to make remote calls** to SAM security policy setting and configuring the SDDL for only those accounts that are explicitly allowed access. diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index cadf290d91..a9991a6eef 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -278,12 +278,12 @@ You can use DHA with Microsoft Intune (sold separately) or a third-party MDM sol The example that follows shows how Windows 10 protective measures integrate and work with Intune and third-party MDM solutions. It demonstrates how the phone security architecture in Windows 10 Mobile can help you monitor and verify compliance and how the security and trust rooted in the device hardware can protect end-to-end corporate resources. When a user turns a phone on: -1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. -2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. -3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. -4. Devices that are DHA-enabled send a copy of this audit trail to the Microsoft Health Attestation service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. -6. From your DHA-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. +1. The Secure Boot feature in Windows 10 Mobile helps protect the startup sequence, allows the device to boot into a defined and trusted configuration, and loads a factory-trusted boot loader. +2. Windows 10 Mobile Trusted Boot takes control when the Secure Boot process is complete, verifying the digital signature of the Windows kernel and the components that are loaded and executed during the startup process. +3. In parallel to steps 1 and 2, the phone’s TPM runs independently in a hardware-protected security zone (isolated from the boot execution path, which monitors boot activities). It creates a protected, tamper-evident audit trail, signed with a secret that only the TPM can access. +4. Devices that are DHA-enabled send a copy of this audit trail to the Microsoft Health Attestation service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. HAS reviews the audit trails, issues an encrypted and signed report, and forwards it to the device. +6. From your DHA-enabled MDM solution, you can review the report in a protected, tamper-resistant, and tamper-evident communication channel to assess whether the device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with the organization’s security needs and policies. Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider implementing a DHA-enabled MDM system like Intune. It can take advantage of the Windows 10 Mobile cloud-based health attestation server feature to detect and block devices infected with advanced malware. ###
Device Guard diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index c06a9f2d2f..4f08806147 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -57,7 +57,7 @@ As a cloud service, it is required that computers have access to the internet an | *Malware submission storage *|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | ussus1eastprod.blob.core.windows.net ussus1westprod.blob.core.windows.net usseu1northprod.blob.core.windows.net usseu1westprod.blob.core.windows.net ussuk1southprod.blob.core.windows.net ussuk1westprod.blob.core.windows.net ussas1eastprod.blob.core.windows.net ussas1southeastprod.blob.core.windows.net ussau1eastprod.blob.core.windows.net ussau1southeastprod.blob.core.windows.net | | *Certificate Revocation List (CRL)* |Used by Windows when creating the SSL connection to MAPS for updating the CRL | http://www.microsoft.com/pkiops/crl/ http://www.microsoft.com/pkiops/certs http://crl.microsoft.com/pki/crl/products http://www.microsoft.com/pki/certs | | *Symbol Store *|Used by Windows Defender Antivirus to restore certain critical files during remediation flows | https://msdl.microsoft.com/download/symbols | -| *Universal Telemetry Client* | Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: * vortex-win.data.microsoft.com * settings-win.data.microsoft.com| +| *Universal Telemetry Client* | Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: vortex-win.data.microsoft.com settings-win.data.microsoft.com| ## Validate connections between your network and the cloud @@ -68,7 +68,7 @@ After whitelisting the URLs listed above, you can test if you are connected to t Use the following argument with the Windows Defender Antivirus command line utility (*mpcmdrun.exe*) to verify that your network can communicate with the Windows Defender Antivirus cloud service: ```DOS -MpCmdRun -ValidateMapsConnection +"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection ``` > [!NOTE] @@ -81,7 +81,7 @@ See [Manage Windows Defender Antivirus with the mpcmdrun.exe commandline tool](c You can download a sample file that Windows Defender Antivirus will detect and block if you are properly connected to the cloud. Download the file by visiting the following link: -- http://aka.ms/ioavtest +- https://aka.ms/ioavtest >[!NOTE] >This file is not an actual piece of malware. It is a fake file that is designed to test if you are properly connected to the cloud. diff --git a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md index 6506a13f61..b61fbe54d1 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md @@ -59,43 +59,43 @@ You can set this feature with Intune, Group Policy, or PowerShell. Open the Intune management portal either by searching for Intune on https://portal.azure.com or going to https://devicemanagement.microsoft.com and logging in. -1. To create a group with only the devices or users you specify: -1. Go to **Groups**. Click **New group**. Use the following values: - 1. Group type: **Security** - 2. Group name: **VDI test VMs** - 3. Group description: *Optional* - 4. Membership type: **Assigned** +1. To create a group with only the devices or users you specify: +1. Go to **Groups**. Click **New group**. Use the following values: + 1. Group type: **Security** + 2. Group name: **VDI test VMs** + 3. Group description: *Optional* + 4. Membership type: **Assigned** -1. Add the devices or users you want to be a part of this test and then click **Create** to save the group. It’s a good idea to create a couple of groups, one with VMs running the latest Insider Preview build and with the shared security intelligence update feature enabled, and another with VMs that are running Windows 10 1809 or earlier versions. This will help when you create dashboards to test the performance changes. +1. Add the devices or users you want to be a part of this test and then click **Create** to save the group. It’s a good idea to create a couple of groups, one with VMs running the latest Insider Preview build and with the shared security intelligence update feature enabled, and another with VMs that are running Windows 10 1809 or earlier versions. This will help when you create dashboards to test the performance changes. -1. To create a group that will include any machine in your tenant that is a VM, even when they are newly created: +1. To create a group that will include any machine in your tenant that is a VM, even when they are newly created: -1. Go to **Groups**. Click **New group**. Use the following values: - 1. Group type: **Security** - 2. Group name: **VDI test VMs** - 3. Group description: *Optional* - 4. Membership type: **Dynamic Device** -1. Click **Simple rule**, and select **deviceModel**, **Equals**, and enter **Virtual Machine**. Click **Add query** and then **Create** to save the group. -1. Go to **Device configuration**, then **Profiles**. You can modify an existing custom profile or create a new one. In this demo I’m going to create a new one by clicking **Create profile**. -1. Name it, choose **Windows 10 and later** as the Platform and – most importantly – select **Custom** as the profile type. -1. The **Custom OMA-URI Settings** blade is opened automatically. Click **Add** then enter the following values: - 1. Name: **VDI shared sig location** - 1. Description: *Optional* - 1. OMA-URI: **./Vendor/MSFT/Defender/SharedSignatureRoot** - 1. Data type: **String** - 1. Value: **\\\wdav-update\** (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be) -1. Click **Ok** to close the details blade, then **OK** again to close the **Custom OMA-URI Settings** blade. Click **Create** to save the new profile. The profile details page now appears. -1. Click **Assignments**. The **Include** tab is automatically selected. In the drop-down menu, select **Selected Groups**, then click **Select groups to include**. Click the **VDI test VMs** group and then **Select**. -1. Click **Evaluate** to see how many users/devices will be impacted. If the number makes sense, click **Save**. If the number doesn’t make sense, go back to the groups blade and confirm the group contains the right users or devices. -1. The profile will now be deployed to the impacted devices. Note that this may take some time. +1. Go to **Groups**. Click **New group**. Use the following values: + 1. Group type: **Security** + 2. Group name: **VDI test VMs** + 3. Group description: *Optional* + 4. Membership type: **Dynamic Device** +1. Click **Simple rule**, and select **deviceModel**, **Equals**, and enter **Virtual Machine**. Click **Add query** and then **Create** to save the group. +1. Go to **Device configuration**, then **Profiles**. You can modify an existing custom profile or create a new one. In this demo I’m going to create a new one by clicking **Create profile**. +1. Name it, choose **Windows 10 and later** as the Platform and – most importantly – select **Custom** as the profile type. +1. The **Custom OMA-URI Settings** blade is opened automatically. Click **Add** then enter the following values: + 1. Name: **VDI shared sig location** + 1. Description: *Optional* + 1. OMA-URI: **./Vendor/MSFT/Defender/SharedSignatureRoot** + 1. Data type: **String** + 1. Value: **\\\wdav-update\** (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be) +1. Click **Ok** to close the details blade, then **OK** again to close the **Custom OMA-URI Settings** blade. Click **Create** to save the new profile. The profile details page now appears. +1. Click **Assignments**. The **Include** tab is automatically selected. In the drop-down menu, select **Selected Groups**, then click **Select groups to include**. Click the **VDI test VMs** group and then **Select**. +1. Click **Evaluate** to see how many users/devices will be impacted. If the number makes sense, click **Save**. If the number doesn’t make sense, go back to the groups blade and confirm the group contains the right users or devices. +1. The profile will now be deployed to the impacted devices. Note that this may take some time. #### Use Group Policy to enable the shared security intelligence feature: -1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit. -1. In the **Group Policy Management Editor** go to **Computer configuration**. -1. Click **Administrative templates**. -1. Expand the tree to **Windows components > Windows Defender Antivirus > Security Intelligence Updates** -1. Double-click Define security intelligence location for VDI clients and set the option to Enabled. A field automatically appears, enter *\\\wdav-update *(see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be). Click **OK**. -1. Deploy the GPO to the VMs you want to test. +1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit. +1. In the **Group Policy Management Editor** go to **Computer configuration**. +1. Click **Administrative templates**. +1. Expand the tree to **Windows components > Windows Defender Antivirus > Security Intelligence Updates** +1. Double-click Define security intelligence location for VDI clients and set the option to Enabled. A field automatically appears, enter *\\\wdav-update *(see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be). Click **OK**. +1. Deploy the GPO to the VMs you want to test. #### Use PowerShell to enable the shared security intelligence feature: Use the following cmdlet to enable the feature. You’ll need to then push this as you normally would push PowerShell-based configuration policies onto the VMs: @@ -128,9 +128,9 @@ We suggest starting with once a day – but you should experiment with increasin Note that security intelligence packages are typically published once every three to four hours, so setting a frequency shorter than four hours isn’t advised as it will increase the network overhead on your management machine for no benefit. #### Set a scheduled task to run the powershell script -1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task…** on the side panel. -1. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Click **New…** Select **Daily** and click **OK**. -1. Go to the **Actions** tab. Click **New…** Enter **PowerShell** in the **Program/Script** field. Enter +1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task…** on the side panel. +1. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Click **New…** Select **Daily** and click **OK**. +1. Go to the **Actions** tab. Click **New…** Enter **PowerShell** in the **Program/Script** field. Enter *-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1* @@ -141,10 +141,10 @@ You can initiate the update manually by right-clicking on the task and clicking #### Download and unpackage manually If you would prefer to do everything manually, this what you would need to do to replicate the script’s behavior: -1. Create a new folder on the system root called *wdav_update* to store intelligence updates, for example, create the folder *c:\wdav_update* -1. Create a subfolder under *wdav_update* with a GUID name, such as *{00000000-0000-0000-0000-000000000000}*; for example *c:\wdav_update\{00000000-0000-0000-0000-000000000000}* (note, in the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time) -1. Download a security intelligence package from https://www.microsoft.com/en-us/wdsi/definitions into the GUID folder. The file should be named *mpam-fe.exe*. -1. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example **mpam-fe.exe /X**. +1. Create a new folder on the system root called *wdav_update* to store intelligence updates, for example, create the folder *c:\wdav_update* +1. Create a subfolder under *wdav_update* with a GUID name, such as *{00000000-0000-0000-0000-000000000000}*; for example *c:\wdav_update\{00000000-0000-0000-0000-000000000000}* (note, in the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time) +1. Download a security intelligence package from https://www.microsoft.com/en-us/wdsi/definitions into the GUID folder. The file should be named *mpam-fe.exe*. +1. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example **mpam-fe.exe /X**. Note: The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package. ### Randomize scheduled scans diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md index 546c3d3604..4ef46be432 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md @@ -38,8 +38,8 @@ If Windows Defender Antivirus did not download protection updates for a specifie 2. Go to the **Definition updates** section and configure the following settings: - 1. Set **Force a definition update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**. - 2. For the **If Configuration Manager is used as a source for definition updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order). + 1. Set **Force a definition update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**. + 2. For the **If Configuration Manager is used as a source for definition updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order). 3. Click **OK**. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index 92ee617ff5..dde9d19622 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -34,7 +34,7 @@ If you decide to deploy updates by using your software distribution tools, you s ## Use msupdate -MAU includes a command line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/en-us/deployoffice/mac/update-office-for-mac-using-msupdate). +MAU includes a command line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: @@ -141,4 +141,4 @@ To configure MAU, you can deploy this configuration profile from the management ## Resources -- [msupdate reference](https://docs.microsoft.com/en-us/deployoffice/mac/update-office-for-mac-using-msupdate) \ No newline at end of file +- [msupdate reference](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md index a194696c88..787e3d4728 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md @@ -53,7 +53,7 @@ In order for devices to properly show up in Update Compliance, you have to meet > - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level). > - It has been 3 days since all requirements have been met -“You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender ATP portal (https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options" +“You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender ATP portal (https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options" If the above pre-requisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index de8f61a435..960e256e35 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -24,9 +24,9 @@ manager: dansimp Windows Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. -However, on endpoints and devices that are protected with a non-Microsoft antivirus or antimalware app, Windows Defender Antivirus will automatically disable itself. You can then choose to enable an optional, limited protection feature, called [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md). +However, on endpoints and devices that are protected with a non-Microsoft antivirus or antimalware app, Windows Defender Antivirus will automatically disable itself. -If you are also using Microsoft Defender Advanced Threat Protection, then Windows Defender AV will enter a passive mode. +If you are also using Microsoft Defender Advanced Threat Protection, then Windows Defender AV will enter a passive mode. Important: Real time protection and and threats will not be remediated by Windows Defender AV. The following matrix illustrates the states that Windows Defender AV will enter when third-party antivirus products or Microsoft Defender ATP are also used. diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md index 92c9645265..bd9df5835d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md @@ -38,6 +38,16 @@ You can configure and manage Windows Defender Antivirus with: - Windows Management Instrumentation (WMI) - Group Policy +>[!TIP] +>You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work: +>- Cloud-delivered protection +>- Fast learning (including Block at first sight) +>- Potentially unwanted application blocking + +> [!NOTE] +> For more information regarding what's new in each Windows version, please refer to [What's new in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp). + +======= ## Minimum system requirements diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md index 612d28d2d8..e106d82384 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md @@ -123,7 +123,7 @@ See the following for more information: 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Advanced scan** label: -3. Select **Windows Defender Offline scan** and click **Scan now**. +3. Select **Windows Defender Offline scan** and click **Scan now**. > [!NOTE] diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md index 294b63f287..785d80cbcc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md @@ -16,6 +16,7 @@ ms.date: 05/21/2019 - Windows 10 - Windows Server 2016 +- Windows Server 2019 >[!IMPORTANT] >Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md index 6f06fb76e5..50811e33c0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -27,7 +27,7 @@ This topic explains the differences between allow and deny actions on AppLocker ## Allow action versus deny action on rules -Unlike Software Restriction Policies (SRP), each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection are allowed to run. This configuration makes it easier to determine what will occur when an AppLocker rule is applied. +Unlike Software Restriction Policies (SRP), each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection are allowed to run. This **block by default, allow by exception** configuration makes it easier to determine what will occur when an AppLocker rule is applied. You can also create rules that use the deny action. When applying rules, AppLocker first checks whether any explicit deny actions are specified in the rule list. If you have denied a file from running in a rule collection, the deny action will take precedence over any allow action, regardless of which Group Policy Object (GPO) the rule was originally applied in. Because AppLocker functions as an allowed list by default, if no rule explicitly allows or denies a file from running, AppLocker's default deny action will block the file. diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 30acb5dae4..aed91aa7a0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -77,13 +77,13 @@ Use the following procedure after you have been running a computer with a WDAC p 2. In an elevated Windows PowerShell session, initialize the variables that will be used. The example filename shown here is **DeviceGuardAuditPolicy.xml**: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + `$CIPolicyPath=$env:userprofile+"\Desktop\"` - ` $CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` + `$CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` 3. Use [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy) to generate a new WDAC policy from logged audit events. This example uses a file rule level of **Hash** and includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**. - ` New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt` + `New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt` > [!NOTE] > When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **Hash** rule level, which is the most specific. Any change to the file (such as replacing the file with a newer version of the same file) will change the Hash value, and require an update to the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md index fece90650c..67c1e0ccef 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md @@ -40,11 +40,11 @@ To create a WDAC policy, copy each of the following commands into an elevated Wi 1. Initialize variables that you will use. The following example commands use **InitialScan.xml** and **DeviceGuardPolicy.bin** for the names of the files that will be created: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + `$CIPolicyPath=$env:userprofile+"\Desktop\"` - ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - ` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` 2. Use [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy) to create a new WDAC policy by scanning the system for installed applications: diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index 98d3710250..13fa578687 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -41,7 +41,7 @@ To create a catalog file, you use a tool called **Package Inspector**. You must 2. Start Package Inspector, and then start scanning a local drive, for example, drive C: - ` PackageInspector.exe Start C:` + `PackageInspector.exe Start C:` > [!NOTE] > Package inspector can monitor installations on any local drive. Specify the appropriate drive on the local computer. @@ -69,13 +69,13 @@ To create a catalog file, you use a tool called **Package Inspector**. You must For the last command, which stops Package Inspector, be sure to type the drive letter of the drive you have been scanning, for example, C:. - ` $ExamplePath=$env:userprofile+"\Desktop"` + `$ExamplePath=$env:userprofile+"\Desktop"` - ` $CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` + `$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` - ` $CatDefName=$ExamplePath+"\LOBApp.cdf"` + `$CatDefName=$ExamplePath+"\LOBApp.cdf"` - ` PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName` + `PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName` > **Note**  Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. @@ -116,15 +116,15 @@ To sign the existing catalog file, copy each of the following commands into an e 1. Initialize the variables that will be used. Replace the *$ExamplePath* and *$CatFileName* variables as needed: - ` $ExamplePath=$env:userprofile+"\Desktop"` + `$ExamplePath=$env:userprofile+"\Desktop"` - ` $CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` + `$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` 2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user’s personal store. 3. Sign the catalog file with Signtool.exe: - ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` + ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` > **Note**  The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* represents the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the computer on which you are attempting to sign the catalog file. > @@ -148,14 +148,14 @@ After the catalog file is signed, add the signing certificate to a WDAC policy, 2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy) to create a WDAC policy that you will later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder**: - ` New-CIPolicy -Level PcaCertificate -FilePath C:\PolicyFolder\CatalogSignatureOnly.xml –UserPEs` + `New-CIPolicy -Level PcaCertificate -FilePath C:\PolicyFolder\CatalogSignatureOnly.xml –UserPEs` > [!NOTE] > Include the **-UserPEs** parameter to ensure that the policy includes user mode code integrity. 3. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule) to add the signing certificate to the WDAC policy, filling in the correct path and filenames for `` and ``: - ` Add-SignerRule -FilePath -CertificatePath -User ` + `Add-SignerRule -FilePath -CertificatePath -User` If you used step 2 to create a new WDAC policy, and want information about merging policies together, see [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index abc8820fab..40326f9ba8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -22,12 +22,12 @@ ms.date: 05/17/2019 The restriction of only having a single code integrity policy active on a system at any given time has felt limiting for customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: -1. Enforce and Audit Side-by-Side +1. Enforce and Audit Side-by-Side - To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side-by-side with an existing enforcement-mode base policy -2. Multiple Base Policies +2. Multiple Base Policies - Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent - If two base policies exist on a device, an application has to be allowed by both to run -3. Supplemental Policies +3. Supplemental Policies - Users can deploy one or more supplemental policies to expand a base policy - A supplemental policy expands a single base policy, and multiple supplemental policies can expand the same base policy - For supplemental policies, applications that are allowed by either the base policy or its supplemental policy/policies are allowed to run @@ -85,7 +85,7 @@ In order to deploy policies using the new multiple policy format you will need t - Policies must be copied to this directory: C:\Windows\System32\CodeIntegrity\CiPolicies\Active 2. Binary policy files must have the correct name which takes the format {PolicyGUID}.cip - Ensure that the name of the binary policy file is exactly the same as the PolicyID in the policy - - For example if the policy XML had the ID as {A6D7FBBF-9F6B-4072-BF37-693741E1D745} the correct name for the binary policy file would be {A6D7FBBF-9F6B-4072-BF37-693741E1D745}.cip + - For example if the policy XML had the ID as `{A6D7FBBF-9F6B-4072-BF37-693741E1D745}` the correct name for the binary policy file would be {A6D7FBBF-9F6B-4072-BF37-693741E1D745}.cip 3. Reboot the system or use WMI to rebootlessly refresh the policy ```powershell diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md index 275a1ff7ff..13a60fe360 100644 --- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -28,13 +28,13 @@ Every WDAC policy is created with audit mode enabled. After you have successfull 1. Initialize the variables that will be used: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + `$CIPolicyPath=$env:userprofile+"\Desktop\"` - ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" ` + `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - ` $EnforcedCIPolicy=$CIPolicyPath+"EnforcedPolicy.xml"` + `$EnforcedCIPolicy=$CIPolicyPath+"EnforcedPolicy.xml"` - ` $CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` + `$CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` > [!NOTE] > The initial WDAC policy that this section refers to was created in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section. If you are using a different WDAC policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. @@ -43,23 +43,23 @@ Every WDAC policy is created with audit mode enabled. After you have successfull To ensure that these options are enabled in a policy, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) as shown in the following commands. You can run these commands even if you're not sure whether options 9 and 10 are already enabled—if so, the commands have no effect. - ` Set-RuleOption -FilePath $InitialCIPolicy -Option 9` + `Set-RuleOption -FilePath $InitialCIPolicy -Option 9` - ` Set-RuleOption -FilePath $InitialCIPolicy -Option 10` + `Set-RuleOption -FilePath $InitialCIPolicy -Option 10` 3. Copy the initial file to maintain an original copy: - ` copy $InitialCIPolicy $EnforcedCIPolicy` + `copy $InitialCIPolicy $EnforcedCIPolicy` 4. Use Set-RuleOption to delete the audit mode rule option: - ` Set-RuleOption -FilePath $EnforcedCIPolicy -Option 3 -Delete` + `Set-RuleOption -FilePath $EnforcedCIPolicy -Option 3 -Delete` > [!NOTE] > To enforce a WDAC policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a WDAC policy. 5. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy) to convert the new WDAC policy to binary format: - ` ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` + `ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). You can also use other client management software to deploy and manage the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md index a0a8076215..4d04e9f6fa 100644 --- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md @@ -30,26 +30,26 @@ To merge two WDAC policies, complete the following steps in an elevated Windows 1. Initialize the variables that will be used: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + `$CIPolicyPath=$env:userprofile+"\Desktop\"` - ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - ` $AuditCIPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` + `$AuditCIPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` - ` $MergedCIPolicy=$CIPolicyPath+"MergedPolicy.xml"` + `$MergedCIPolicy=$CIPolicyPath+"MergedPolicy.xml"` - ` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"` + `$CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"` > [!NOTE] > The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit WDAC policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other WDAC policies, update the variables accordingly. 2. Use [Merge-CIPolicy](https://docs.microsoft.com/powershell/module/configci/merge-cipolicy) to merge two policies and create a new WDAC policy: - ` Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy` + `Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy` 3. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy) to convert the merged WDAC policy to binary format: - ` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin ` + `ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin` Now that you have created a new WDAC policy, you can deploy the policy binary to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 960a7fb0ca..ab584cebd9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -36,13 +36,13 @@ To modify the policy rule options of an existing WDAC policy, use [Set-RuleOptio - To ensure that UMCI is enabled for a WDAC policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command: - ` Set-RuleOption -FilePath -Option 0` + `Set-RuleOption -FilePath -Option 0` Note that a policy that was created without the `-UserPEs` option is empty of user mode executables, that is, applications. If you enable UMCI (Option 0) for such a policy and then attempt to run an application, Windows Defender Application Control will see that the application is not on its list (which is empty of applications), and respond. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. To create a policy that includes user mode executables (applications), when you run `New-CIPolicy`, include the `-UserPEs` option. - To disable UMCI on an existing WDAC policy, delete rule option 0 by running the following command: - ` Set-RuleOption -FilePath -Option 0 -Delete` + `Set-RuleOption -FilePath -Option 0 -Delete` You can set several rule options within a WDAC policy. Table 2 describes each rule option. diff --git a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md index b00e9c0154..7f2c0b16d3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md +++ b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md @@ -43,11 +43,11 @@ If you do not have a code signing certificate, see the [Optional: Create a code 1. Initialize the variables that will be used: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + `$CIPolicyPath=$env:userprofile+"\Desktop\"` - ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - ` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` > [!NOTE] > This example uses the WDAC policy that you created in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. @@ -58,11 +58,11 @@ If you do not have a code signing certificate, see the [Optional: Create a code 4. Navigate to your desktop as the working directory: - ` cd $env:USERPROFILE\Desktop ` + `cd $env:USERPROFILE\Desktop` 5. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule) to add an update signer certificate to the WDAC policy: - ` Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` + `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` > [!NOTE] > \ should be the full path to the certificate that you exported in step 3. @@ -70,15 +70,15 @@ If you do not have a code signing certificate, see the [Optional: Create a code 6. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) to remove the unsigned policy rule option: - ` Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete` + `Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete` 7. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy) to convert the policy to binary format: - ` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` 8. Sign the WDAC policy by using SignTool.exe: - ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` + ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` > [!NOTE] > The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md index e481ff08f8..7cca116982 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -45,11 +45,11 @@ If you do not have a code signing certificate, see [Optional: Create a code sign 1. Initialize the variables that will be used: - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + `$CIPolicyPath=$env:userprofile+"\Desktop\"` - ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - ` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` > [!NOTE] > This example uses the WDAC policy that you created in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. @@ -60,11 +60,11 @@ If you do not have a code signing certificate, see [Optional: Create a code sign 4. Navigate to your desktop as the working directory: - ` cd $env:USERPROFILE\Desktop ` + `cd $env:USERPROFILE\Desktop` 5. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule) to add an update signer certificate to the WDAC policy: - ` Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` + `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` > [!NOTE] > *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. @@ -72,15 +72,15 @@ If you do not have a code signing certificate, see [Optional: Create a code sign 6. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) to remove the unsigned policy rule option: - ` Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete` + `Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete` 7. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy) to convert the policy to binary format: - ` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` 8. Sign the WDAC policy by using SignTool.exe: - ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` + ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` > [!NOTE] > The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index 559852d48c..91eec3f5c5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -98,3 +98,6 @@ Modern apps are not supported with the ISG heuristic and will need to be separat The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run. In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases. + +>[!NOTE] +> A rule that explicitly allows an application will take precedence over the ISG rule that does not allow it. In this scenario, this policy is not compatible with Intune, where there is no option to add rules to the template that enables ISG. In most circumstances you would need to build a custom WDAC policy, including ISG if desired. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index d4c6fd8591..1c2b670b16 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -29,7 +29,7 @@ A managed installer helps an IT admin balance security and manageability require ## How does a managed installer work? A managed installer uses a new rule collection in AppLocker to specify one or more executables that are trusted by the organization as an authorized source for application deployment. -Specifying an executable as a managed installer will cause Windows to tag files that are written from the executable’s process (or processes it launches) as having originated from a trusted installation authority. +Specifying an executable as a managed installer will cause Windows to tag files that are written from the executable’s process (or processes it launches) as having originated from a trusted installation authority. The Managed Installer rule collection is currently supported for AppLocker rules in Group Policy and in Configuration Manager, but not in the AppLocker CSP for OMA-URI policies. Once the IT administrator adds the Allow: Managed Installer option to a WDAC policy, the WDAC component will subsequently check for the presence of the origin information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the managed installer origin information.+ @@ -49,10 +49,11 @@ There are three primary steps to keep in mind: ### Specify managed installers using the Managed Installer rule collection in AppLocker policy The identity of the managed installer executable(s) is specified in an AppLocker policy in a Managed Installer rule collection. -Currently the AppLocker policy creation UI and cmdlets do not allow for directly specifying rules for the Managed Installer rule collection, however a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller". +Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO. An example of a valid Managed Installer rule collection is shown below. For more information about creating an AppLocker policy that includes a managed installer and configuring client devices, see [Simplify application whitelisting with Configuration Manager and Windows 10](https://cloudblogs.microsoft.com/enterprisemobility/2016/06/20/configmgr-as-a-managed-installer-with-win10/). +As mentioned above, the AppLocker CSP for OMA-URI policies does not currently support the Managed Installer rule collection or the Service Enforcement rule extensions mentioned below. ```code diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md index f6904fc6f0..fb335353dc 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md @@ -42,7 +42,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Win |-----------|------------------|-----------|-------| |Configure Windows Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:

**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.| |Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| -|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.

**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | +|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.

**Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | |Allow Persistence|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

**Disabled or not configured.** All user data within Application Guard is reset between sessions.

**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**
  1. Open a command-line program and navigate to Windows/System32.
  2. Type `wdagtool.exe cleanup`.
    The container environment is reset, retaining only the employee-generated data.
  3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`.
    The container environment is reset, including discarding all employee-generated data.
| |Turn on Windows Defender Application Guard in Enterprise Mode|Windows 10 Enterprise, 1709 or higher|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.

**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.| |Allow files to download to host operating system|Windows 10 Enterprise, 1803 or higher|Determines whether to save downloaded files to the host operating system from the Windows Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Windows Defender Application Guard container to the host operating system.

**Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.| @@ -50,3 +50,5 @@ These settings, located at **Computer Configuration\Administrative Templates\Win |Allow camera and microphone access in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Windows Defender Application Guard.|**Enabled.** Applications inside Windows Defender Application Guard are able to access the camera and microphone on the user's device.

**Important**
Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Windows Defender Application Guard are unable to access the camera and microphone on the user's device.| |Allow Windows Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Windows Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

**Disabled or not configured.** Certificates are not shared with Windows Defender Application Guard.| |Allow users to trust files that open in Windows Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.

**Disabled or not configured.** Users are unable to manually trust files and files continue to open in Windows Defender Application Guard.| + + diff --git a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md index 3792441270..7bd4873234 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md @@ -29,11 +29,11 @@ You can see how an employee would use standalone mode with Application Guard. 1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). -2. Restart the device, start Microsoft Edge, and then click **New Application Guard window** from the menu. +2. Restart the device, start Microsoft Edge, and then click **New Application Guard window** from the menu. ![New Application Guard window setting option](images/appguard-new-window.png) -3. Wait for Application Guard to set up the isolated environment. +3. Wait for Application Guard to set up the isolated environment. >[!NOTE] >Starting Application Guard too quickly after restarting the device might cause it to take a bit longer to load. However, subsequent starts should occur without any perceivable delays. @@ -108,13 +108,13 @@ You have the option to change each of these settings to work with your enterpris #### Copy and paste options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard clipboard settings**. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard clipboard settings**. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor clipboard options](images/appguard-gp-clipboard.png) -3. Choose how the clipboard works: +3. Choose how the clipboard works: - Copy and paste from the isolated session to the host PC @@ -122,7 +122,7 @@ You have the option to change each of these settings to work with your enterpris - Copy and paste both directions -4. Choose what can be copied: +4. Choose what can be copied: - **1.** Only text can be copied between the host PC and the isolated container. @@ -130,33 +130,33 @@ You have the option to change each of these settings to work with your enterpris - **3.** Both text and images can be copied between the host PC and the isolated container. -5. Click **OK**. +5. Click **OK**. #### Print options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard print** settings. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Configure Windows Defender Application Guard print** settings. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Print options](images/appguard-gp-print.png) -3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. +3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. 4. Click **OK**. #### Data persistence options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Data Persistence options](images/appguard-gp-persistence.png) -3. Open Microsoft Edge and browse to an untrusted, but safe URL. +3. Open Microsoft Edge and browse to an untrusted, but safe URL. The website opens in the isolated session. -4. Add the site to your **Favorites** list and then close the isolated session. +4. Add the site to your **Favorites** list and then close the isolated session. 5. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -171,29 +171,29 @@ You have the option to change each of these settings to work with your enterpris #### Download options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow files to download and save to the host operating system from Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow files to download and save to the host operating system from Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Download options](images/appguard-gp-download.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Download a file from Windows Defender Application Guard. +4. Download a file from Windows Defender Application Guard. -5. Check to see the file has been downloaded into This PC > Downloads > Untrusted files. +5. Check to see the file has been downloaded into This PC > Downloads > Untrusted files. #### Hardware acceleration options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor hardware acceleration options](images/appguard-gp-vgpu.png) -3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. +3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. -4. Assess the visual experience and battery performance. +4. Assess the visual experience and battery performance. **Applies to:** - Windows 10 Enterpise edition, version 1809 @@ -201,39 +201,39 @@ You have the option to change each of these settings to work with your enterpris #### File trust options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard** setting. -2. Click **Enabled**, set **Options** to 2, and click **OK**. +2. Click **Enabled**, set **Options** to 2, and click **OK**. ![Group Policy editor Download options](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Open a file in Edge, such an Office 365 file. +4. Open a file in Edge, such an Office 365 file. -5. Check to see that an antivirus scan completed before the file was opened. +5. Check to see that an antivirus scan completed before the file was opened. #### Camera and microphone options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard** setting. -2. Click **Enabled** and click **OK**. +2. Click **Enabled** and click **OK**. ![Group Policy editor Download options](images/appguard-gp-allow-camera-and-mic.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. -4. Open an application with video or audio capability in Edge. +4. Open an application with video or audio capability in Edge. -5. Check that the camera and microphone work as expected. +5. Check that the camera and microphone work as expected. #### Root certificate sharing options -1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device** setting. +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user's device** setting. -2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. +2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. ![Group Policy editor Download options](images/appguard-gp-allow-root-certificates.png) -3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. diff --git a/windows/security/threat-protection/windows-defender-atp/overview-secure-score.md b/windows/security/threat-protection/windows-defender-atp/overview-secure-score.md new file mode 100644 index 0000000000..7eed1f912d --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/overview-secure-score.md @@ -0,0 +1,82 @@ +--- +title: Overview of Secure score in Windows Defender Security Center +description: Expand your visibility into the overall security posture of your organization +keywords: secure score, security controls, improvement opportunities, security score over time, score, posture, baseline +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 09/03/2018 +--- + +# Overview of Secure score in Windows Defender Security Center +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. + +>[!IMPORTANT] +> This feature is available for machines on Windows 10, version 1703 or later. + + +The **Secure score dashboard** displays a snapshot of: +- Microsoft secure score +- Secure score over time +- Top recommendations +- Improvement opportunities + + +![Secure score dashboard](images/new-secure-score-dashboard.png) + +## Microsoft secure score +The Microsoft secure score tile is reflective of the sum of all the Windows Defender security controls that are configured according to the recommended baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings. + +![Image of Microsoft secure score tile](images/mss.png) + +Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar). + +The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/en-us/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess). + +In the example image, the total points for the Windows security controls and Office 365 add up to 602 points. + +You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md). + +## Secure score over time +You can track the progression of your organizational security posture over time using this tile. It displays the overall score in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture. The expected update schedule for Secure Score is about 24 hours. In some cases, depending of the size of the organization, number of computers and other factors, this update can take up to 72 hours. + +![Image of the security score over time tile](images/new-ssot.png) + +You can mouse over specific date points to see the total score for that security control is on a specific date. + + +## Top recommendations +Reflects specific actions you can take to significantly increase the security stance of your organization and how many points will be added to the secure score if you take the recommended action. + +![Top recommendations tile](images/top-recommendations.png) + +## Improvement opportunities +Improve your score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control. + +Clicking on the affected machines link at the top of the table takes you to the Machines list. The list is filtered to reflect the list of machines where improvements can be made. + + + +![Improvement opportunities](images/io.png) + + +Within the tile, you can click on each control to see the recommended optimizations. + +Clicking the link under the Misconfigured machines column opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice. + +## Related topic +- [Threat analytics](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +- [Threat analytics for Spectre and Meltdown](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 9d5715caa9..e78eb77ef5 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -114,6 +114,8 @@ This rule blocks the following file types from launching from email in Microsoft - Executable files (such as .exe, .dll, or .scr) - Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) SCCM name: Block executable content from email client and webmail @@ -126,6 +128,8 @@ This rule blocks Office apps from creating child processes. This includes Word, This is a typical malware behavior, especially malware that abuses Office as a vector, using VBA macros and exploit code to download and attempt to run additional payload. Some legitimate line-of-business applications might also use behaviors like this, including spawning a command prompt or using PowerShell to configure registry settings. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Office apps launching child processes SCCM name: Block Office application from creating child processes @@ -138,6 +142,8 @@ This rule prevents Office apps, including Word, Excel, and PowerPoint, from crea This rule targets a typical behavior where malware uses Office as a vector to break out of Office and save malicious components to disk, where they persist and survive a computer reboot. This rule prevents malicious code from being written to disk. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Office apps/macros creating executable content SCCM name: Block Office applications from creating executable content @@ -150,6 +156,8 @@ Attackers might attempt to use Office apps to migrate malicious code into other This rule applies to Word, Excel, and PowerPoint. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Office apps injecting code into other processes (no exceptions) SCCM name: Block Office applications from injecting code into other processes @@ -165,6 +173,8 @@ Malware written in JavaScript or VBS often acts as a downloader to fetch and lau >[!IMPORTANT] >File and folder exclusions don't apply to this attack surface reduction rule. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: js/vbs executing payload downloaded from Internet (no exceptions) SCCM name: Block JavaScript or VBScript from launching downloaded executable content @@ -175,6 +185,8 @@ GUID: D3E037E1-3EB8-44C8-A917-57927947596D Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. This rule detects suspicious properties within an obfuscated script. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Obfuscated js/vbs/ps/macro code SCCM name: Block execution of potentially obfuscated scripts. @@ -185,6 +197,8 @@ GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Office VBA provides the ability to use Win32 API calls, which malicious code can abuse. Most organizations don't use this functionality, but might still rely on using other macro capabilities. This rule allows you to prevent using Win32 APIs in VBA macros, which reduces the attack surface. +This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 + Intune name: Win32 imports from Office macro code SCCM name: Block Win32 API calls from Office macros @@ -205,6 +219,8 @@ This rule blocks the following file types from launching unless they either meet > >You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. SCCM name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria @@ -218,6 +234,8 @@ This rule provides an extra layer of protection against ransomware. It scans exe >[!NOTE] >You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Advanced ransomware protection SCCM name: Use advanced protection against ransomware @@ -230,6 +248,8 @@ Local Security Authority Subsystem Service (LSASS) authenticates users who log i >[!NOTE] >In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. + +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 Intune name: Flag credential stealing from the Windows local security authority subsystem @@ -247,6 +267,8 @@ This rule blocks processes through PsExec and WMI commands from running, to prev >[!WARNING] >Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [System Center Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Process creation from PSExec and WMI commands SCCM name: Not applicable @@ -260,6 +282,8 @@ With this rule, admins can prevent unsigned or untrusted executable files from r - Executable files (such as .exe, .dll, or .scr) - Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 + Intune name: Untrusted and unsigned processes that run from USB SCCM name: Block untrusted and unsigned processes that run from USB @@ -273,6 +297,8 @@ This rule prevents Outlook from creating child processes. It protects against so >[!NOTE] >This rule applies to Outlook and Outlook.com only. +This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019, SCCM CB 1810 + Intune name: Process creation from Office communication products (beta) SCCM name: Not yet available @@ -283,6 +309,8 @@ GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869 Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. This rule prevents attacks like this by blocking Adobe Reader from creating additional processes. +This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019, SCCM CB 1810 + Intune name: Process creation from Adobe Reader (beta) SCCM name: Not applicable diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index 6e52ff5447..1acfffd14f 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -105,7 +105,7 @@ An allowed application or service only has write access to a controlled folder a 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**. -3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** +3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** 4. Click **Add an allowed app** and follow the prompts to add apps. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md index 72894a0a5d..e3fd820ba9 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md @@ -50,7 +50,7 @@ You can [export these settings as an XML file](import-export-exploit-protection- 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. -3. Go to **Program settings** and choose the app you want to apply mitigations to: +3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: @@ -100,7 +100,7 @@ CFG will be enabled for *miles.exe*. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. -3. Go to **Program settings** and choose the app you want to apply mitigations to: +3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md index 3cd5fee197..0f4d7ee1dc 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -26,7 +26,7 @@ This can cause devices or software to malfunction and in rare cases may result i If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. >[!NOTE] ->HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*. +>HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*. AMD CPUs do not have MBE. >[!TIP] > "The Secure Kernel relies on the Mode-Based Execution Control (MBEC) feature, if present in hardware, which enhances the SLAT with a user/kernel executable bit, or the hypervisor’s software emulation of this feature, called Restricted User Mode (RUM)." Mark Russinovich and Alex Ionescu. Windows Internals 7th Edition book @@ -177,11 +177,14 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: -` Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` +`Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` > [!NOTE] > The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. +> [!NOTE] +> Mode Based Execution Control property will only be listed as available starting with Windows 10 version 1709. + The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. #### AvailableSecurityProperties @@ -275,9 +278,9 @@ C. If you experience a critical error during boot or your system is unstable aft ## How to turn off HVCI on the Windows 10 Fall Creators Update -1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity. -2. Restart the device. -3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. +1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity. +2. Restart the device. +3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. ## HVCI deployment in virtual machines diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md index 46cce510fa..61220879a8 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md @@ -44,7 +44,7 @@ You can set mitigations in audit mode for specific programs either by using the 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. -3. Go to **Program settings** and choose the app you want to apply mitigations to: +3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md index c9851d72d1..676188aa12 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md @@ -70,6 +70,9 @@ When you have configured exploit protection to your desired state (including bot Change `filename` to any name or location of your choosing. +Example command +**Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml** + > [!IMPORTANT] > When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration file. Ensure you place the file in a shared location. @@ -91,6 +94,10 @@ After importing, the settings will be instantly applied and can be reviewed in t Change `filename` to the location and name of the exploit protection XML file. +Example command +**Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml** + + >[!IMPORTANT] > >Ensure you import a configuration file that is created specifically for exploit protection. You cannot directly import an EMET configuration file, you must convert it first. @@ -151,6 +158,7 @@ You can use Group Policy to deploy the configuration you've created to multiple - C:\MitigationSettings\Config.XML - \\\Server\Share\Config.xml - https://localhost:8080/Config.xml + - C:\ExploitConfigfile.xml 8. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md index 1e2192cfb7..8163dafe10 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md @@ -24,5 +24,6 @@ manager: dansimp Memory integrity is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Memory integrity helps block many types of malware from running on computers that run Windows 10 and Windows Server 2016. - +> [!NOTE] +> For more information, see [Device protection in Windows Defender Security Center](https://support.microsoft.com/help/4096339/windows-10-device-protection-in-windows-defender-security-center). diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md index 6f2ca8462f..63963825e3 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md @@ -130,7 +130,7 @@ You can manually remove unwanted mitigations in Windows Security, or you can use Remove-All-SystemMitigations ``` -2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: +2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: ```xml diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md index 89c98507fe..dc0bab469f 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md @@ -20,7 +20,7 @@ manager: dansimp **Applies to** -- Windows 10, version 1709 and later +- Windows 10, version 1809 and above **Audience** @@ -54,13 +54,13 @@ This can only be done in Group Policy. >[!IMPORTANT] >### Requirements > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +>You must have Windows 10, version 1903. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > Notifications**. +5. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below the path would be **Windows components > Windows Defender Security Center > Notifications** 6. Open the **Hide non-critical notifications** setting and set it to **Enabled**. Click **OK**. @@ -76,13 +76,13 @@ This can only be done in Group Policy. >[!IMPORTANT] >### Requirements > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +>You must have Windows 10, version 1903. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > Notifications**. +5. Expand the tree to **Windows components > Windows Security > Notifications**. For Windows 10 version 1803 and below the path would be **Windows components > Windows Defender Security Center > Notifications** 6. Open the **Hide all notifications** setting and set it to **Enabled**. Click **OK**. diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 12253adde3..027d92a3b4 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -57,6 +57,8 @@ When Windows Defender SmartScreen warns or blocks an employee from a website, it ## Viewing Windows event logs for SmartScreen SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log in Event Viewer. +> [!NOTE] +> For information on how to use the Event Viewer, see [Windows Event Viewer](https://docs.microsoft.com/host-integration-server/core/windows-event-viewer1). |EventID | Description | | :---: | :---: | diff --git a/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md index e1cacdb8c6..1a5d115e8a 100644 --- a/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md @@ -93,7 +93,7 @@ All other endpoints that do not meet the previously stated criteria are consider **To configure a GPO that defines your intranet address space** -1. Open the Group Policy Management snap-in (gpmc.msc) and edit the Default Domain Policy. +1. Open the Group Policy Management snap-in (gpmc.msc), right click on the Group Policy you want to use to define your address space, and select **Edit**. 2. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**. diff --git a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md index 60e0c1e82c..fe043e036b 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md @@ -43,7 +43,7 @@ Microsoft recommends using [the rings methodology](https://docs.microsoft.com/wi |-------------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Account Lockout | Account Lockout Duration | 15 | The number of minutes a locked-out account remains locked out before automatically becoming unlocked. If an account lockout threshold is defined, the account lockout duration must be greater than or equal to the reset time. | | Account Lockout | Account Lockout Threshold | 10 | The number of failed logon attempts that causes a user account to be locked out. A locked-out account cannot be used until it is reset by an administrator or until the lockout duration for the account has expired. | -| Account Lockout | Reset account lockout conter after | 15 | The number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. | +| Account Lockout | Reset account lockout counter after | 15 | The number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts. | | Password Policy | Enforce password history | 24 | The number of unique new passwords that must be associated with a user account before an old password can be reused. | | Password Policy | Minimum password length | 14 | The least number of characters that a password for a user account may contain. | | Password Policy | Password must meet complexity requirements | Enabled | Determines whether passwords must meet complexity requirements:
1) Not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Neither check is case sensitive.
The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is less than three characters long, this check is skipped. The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed to not be included in the password. Tokens that are less than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password.
2) Contain characters from three of the following categories:
- Uppercase letters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
- Lowercase letters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
- Base 10 digits (0 through 9)
-Non-alphanumeric characters (special characters):
(~!@#$%^&*_-+=`\|\\(){}[]:;"'<>,.?/)
Currency symbols such as the Euro or British Pound are not counted as special characters for this policy setting.
- Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages. | diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md index fd0c3af5a7..824b53c0f6 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md @@ -40,7 +40,7 @@ This new security configuration framework, which we affectionately nickname the The security configuration framework divides configuration into Productivity Devices and Privileged Access Workstations. This document will focus on Productivity Devices (Levels 1, 2, and 3). -Microsoft’s current guidance on [Privileged Access Workstations](http://aka.ms/privsec) are part of the [Securing Privileged Access roadmap](http://aka.ms/privsec). +Microsoft’s current guidance on [Privileged Access Workstations](https://aka.ms/privsec) are part of the [Securing Privileged Access roadmap](https://aka.ms/privsec). Microsoft recommends reviewing and categorizing your devices, and then configuring them using the prescriptive guidance for that level. Level 1 should be considered the minimum baseline for an enterprise device, and Microsoft recommends increasing the protection based on both threat environment and risk appetite. diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md index f71dfffeea..8c38cd61c8 100644 --- a/windows/whats-new/contribute-to-a-topic.md +++ b/windows/whats-new/contribute-to-a-topic.md @@ -73,9 +73,9 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 9. Enter a title and description to let us know what’s in the request. -10. Scroll to the bottom of the page, and make sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. +10. Scroll to the bottom of the page, and make sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. -11. Click **Create pull request** again to actually submit your edits. +11. Click **Create pull request** again to actually submit your edits. 12. If you aren't a Microsoft employee, you need to [sign a Microsoft Contribution Licensing Agreement (CLA)](https://cla.microsoft.com/) before updating or adding to any Microsoft repositories. A bot running in GitHub checks whether you've signed the CLA - if not, you'll be prompted, in the pull request, to sign it. diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 6c9a323ecd..43bca2f54c 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -5,6 +5,7 @@ ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 keywords: ["What's new in Windows 10", "Windows 10"] ms.prod: w10 author: greg-lindsay +manager: laurawi ms.localizationpriority: high ms.topic: article --- diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index c89b8110a0..d90f6985d2 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay +manager: laurawi ms.localizationpriority: low ms.topic: article --- @@ -46,4 +47,4 @@ For detailed information about Windows 10 servicing, see [Overview of Windows as ## See Also [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
-[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. \ No newline at end of file +[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 61b20e6870..bd6b7f1df1 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay +manager: laurawi ms.localizationpriority: high ms.topic: article ---