From d7b795456578bdb84e7256de8b9cfc74b2426d89 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Wed, 19 Jan 2022 14:15:38 -0700 Subject: [PATCH 1/9] Update waas-delivery-optimization.md - Update Bypass version note - Add details to 'behind the NAT' for LAN default option - Update 'NAT' to 'None' in Restrict Peer mode - Add RFC link for DNS-SD --- windows/deployment/update/waas-delivery-optimization.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 7a22bcf291..6fa98d31a6 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -38,13 +38,13 @@ For information about setting up Delivery Optimization, including tips for the b ## New in Windows 10, version 20H2 and Windows 11 -- New peer selection options: Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)." +- New peer selection options: Currently the available options include: 0 = None, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)." - Local Peer Discovery: a new option for **Restrict Peer Selection By** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization will restrict peer selection to peers that are locally discovered (using DNS-SD). If you also enabled Group mode, Delivery Optimization will connect to locally discovered peers that are also part of the same group (that is, those which have the same Group ID). > [!NOTE] -> The Local Peer Discovery (DNS-SD) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](/windows/deployment/update/waas-delivery-optimization-reference). +> The Local Peer Discovery (DNS-SD, [RFC 6763](https://datatracker.ietf.org/doc/html/rfc6763)) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](/windows/deployment/update/waas-delivery-optimization-reference). -- Starting with Windows 10, version 2006 (and in Windows 11), the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used. +- Starting with Windows 11, the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used. ## Requirements @@ -93,7 +93,7 @@ The following table lists the minimum Windows 10 version that supports Delivery -In Windows client Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. +In Windows client Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT (which includes either Ethernet or WiFi), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. For more information, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md). From ee9ea1c8450dfc67f4dcf7c9f059e8224e74681b Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Thu, 20 Jan 2022 09:47:36 +0100 Subject: [PATCH 2/9] add detail this also logs event 4625 We may have customers seeing event 4625 as additional hint the task failed. --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 1dae9e49d5..a27265135f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -33,7 +33,7 @@ The following known issue has been fixed in the [Cumulative Security Update for Failure occurred in ‘LogonUserExEx’.
User Action: Ensure the credentials for the task are correctly specified.
Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect)." -- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. For example: +- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You get a similar user name in a user logon failure event 4525 wiith error 0xC0000064 on the machine itself. For example: > Log Name: Microsoft-Windows-NTLM/Operational Source: Microsoft-Windows-Security-Netlogon Event ID: 8004 From 1467fa34a9401f106fcf8a7695dbc7b85bdd4a29 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 20 Jan 2022 17:56:18 +0530 Subject: [PATCH 3/9] added windows 11 as per user feedback #10296 , so I added **Windows 11** in the link and in this article --- .../threat-protection/intelligence/safety-scanner-download.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index 64d069d398..9a62420e91 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -35,11 +35,11 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from - Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download. -- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). +- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 11, Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). ## System requirements -Safety Scanner helps remove malicious software from computers running Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. Please refer to the [Microsoft Lifecycle Policy](/lifecycle/). +Safety Scanner helps remove malicious software from computers running Windows 11, Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. Please refer to the [Microsoft Lifecycle Policy](/lifecycle/). ## How to run a scan From d945ab9ddfefae66a02fdec51e29ad864bd2302e Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 21 Jan 2022 13:40:07 +0530 Subject: [PATCH 4/9] Update windows/security/threat-protection/intelligence/safety-scanner-download.md Accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../threat-protection/intelligence/safety-scanner-download.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index 9a62420e91..85cc05d428 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -39,7 +39,7 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from ## System requirements -Safety Scanner helps remove malicious software from computers running Windows 11, Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. Please refer to the [Microsoft Lifecycle Policy](/lifecycle/). +Safety Scanner helps remove malicious software from computers running Windows 11, Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. For details, refer to the [Microsoft Lifecycle Policy](/lifecycle/). ## How to run a scan From 7711f967baeb6a2ab4f62b30d87b5381b3105a55 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 21 Jan 2022 13:40:33 +0530 Subject: [PATCH 5/9] Update windows/security/threat-protection/intelligence/safety-scanner-download.md Accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../threat-protection/intelligence/safety-scanner-download.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index 85cc05d428..12392ecd4f 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -35,7 +35,7 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from - Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download. -- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 11, Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). +- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 11, Windows 10, and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). ## System requirements From 177c01c8291eb3cc7c35fb2232c6c9de729745d3 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 24 Jan 2022 17:07:01 +0500 Subject: [PATCH 6/9] Addition to note As the policy needs to have Windows 10 ver 1803 or later. Or The ADMX template file needs to be updated. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/9726 --- .../wdsc-device-security.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index 8526440bc9..8bb0a730d3 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -33,10 +33,8 @@ You can choose to hide the entire section by using Group Policy. The section wil This can only be done in Group Policy. ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. @@ -56,10 +54,8 @@ This can only be done in Group Policy. ## Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. ->[!IMPORTANT] ->### Requirements -> ->You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> [!IMPORTANT] +> You must have Windows 10, version 1809 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. @@ -86,6 +82,8 @@ If you don't want users to see the recommendation to update TPM firmware, you ca ## Disable Memory integrity switch If you don't want users to be able to change the Hypervisor Control Integrity (HVCI), or memory integrity, setting on their computers, you can disable the **Memory integrity** switch. +> [!IMPORTANT] +> You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. @@ -95,4 +93,4 @@ If you don't want users to be able to change the Hypervisor Control Integrity (H 4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Click **OK**. -5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). \ No newline at end of file +5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). From d7c71a63c328ac296f0d1847b93ed0518da74c67 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 24 Jan 2022 09:29:24 -0800 Subject: [PATCH 7/9] Update credential-guard-known-issues.md --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index a27265135f..ef9971f738 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -12,7 +12,7 @@ ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.date: 08/17/2017 +ms.date: 01/24/2022 ms.reviewer: --- From 9202efabd5af60f8081d15869d745f0f383ef101 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 24 Jan 2022 09:29:45 -0800 Subject: [PATCH 8/9] Update windows/security/identity-protection/credential-guard/credential-guard-known-issues.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index ef9971f738..0f5e251a7f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -33,7 +33,7 @@ The following known issue has been fixed in the [Cumulative Security Update for Failure occurred in ‘LogonUserExEx’.
User Action: Ensure the credentials for the task are correctly specified.
Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect)." -- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You get a similar user name in a user logon failure event 4525 wiith error 0xC0000064 on the machine itself. For example: +- When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4525 with error 0xC0000064 on the machine itself. For example: > Log Name: Microsoft-Windows-NTLM/Operational Source: Microsoft-Windows-Security-Netlogon Event ID: 8004 From 66053a7cea70b3817a25105a292c890655a96c3e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 24 Jan 2022 09:36:27 -0800 Subject: [PATCH 9/9] Update wdsc-device-security.md --- .../wdsc-device-security.md | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index 8bb0a730d3..547b17ac29 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -29,20 +29,18 @@ You can choose to hide the section from users of the machine. This can be useful ## Hide the Device security section -You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app. - -This can only be done in Group Policy. +You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app. You can hide the device security section by using Group Policy only. > [!IMPORTANT] > You must have Windows 10, version 1803 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Hide the Device security area** setting and set it to **Enabled**. Click **OK**. +4. Open the **Hide the Device security area** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). @@ -59,11 +57,11 @@ If you don't want users to be able to click the **Clear TPM** button in the Wind 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Click **OK**. +4. Open the **Disable the Clear TPM button** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). @@ -72,11 +70,11 @@ If you don't want users to see the recommendation to update TPM firmware, you ca 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Click **OK**. +4. Open the **Hide the TPM Firmware Update recommendation** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). @@ -87,10 +85,10 @@ If you don't want users to be able to change the Hypervisor Control Integrity (H 1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and then select **Administrative templates**. -3. Expand the tree to **Windows components > Windows Security > Device security**. +3. Expand the tree to **Windows components** > **Windows Security** > **Device security**. -4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Click **OK**. +4. Open the **Disable Memory integrity switch** setting and set it to **Enabled**. Select **OK**. 5. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy).