mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 10:23:37 +00:00
Merge branch 'master' into MDBranch20H2LocalUsersAndGroups
This commit is contained in:
ManikaDhiman
@ -22,13 +22,10 @@ ms.topic: article
|
||||
|
||||
- Windows 10
|
||||
|
||||
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/user-help/device-management-azuread-joined-devices-setup).
|
||||
From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/user-help/device-management-azuread-joined-devices-setup). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics).
|
||||
|
||||
|
||||
|
||||
> [!TIP]
|
||||
> Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session.](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics)
|
||||
|
||||
## Set up
|
||||
|
||||
- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 are not supported.
|
||||
@ -37,36 +34,39 @@ From its release, Windows 10 has supported remote connections to PCs joined to A
|
||||
Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you are using to connect to the remote PC.
|
||||
|
||||
- On the PC you want to connect to:
|
||||
|
||||
1. Open system properties for the remote PC.
|
||||
|
||||
2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users to connect to the PC, you must allow remote connections for the local **Authenticated Users** group. Click **Select Users**.
|
||||
3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Click **Select Users -> Add** and enter the name of the user or group.
|
||||
|
||||
> [!NOTE]
|
||||
> You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once, and then running the following PowerShell cmdlet:
|
||||
> ```PowerShell
|
||||
> net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"
|
||||
> ```
|
||||
> where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD.
|
||||
>
|
||||
> This command only works for AADJ device users already added to any of the local groups (administrators).
|
||||
> Otherwise this command throws the below error. For example:
|
||||
> - for cloud only user: "There is no such global user or group : *name*"
|
||||
> - for synced user: "There is no such global user or group : *name*" </br>
|
||||
>
|
||||
> In Windows 10, version 1709, the user does not have to sign in to the remote device first.
|
||||
>
|
||||
> In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
> [!NOTE]
|
||||
> You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once, and then running the following PowerShell cmdlet:
|
||||
> ```powershell
|
||||
> net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"
|
||||
> ```
|
||||
> where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD.
|
||||
>
|
||||
> This command only works for AADJ device users already added to any of the local groups (administrators).
|
||||
> Otherwise this command throws the below error. For example:
|
||||
> - for cloud only user: "There is no such global user or group : *name*"
|
||||
> - for synced user: "There is no such global user or group : *name*" </br>
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1709, the user does not have to sign in to the remote device first.
|
||||
>
|
||||
> In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.
|
||||
|
||||
4. Click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC.
|
||||
|
||||
4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC.
|
||||
> [!TIP]
|
||||
> When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
|
||||
> [!TIP]
|
||||
> When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant.
|
||||
|
||||
> [!Note]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
> [!Note]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
|
||||
## Supported configurations
|
||||
|
||||
|
||||
@ -308,6 +308,7 @@
|
||||
#### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md)
|
||||
#### [WindowsLogon](policy-csp-windowslogon.md)
|
||||
#### [WindowsPowerShell](policy-csp-windowspowershell.md)
|
||||
#### [WindowsSandbox](policy-csp-windowssandbox.md)
|
||||
#### [WirelessDisplay](policy-csp-wirelessdisplay.md)
|
||||
### [PolicyManager CSP](policymanager-csp.md)
|
||||
### [Provisioning CSP](provisioning-csp.md)
|
||||
|
||||
@ -5575,6 +5575,29 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### WindowsSandbox policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowaudioinput" id="windowssandbox-allowaudioinput">WindowsSandbox/AllowAudioInput</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection" id="windowssandbox-allowclipboardredirection">WindowsSandbox/AllowClipboardRedirection</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowssandbox.md#windowssandbox-allownetworking" id="windowssandbox-allownetworking">WindowsSandbox/AllowNetworking</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection" id="windowssandbox-allowprinterredirection">WindowsSandbox/AllowPrinterRedirection</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowvgpu" id="windowssandbox-allowvgpu">WindowsSandbox/AllowVGPU</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-windowssandbox.md#windowssandbox-allowvideoinput" id="windowssandbox-allowvideoinput">WindowsSandbox/AllowVideoInput</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### WirelessDisplay policies
|
||||
|
||||
<dl>
|
||||
|
||||
561
windows/client-management/mdm/policy-csp-windowssandbox.md
Normal file
561
windows/client-management/mdm/policy-csp-windowssandbox.md
Normal file
@ -0,0 +1,561 @@
|
||||
---
|
||||
title: Policy CSP - WindowsSandbox
|
||||
description: Policy CSP - WindowsSandbox
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/14/2020
|
||||
---
|
||||
|
||||
# Policy CSP - WindowsSandbox
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## WindowsSandbox policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#windowssandbox-allowaudioinput">WindowsSandbox/AllowAudioInput</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#windowssandbox-allowclipboardredirection">WindowsSandbox/AllowClipboardRedirection</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#windowssandbox-allownetworking">WindowsSandbox/AllowNetworking</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#windowssandbox-allowprinterredirection">WindowsSandbox/AllowPrinterRedirection</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#windowssandbox-allowvgpu">WindowsSandbox/AllowVGPU</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#windowssandbox-allowvideoinput">WindowsSandbox/AllowVideoInput</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowssandbox-allowaudioinput"></a>**WindowsSandbox/AllowAudioInput**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows the IT admin to enable or disable audio input to the Sandbox.
|
||||
|
||||
> [!NOTE]
|
||||
> There may be security implications of exposing host audio input to the container.
|
||||
|
||||
If this policy is not configured, end-users get the default behavior (audio input enabled).
|
||||
|
||||
If audio input is disabled, a user will not be able to enable audio input from their own configuration file.
|
||||
|
||||
If audio input is enabled, a user will be able to disable audio input from their own configuration file to make the device more secure.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
|
||||
- GP English Name: *Allow audio input in Windows Sandbox*
|
||||
- GP name: *AllowAudioInput*
|
||||
- GP path: *Windows Components/Windows Sandbox*
|
||||
- GP ADMX file name: *WindowsSandbox.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following are the supported values:
|
||||
|
||||
- 0 - Disabled
|
||||
- 1 (default) - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowssandbox-allowclipboardredirection"></a>**WindowsSandbox/AllowClipboardRedirection**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows the IT admin to enable or disable sharing of the host clipboard with the sandbox.
|
||||
|
||||
If this policy is not configured, end-users get the default behavior (clipboard redirection enabled.
|
||||
|
||||
If clipboard sharing is disabled, a user will not be able to enable clipboard sharing from their own configuration file.
|
||||
|
||||
If clipboard sharing is enabled, a user will be able to disable clipboard sharing from their own configuration file to make the device more secure.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
|
||||
- GP English Name: *Allow clipboard sharing with Windows Sandbox*
|
||||
- GP name: *AllowClipboardRedirection*
|
||||
- GP path: *Windows Components/Windows Sandbox*
|
||||
- GP ADMX file name: *WindowsSandbox.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following are the supported values:
|
||||
|
||||
- 0 - Disabled
|
||||
- 1 (default) - Enabled
|
||||
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowssandbox-allownetworking"></a>**WindowsSandbox/AllowNetworking**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows the IT admin to enable or disable networking in Windows Sandbox. Disabling network access can decrease the attack surface exposed by the Sandbox. Enabling networking can expose untrusted applications to the internal network.
|
||||
|
||||
If this policy is not configured, end-users get the default behavior (networking enabled).
|
||||
|
||||
If networking is disabled, a user will not be able to enable networking from their own configuration file.
|
||||
|
||||
If networking is enabled, a user will be able to disable networking from their own configuration file to make the device more secure.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
|
||||
- GP English Name: *Allow networking in Windows Sandbox*
|
||||
- GP name: *AllowNetworking*
|
||||
- GP path: *Windows Components/Windows Sandbox*
|
||||
- GP ADMX file name: *WindowsSandbox.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following are the supported values:
|
||||
- 0 - Disabled
|
||||
- 1 (default) - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowssandbox-allowprinterredirection"></a>**WindowsSandbox/AllowPrinterRedirection**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows the IT admin to enable or disable printer sharing from the host into the Sandbox.
|
||||
|
||||
If this policy is not configured, end-users get the default behavior (printer sharing disabled).
|
||||
|
||||
If printer sharing is disabled, a user will not be able to enable printer sharing from their own configuration file.
|
||||
|
||||
If printer sharing is enabled, a user will be able to disable printer sharing from their own configuration file to make the device more secure.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
|
||||
- GP English Name: *Allow printer sharing with Windows Sandbox*
|
||||
- GP name: *AllowPrinterRedirection*
|
||||
- GP path: *Windows Components/Windows Sandbox*
|
||||
- GP ADMX file name: *WindowsSandbox.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following are the supported values:
|
||||
|
||||
- 0 - Disabled
|
||||
- 1 (default) - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowssandbox-allowvgpu"></a>**WindowsSandbox/AllowVGPU**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows the IT admin to enable or disable virtualized GPU for Windows Sandbox.
|
||||
|
||||
> [!NOTE]
|
||||
> Enabling virtualized GPU can potentially increase the attack surface of Windows Sandbox.
|
||||
|
||||
If this policy is not configured, end-users get the default behavior (vGPU is disabled).
|
||||
|
||||
If vGPU is disabled, a user will not be able to enable vGPU support from their own configuration file.
|
||||
|
||||
If vGPU is enabled, a user will be able to disable vGPU support from their own configuration file to make the device more secure.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
|
||||
- GP English Name: *Allow vGPU sharing for Windows Sandbox*
|
||||
- GP name: *AllowVGPU*
|
||||
- GP path: *Windows Components/Windows Sandbox*
|
||||
- GP ADMX file name: *WindowsSandbox.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following are the supported values:
|
||||
|
||||
- 0 (default) - Disabled
|
||||
- 1 - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="windowssandbox-allowvideoinput"></a>**WindowsSandbox/AllowVideoInput**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting allows the IT admin to enable or disable video input to the Sandbox.
|
||||
|
||||
> [!NOTE]
|
||||
> There may be security implications of exposing host video input to the container.
|
||||
|
||||
If this policy is not configured, users get the default behavior (video input disabled).
|
||||
|
||||
If video input is disabled, users will not be able to enable video input from their own configuration file.
|
||||
|
||||
If video input is enabled, users will be able to disable video input from their own configuration file to make the device more secure.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart Windows Sandbox for any changes to this policy setting to take effect.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English Name: *Allow video input in Windows Sandbox*
|
||||
- GP name: *AllowVideoInput*
|
||||
- GP path: *Windows Components/Windows Sandbox*
|
||||
- GP ADMX file name: *WindowsSandbox.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following are the supported values:
|
||||
|
||||
- 0 (default) - Disabled
|
||||
- 1 - Enabled
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
- 9 - Available in Windows 10, version 2010.
|
||||
|
||||
<!--/Policies-->
|
||||
@ -593,7 +593,7 @@ After you've decided where your protected apps can access enterprise data on you
|
||||
|
||||
**Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared amongst employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they are copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template’s license. Only users with permission to that template will be able to read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp).
|
||||
|
||||
- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. Curly braces {} are required around the RMS Template ID, but they are removed after you save the policy.
|
||||
- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files.
|
||||
|
||||
If you don’t specify an [RMS template](https://docs.microsoft.com/information-protection/deploy-use/configure-custom-templates), it’s a regular EFS file using a default RMS template that all users can access.
|
||||
|
||||
|
||||
@ -73,6 +73,8 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
|
||||
|
||||
- Microsoft Remote Desktop
|
||||
|
||||
- Microsoft To Do
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Visio, Microsoft Office Access, Microsoft Project, and Microsoft Publisher are not enlightened apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioning.
|
||||
|
||||
@ -113,6 +115,7 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li
|
||||
| Microsoft Paint | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mspaint.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft Remote Desktop | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mstsc.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft MAPI Repair Tool | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** fixmapi.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft To Do | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Todos<br>**App Type:** Store app |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
@ -42,7 +42,7 @@ Configuring policy settings in this category can help you document attempts to a
|
||||
- [Audit Credential Validation](audit-credential-validation.md)
|
||||
- [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md)
|
||||
- [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md)
|
||||
- [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md)
|
||||
- [Audit Other Account Logon Events](audit-other-account-logon-events.md)
|
||||
|
||||
## Account Management
|
||||
|
||||
@ -150,8 +150,8 @@ Auditors will be able to prove that every resource in the system is protected by
|
||||
|
||||
Resource SACLs are also useful for diagnostic scenarios. For example, setting the Global Object Access Auditing policy to log all the activity for a specific user and enabling the policy to track "Access denied" events for the file system or registry can help administrators quickly identify which object in a system is denying a user access.
|
||||
|
||||
> **Note:** If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object
|
||||
Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy.
|
||||
> [!NOTE]
|
||||
> If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy.
|
||||
|
||||
This category includes the following subcategories:
|
||||
- [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md)
|
||||
|
||||
@ -166,7 +166,7 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
| 0xC0000064 | User logon with misspelled or bad user account |
|
||||
| 0xC000006A | User logon with misspelled or bad password |
|
||||
| 0XC000006D | This is either due to a bad username or authentication information |
|
||||
| 0XC000006E | Unknown user name or bad password. |
|
||||
| 0XC000006E | Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions). |
|
||||
| 0xC000006F | User logon outside authorized hours |
|
||||
| 0xC0000070 | User logon from unauthorized workstation |
|
||||
| 0xC0000071 | User logon with expired password |
|
||||
@ -284,7 +284,7 @@ For 4625(F): An account failed to log on.
|
||||
|
||||
- Monitor for all events with the fields and values in the following table:
|
||||
|
||||
| **Field** | Value to monitor for |
|
||||
| Field | Value to monitor for |
|
||||
|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.” <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”. <br>Especially if you get a number of these in a row, it can be a sign of user enumeration attack. |
|
||||
|
||||
Reference in New Issue
Block a user