mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge pull request #3271 from MicrosoftDocs/master
Publish 07/09/2020 3:38 PM
This commit is contained in:
Gary Moore
GitHub
commit
7a23ffc91d
@ -1725,14 +1725,14 @@ Valid values: 0–90
|
||||
<!--Description-->
|
||||
This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.
|
||||
|
||||
If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run.
|
||||
If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run.
|
||||
|
||||
If you enable this setting, catch-up scans for scheduled full scans will be disabled.
|
||||
If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned off.
|
||||
|
||||
Supported values:
|
||||
|
||||
- 0 - Disabled
|
||||
- 1 - Enabled (default)
|
||||
- 0 - Disabled (default)
|
||||
- 1 - Enabled
|
||||
|
||||
OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan
|
||||
|
||||
@ -1811,8 +1811,8 @@ If you disable or do not configure this setting, catch-up scans for scheduled qu
|
||||
|
||||
Supported values:
|
||||
|
||||
- 0 - Disabled
|
||||
- 1 - Enabled (default)
|
||||
- 0 - Disabled (default)
|
||||
- 1 - Enabled
|
||||
|
||||
OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan
|
||||
|
||||
|
||||
@ -1354,6 +1354,11 @@ ADMX Info:
|
||||
- GP ADMX file name: *DataCollection.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
- 0 (default) - Enable telemetry change notifications
|
||||
- 1 - Disable telemetry change notifications
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
@ -1409,7 +1414,7 @@ If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry
|
||||
If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings.
|
||||
|
||||
> [!Note]
|
||||
> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit.
|
||||
> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's acceptable level of data disclosure.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
@ -1421,6 +1426,11 @@ ADMX Info:
|
||||
- GP ADMX file name: *DataCollection.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
- 0 (default) - Enable Telemetry opt-in Settings
|
||||
- 1 - Disable Telemetry opt-in Settings
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
@ -17,7 +17,7 @@ manager: dansimp
|
||||
|
||||
# Use Windows Configuration Designer to configure Windows 10 Mobile devices
|
||||
|
||||
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using provisioning packages, ayou can easily specify desired configuration, settings, and information required to enroll the devices into management, and then apply that configuration to target devices in a matter of minutes.
|
||||
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using provisioning packages, you can easily specify desired configuration, settings, and information required to enroll the devices into management, and then apply that configuration to target devices in a matter of minutes.
|
||||
|
||||
A provisioning package (.ppkg) is a container for a collection of configuration settings. Using Windows Configuration Designer, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
||||
|
||||
|
||||
@ -131,7 +131,7 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection
|
||||
- 0 = not set
|
||||
- 1 = AD Site
|
||||
- 2 = Authenticated domain SID
|
||||
- 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID)
|
||||
- 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 235 and use the returned GUID value as the Group ID)
|
||||
- 4 = DNS Suffix
|
||||
- 5 = Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5.
|
||||
|
||||
|
||||
@ -570,6 +570,7 @@
|
||||
###### [Vulnerability]()
|
||||
####### [Vulnerability methods and properties](microsoft-defender-atp/vulnerability.md)
|
||||
####### [List vulnerabilities](microsoft-defender-atp/get-all-vulnerabilities.md)
|
||||
####### [List vulnerabilities by Machine and Software](microsoft-defender-atp/get-all-vulnerabilities-by-machines.md)
|
||||
####### [Get vulnerability by Id](microsoft-defender-atp/get-vulnerability-by-id.md)
|
||||
####### [List machines by vulnerability](microsoft-defender-atp/get-machines-by-vulnerability.md)
|
||||
|
||||
|
||||
@ -102,19 +102,21 @@ See [Netsh Command Syntax, Contexts, and Formatting](https://docs.microsoft.com/
|
||||
|
||||
## Enable access to Microsoft Defender ATP service URLs in the proxy server
|
||||
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed below to the allowed domains list.
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed in the downloadable sheet to the allowed domains list.
|
||||
|
||||
|
||||
|
||||
|**Item**|**Description**|
|
||||
|:-----|:-----|
|
||||
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)<br/> [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) | The spreadsheet provides specific DNS records for service locations, geographic locations, and OS.
|
||||
|
||||
|
||||
If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed below from HTTPS scanning.
|
||||
|
||||
> [!NOTE]
|
||||
> settings-win.data.microsoft.com is only needed if you have Windows 10 devices running version 1803 or earlier.<br>
|
||||
> URLs that include v20 in them are only needed if you have Windows 10 devices running version 1803 or later. For example, ```us-v20.events.data.microsoft.com``` is needed for a Windows 10 device running version 1803 or later and onboarded to US Data Storage region.
|
||||
|
||||
Service location | Microsoft.com DNS record
|
||||
-|-
|
||||
Common URLs for all locations | ```crl.microsoft.com/pki/crl/*```<br> ```ctldl.windowsupdate.com``` <br>```www.microsoft.com/pkiops/*```<br>```events.data.microsoft.com```<br>```notify.windows.com```<br> ```settings-win.data.microsoft.com```
|
||||
European Union | ```eu.vortex-win.data.microsoft.com``` <br> ```eu-v20.events.data.microsoft.com``` <br> ```usseu1northprod.blob.core.windows.net``` <br>```usseu1westprod.blob.core.windows.net``` <br> ```winatp-gw-neu.microsoft.com``` <br> ```winatp-gw-weu.microsoft.com``` <br>```wseu1northprod.blob.core.windows.net``` <br>```wseu1westprod.blob.core.windows.net``` <br>```automatedirstrprdweu.blob.core.windows.net``` <br>```automatedirstrprdneu.blob.core.windows.net```
|
||||
United Kingdom | ```uk.vortex-win.data.microsoft.com``` <br>```uk-v20.events.data.microsoft.com``` <br>```ussuk1southprod.blob.core.windows.net``` <br>```ussuk1westprod.blob.core.windows.net``` <br>```winatp-gw-uks.microsoft.com``` <br>```winatp-gw-ukw.microsoft.com``` <br>```wsuk1southprod.blob.core.windows.net``` <br>```wsuk1westprod.blob.core.windows.net``` <br>```automatedirstrprduks.blob.core.windows.net``` <br>```automatedirstrprdukw.blob.core.windows.net```
|
||||
United States | ```us.vortex-win.data.microsoft.com``` <br> ```ussus1eastprod.blob.core.windows.net``` <br> ```ussus1westprod.blob.core.windows.net``` <br> ```ussus2eastprod.blob.core.windows.net``` <br> ```ussus2westprod.blob.core.windows.net``` <br> ```ussus3eastprod.blob.core.windows.net``` <br> ```ussus3westprod.blob.core.windows.net``` <br> ```ussus4eastprod.blob.core.windows.net``` <br> ```ussus4westprod.blob.core.windows.net``` <br> ```us-v20.events.data.microsoft.com``` <br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com``` <br> ```wsus1eastprod.blob.core.windows.net``` <br> ```wsus1westprod.blob.core.windows.net``` <br> ```wsus2eastprod.blob.core.windows.net``` <br> ```wsus2westprod.blob.core.windows.net``` <br> ```automatedirstrprdcus.blob.core.windows.net``` <br> ```automatedirstrprdeus.blob.core.windows.net```
|
||||
|
||||
> [!NOTE]
|
||||
> If you are using Microsoft Defender Antivirus in your environment, please refer to the following article for details on allowing connections to the Microsoft Defender Antivirus cloud service: https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus
|
||||
|
||||
Binary file not shown.
@ -0,0 +1,104 @@
|
||||
---
|
||||
title: Get all vulnerabilities by Machine and Software
|
||||
description: Retrieves a list of all the vulnerabilities affecting the organization by Machine and Software
|
||||
keywords: apis, graph api, supported apis, get, vulnerability information, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# List vulnerabilities by Machine and Software
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a list of all the vulnerabilities affecting the organization per [Machine](machine.md) and [Software](software.md).
|
||||
<br>If the vulnerability has a fixing KB, it will appear in the response.
|
||||
<br>Supports [OData V4 queries](https://www.odata.org/documentation/).
|
||||
<br>The OData ```$filter``` is supported on all properties.
|
||||
|
||||
>[!Tip]
|
||||
>This is great API for [Power BI integration](api-power-bi.md).
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Vulnerability.Read.All | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
Delegated (work or school account) | Vulnerability.Read | 'Read Threat and Vulnerability Management vulnerability information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/vulnerabilities/machinesVulnerabilities
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK with the list of vulnerabilities in the body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/vulnerabilities/machinesVulnerabilities
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api-us.securitycenter.windows.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicAssetVulnerabilityDto)",
|
||||
"value": [
|
||||
{
|
||||
"id": "5afa3afc92a7c63d4b70129e0a6f33f63a427e21-_-CVE-2020-6494-_-microsoft-_-edge_chromium-based-_-81.0.416.77-_-",
|
||||
"cveId": "CVE-2020-6494",
|
||||
"machineId": "5afa3afc92a7c63d4b70129e0a6f33f63a427e21",
|
||||
"fixingKbId": null,
|
||||
"productName": "edge_chromium-based",
|
||||
"productVendor": "microsoft",
|
||||
"productVersion": "81.0.416.77",
|
||||
"severity": "Low"
|
||||
},
|
||||
{
|
||||
"id": "7a704e17d1c2977c0e7b665fb18ae6e1fe7f3283-_-CVE-2016-3348-_-microsoft-_-windows_server_2012_r2-_-6.3.9600.19728-_-3185911",
|
||||
"cveId": "CVE-2016-3348",
|
||||
"machineId": "7a704e17d1c2977c0e7b665fb18ae6e1fe7f3283",
|
||||
"fixingKbId": "3185911",
|
||||
"productName": "windows_server_2012_r2",
|
||||
"productVendor": "microsoft",
|
||||
"productVersion": "6.3.9600.19728",
|
||||
"severity": "Low"
|
||||
},
|
||||
...
|
||||
]
|
||||
|
||||
}
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
|
||||
- [Vulnerabilities in your organization](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses)
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 64 KiB |
@ -136,4 +136,4 @@ Integrate Microsoft Defender Advanced Threat Protection into your existing workf
|
||||
|
||||
|
||||
## Related topic
|
||||
[Microsoft Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats)
|
||||
[Microsoft Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/microsoft-defender-atps-antivirus-capabilities-boost-malware-protection)
|
||||
|
||||
@ -27,7 +27,7 @@ ms.topic: conceptual
|
||||
>
|
||||
> As with any pre-release solution, remember to exercise caution when determining the target population for your deployments.
|
||||
>
|
||||
> If you have preview features turned on in the Microsoft Defender Security Center, you should be able to access the Linux onboarding page immediately. If you have not yet opted into previews, we encourage you to [turn on preview features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview) in the Microsoft Defender Security Center today.
|
||||
> If you have preview features turned on in the Microsoft Defender Security Center, you should be able to access the Android onboarding page immediately. If you have not yet opted into previews, we encourage you to [turn on preview features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview) in the Microsoft Defender Security Center today.
|
||||
|
||||
This topic describes how to install, configure, update, and use Microsoft Defender ATP for Android.
|
||||
|
||||
|
||||
@ -89,14 +89,15 @@ After you've enabled the service, you may need to configure your network or fire
|
||||
|
||||
### Network connections
|
||||
|
||||
The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. If there are, you may need to create an *allow* rule specifically for them.
|
||||
The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. If there are, you may need to create an *allow* rule specifically for them.
|
||||
|
||||
|
||||
|
||||
|**Item**|**Description**|
|
||||
|:-----|:-----|
|
||||
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)<br/> [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) | The spreadsheet provides specific DNS records for service locations, geographic locations, and OS.
|
||||
|
||||
|
||||
| Service location | DNS record |
|
||||
| ---------------------------------------- | ----------------------- |
|
||||
| Common URLs for all locations | x.cp.wd.microsoft.com <br/> cdn.x.cp.wd.microsoft.com <br/> eu-cdn.x.cp.wd.microsoft.com <br/> wu-cdn.x.cp.wd.microsoft.com <br/> officecdn-microsoft-com.akamaized.net <br/> crl.microsoft.com <br/> events.data.microsoft.com |
|
||||
| European Union | europe.x.cp.wd.microsoft.com <br/> eu-v20.events.data.microsoft.com <br/> usseu1northprod.blob.core.windows.net <br/> usseu1westprod.blob.core.windows.net |
|
||||
| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com <br/> uk-v20.events.data.microsoft.com <br/> ussuk1southprod.blob.core.windows.net <br/> ussuk1westprod.blob.core.windows.net |
|
||||
| United States | unitedstates.x.cp.wd.microsoft.com <br/> us-v20.events.data.microsoft.com <br/> ussus1eastprod.blob.core.windows.net <br/> ussus1westprod.blob.core.windows.net |
|
||||
|
||||
> [!NOTE]
|
||||
> For a more specific URL list, see [Configure proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
@ -69,14 +69,15 @@ After you've enabled the service, you may need to configure your network or fire
|
||||
|
||||
### Network connections
|
||||
|
||||
The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them.
|
||||
The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them.
|
||||
|
||||
|
||||
|
||||
|**Item**|**Description**|
|
||||
|:-----|:-----|
|
||||
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)<br/> [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) | The spreadsheet provides specific DNS records for service locations, geographic locations, and OS.
|
||||
|
||||
|
||||
| Service location | DNS record |
|
||||
| ---------------------------------------- | ----------------------- |
|
||||
| Common URLs for all locations | x.cp.wd.microsoft.com <br/> cdn.x.cp.wd.microsoft.com <br/> eu-cdn.x.cp.wd.microsoft.com <br/> wu-cdn.x.cp.wd.microsoft.com <br/> officecdn-microsoft-com.akamaized.net <br/> crl.microsoft.com <br/> events.data.microsoft.com |
|
||||
| European Union | europe.x.cp.wd.microsoft.com <br/> eu-v20.events.data.microsoft.com <br/> usseu1northprod.blob.core.windows.net <br/> usseu1westprod.blob.core.windows.net <br/> winatp-gw-weu.microsoft.com <br/> winatp-gw-neu.microsoft.com |
|
||||
| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com <br/> uk-v20.events.data.microsoft.com <br/> ussuk1southprod.blob.core.windows.net <br/> ussuk1westprod.blob.core.windows.net <br/> winatp-gw-ukw.microsoft.com <br/> winatp-gw-uks.microsoft.com |
|
||||
| United States | unitedstates.x.cp.wd.microsoft.com <br/> us-v20.events.data.microsoft.com <br/> ussus1eastprod.blob.core.windows.net <br/> ussus1westprod.blob.core.windows.net <br/> winatp-gw-cus.microsoft.com <br/> winatp-gw-eus.microsoft.com |
|
||||
|
||||
Microsoft Defender ATP can discover a proxy server by using the following discovery methods:
|
||||
- Proxy auto-config (PAC)
|
||||
|
||||
@ -43,6 +43,9 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr
|
||||
> [!NOTE]
|
||||
> Eligible Licensed Users may use Microsoft Defender Advanced Threat Protection on up to five concurrent devices.
|
||||
|
||||
|
||||
Microsoft Defender Advanced Threat Protection is also available for purchase from a Cloud Solution Provider (CSP).
|
||||
|
||||
Microsoft Defender Advanced Threat Protection, on Windows Server, requires one of the following licensing options:
|
||||
|
||||
- [Azure Security Center Standard plan](https://docs.microsoft.com/azure/security-center/security-center-pricing) (per node)
|
||||
@ -89,7 +92,7 @@ Access to Microsoft Defender ATP is done through a browser, supporting the follo
|
||||
|
||||
Devices on your network must be running one of these editions.
|
||||
|
||||
The hardware requirements for Microsoft Defender ATP on devices is the same as those for the supported editions.
|
||||
The hardware requirements for Microsoft Defender ATP on devices are the same for the supported editions.
|
||||
|
||||
> [!NOTE]
|
||||
> Machines running mobile versions of Windows are not supported.
|
||||
@ -122,8 +125,8 @@ When you run the onboarding wizard for the first time, you must choose where you
|
||||
> [!NOTE]
|
||||
> Microsoft Defender ATP doesn't require any specific diagnostic level as long as it's enabled.
|
||||
|
||||
You must ensure that the diagnostic data service is enabled on all the devices in your organization.
|
||||
By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them.
|
||||
Make sure that the diagnostic data service is enabled on all the devices in your organization.
|
||||
By default, this service is enabled. It's good practice to check to ensure that you'll get sensor data from them.
|
||||
|
||||
**Use the command line to check the Windows 10 diagnostic data service startup type**:
|
||||
|
||||
@ -143,7 +146,8 @@ By default, this service is enabled, but it's good practice to check to ensu
|
||||
|
||||
|
||||
|
||||
If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start.
|
||||
|
||||
You'll need to set the service to automatically start if the **START_TYPE** is not set to **AUTO_START**.
|
||||
|
||||
|
||||
**Use the command line to set the Windows 10 diagnostic data service to automatically start:**
|
||||
@ -170,7 +174,7 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the
|
||||
#### Internet connectivity
|
||||
Internet connectivity on devices is required either directly or through proxy.
|
||||
|
||||
The Microsoft Defender ATP sensor can utilize a daily average bandwidth of 5MB to communicate with the Microsoft Defender ATP cloud service and report cyber data. One-off activities such as file uploads and investigation package collection are not included in this daily average bandwidth.
|
||||
The Microsoft Defender ATP sensor can utilize a daily average bandwidth of 5 MB to communicate with the Microsoft Defender ATP cloud service and report cyber data. One-off activities such as file uploads and investigation package collection are not included in this daily average bandwidth.
|
||||
|
||||
For more information on additional proxy configuration settings, see [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md).
|
||||
|
||||
@ -180,9 +184,11 @@ Before you onboard devices, the diagnostic data service must be enabled. The ser
|
||||
## Microsoft Defender Antivirus configuration requirement
|
||||
The Microsoft Defender ATP agent depends on the ability of Microsoft Defender Antivirus to scan files and provide information about them.
|
||||
|
||||
You must configure Security intelligence updates on the Microsoft Defender ATP devices whether Microsoft Defender Antivirus is the active antimalware or not. For more information, see [Manage Microsoft Defender Antivirus updates and apply baselines](../microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md).
|
||||
Configure Security intelligence updates on the Microsoft Defender ATP devices whether Microsoft Defender Antivirus is the active antimalware or not. For more information, see [Manage Microsoft Defender Antivirus updates and apply baselines](../microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md).
|
||||
|
||||
When Microsoft Defender Antivirus is not the active antimalware in your organization and you use the Microsoft Defender ATP service, Microsoft Defender Antivirus goes on passive mode. If your organization has disabled Microsoft Defender Antivirus through group policy or other methods, devices that are onboarded to Microsoft Defender ATP must be excluded from this group policy.
|
||||
When Microsoft Defender Antivirus is not the active antimalware in your organization and you use the Microsoft Defender ATP service, Microsoft Defender Antivirus goes on passive mode.
|
||||
|
||||
If your organization has turned off Microsoft Defender Antivirus through group policy or other methods, devices that are onboarded must be excluded from this group policy.
|
||||
|
||||
If you are onboarding servers and Microsoft Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Microsoft Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Onboard servers](configure-server-endpoints.md).
|
||||
|
||||
|
||||
@ -32,9 +32,6 @@ ms.topic: article
|
||||
|
||||
Microsoft Defender ATP extends support to include down-level operating systems, providing advanced attack detection and investigation capabilities on supported Windows versions.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This capability is currently in preview. You'll need to turn on the preview features to take advantage of this feature. For more information, see [Preview features](preview.md).
|
||||
|
||||
To onboard down-level Windows client endpoints to Microsoft Defender ATP, you'll need to:
|
||||
- Configure and update System Center Endpoint Protection clients.
|
||||
- Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP as instructed below.
|
||||
|
||||
@ -228,16 +228,15 @@ is configured on these devices.
|
||||
URLs that include v20 in them are only needed if you have Windows 10, version
|
||||
1803 or later devices. For example, ```us-v20.events.data.microsoft.com``` is only
|
||||
needed if the device is on Windows 10, version 1803 or later.
|
||||
|
||||
|
||||
Service location | Microsoft.com DNS record
|
||||
-|-
|
||||
Common URLs for all locations | ```crl.microsoft.com/pki/crl/*```<br> ```ctldl.windowsupdate.com``` <br>```www.microsoft.com/pkiops/*```<br>```events.data.microsoft.com```<br>```notify.windows.com```<br> ```settings-win.data.microsoft.com```
|
||||
European Union | ```eu.vortex-win.data.microsoft.com``` <br> ```eu-v20.events.data.microsoft.com``` <br> ```usseu1northprod.blob.core.windows.net``` <br>```usseu1westprod.blob.core.windows.net``` <br> ```winatp-gw-neu.microsoft.com``` <br> ```winatp-gw-weu.microsoft.com``` <br>```wseu1northprod.blob.core.windows.net``` <br>```wseu1westprod.blob.core.windows.net``` <br>```automatedirstrprdweu.blob.core.windows.net``` <br>```automatedirstrprdneu.blob.core.windows.net```
|
||||
United Kingdom | ```uk.vortex-win.data.microsoft.com``` <br>```uk-v20.events.data.microsoft.com``` <br>```ussuk1southprod.blob.core.windows.net``` <br>```ussuk1westprod.blob.core.windows.net``` <br>```winatp-gw-uks.microsoft.com``` <br>```winatp-gw-ukw.microsoft.com``` <br>```wsuk1southprod.blob.core.windows.net``` <br>```wsuk1westprod.blob.core.windows.net``` <br>```automatedirstrprduks.blob.core.windows.net``` <br>```automatedirstrprdukw.blob.core.windows.net```
|
||||
United States | ```us.vortex-win.data.microsoft.com``` <br> ```ussus1eastprod.blob.core.windows.net``` <br> ```ussus1westprod.blob.core.windows.net``` <br> ```ussus2eastprod.blob.core.windows.net``` <br> ```ussus2westprod.blob.core.windows.net``` <br> ```ussus3eastprod.blob.core.windows.net``` <br> ```ussus3westprod.blob.core.windows.net``` <br> ```ussus4eastprod.blob.core.windows.net``` <br> ```ussus4westprod.blob.core.windows.net``` <br> ```us-v20.events.data.microsoft.com``` <br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com``` <br> ```wsus1eastprod.blob.core.windows.net``` <br> ```wsus1westprod.blob.core.windows.net``` <br> ```wsus2eastprod.blob.core.windows.net``` <br> ```wsus2westprod.blob.core.windows.net``` <br> ```automatedirstrprdcus.blob.core.windows.net``` <br> ```automatedirstrprdeus.blob.core.windows.net```
|
||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the listed URLs.
|
||||
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
|**Item**|**Description**|
|
||||
|:-----|:-----|
|
||||
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)<br/> [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) | The spreadsheet provides specific DNS records for service locations, geographic locations, and OS.
|
||||
|
||||
|
||||
### Microsoft Defender ATP service backend IP range
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user