StorePath
Indicates a folder where files and settings will be saved. Note that StorePath cannot be c:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.
Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.
/apps
| Windows 10 installation media | Windows 10 Professional or Enterprise (ISO file), version 1703 or later is required. If you do not already have an ISO to use, a link is provided to download an [evaluation version of Windows 10 Enterprise](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). |
| Internet access | If you are behind a firewall, see the detailed [networking requirements](windows-autopilot-requirements-network.md). Otherwise, just ensure that you have a connection to the Internet. |
| Hyper-V or a physical device running Windows 10 | The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V. |
| A Premium Intune account | This guide will describe how to obtain a free 30-day trial premium account that can be used to complete the lab. |
[Enable Hyper-V](#enable-hyper-v) +
[Create a demo VM](#create-a-demo-vm) +
[Set ISO file location](#set-iso-file-location) +
[Determine network adapter name](#determine-network-adapter-name) +
[Use Windows PowerShell to create the demo VM](#use-windows-powershell-to-create-the-demo-vm) +
[Install Windows 10](#install-windows-10) +
[Capture the hardware ID](#capture-the-hardware-id) +
[Reset the VM back to Out-Of-Box-Experience (OOBE)](#reset-the-vm-back-to-out-of-box-experience-oobe) +
[Verify subscription level](#verify-subscription-level) +
[Configure company branding](#configure-company-branding) +
[Configure Microsoft Intune auto-enrollment](#configure-microsoft-intune-auto-enrollment) +
[Register your VM](#register-your-vm) +
[Autopilot registration using Intune](#autopilot-registration-using-intune) +
[Autopilot registration using MSfB](#autopilot-registration-using-msfb) +
[Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile) +
[Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) +
[Assign the profile](#assign-the-profile) +
[Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) +
[See Windows Autopilot in action](#see-windows-autopilot-in-action) +
[Remove devices from Autopilot](#remove-devices-from-autopilot) +
[Delete (deregister) Autopilot device](#delete-deregister-autopilot-device) +
[Appendix A: Verify support for Hyper-V](#appendix-a-verify-support-for-hyper-v) +
[Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile) +
[Add a Win32 app](#add-a-win32-app) +
[Prepare the app for Intune](#prepare-the-app-for-intune) +
[Create app in Intune](#create-app-in-intune) +
[Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +
[Add Office 365](#add-office-365) +
[Create app in Intune](#create-app-in-intune) +
[Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +
[Glossary](#glossary) + +## Verify support for Hyper-V + +If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). + +>If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). + +If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed. + +## Enable Hyper-V + +To enable Hyper-V, open an elevated Windows PowerShell prompt and run the following command: -Open a PowerShell prompt **as an administrator** and run the following: ```powershell Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All ``` -You will be prompted to restart your device, so save all your work and restart it before you continue. +This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command (below) to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. The following command will also install Hyper-V if it isn't already installed, so if you're using Windows Server, you can just type the following command instead of using the Enable-WindowsOptionalFeature command: -### Create and start your demo Virtual Machine - -Now that Hyper-V is enabled, proceed to create your Virtual Machine. - -Open a PowerShell prompt **as an administrator** and run the following: ```powershell -New-VMSwitch -Name AutopilotExternal -NetAdapterName
If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under **Role Administration Tools\Hyper-V Management Tools**.
+
+After installation is complete, open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt, or by typing **Hyper-V** in the Start menu search box.
+
+To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/) and [Hyper-V on Windows Server](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server).
+
+## Create a demo VM
+
+Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell.
+
+To use Windows Powershell we just need to know two things:
+
+1. The location of the Windows 10 ISO file.
+ - In the example, we assume the location is **c:\iso\win10-eval.iso**.
+2. The name of the network interface that connects to the Internet.
+ - In the example, we use a Windows PowerShell command to determine this automatically.
+
+After we have set the ISO file location and determined the name of the appropriate network interface, we can install Windows 10.
+
+### Set ISO file location
+
+You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise).
+- When asked to select a platform, choose **64 bit**.
+
+After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso).
+
+1. So that it is easier to type and remember, rename the file to **win10-eval.iso**.
+2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**.
+3. If you wish to use a different name and location for the file, you must modify the Windows PowerShell commands below to use your custom name and directory.
+
+### Determine network adapter name
+
+The Get-NetAdaper cmdlet is used below to automatically find the network adapter that is most likely to be the one you use to connect to the Internet. You should test this command first by running the following at an elevated Windows PowerShell prompt:
+
+```powershell
+(Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
+```
+
+The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name.
+
+For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**.
+
+### Use Windows PowerShell to create the demo VM
+
+All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands.
+
+>[!IMPORTANT]
+>**VM switch**: a VM switch is how Hyper-V connects VMs to a network. Yes
If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."
If you have never created an external VM switch before, then just run the commands below.
+
+```powershell
+New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
-Add-VMDvdDrive -Path
+PS C:\autopilot> dir c:\iso
+
+
+ Directory: C:\iso
+
+
+Mode LastWriteTime Length Name
+---- ------------- ------ ----
+-a---- 3/12/2019 2:46 PM 4627343360 win10-eval.iso
+
+PS C:\autopilot> (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
+Ethernet
+PS C:\autopilot> New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name
+
+Name SwitchType NetAdapterInterfaceDescription
+---- ---------- ------------------------------
+AutopilotExternal External Intel(R) Ethernet Connection (2) I218-LM
+
+PS C:\autopilot> New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
+
+Name State CPUUsage(%) MemoryAssigned(M) Uptime Status Version
+---- ----- ----------- ----------------- ------ ------ -------
+WindowsAutopilot Off 0 0 00:00:00 Operating normally 8.0
+
+PS C:\autopilot> Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot
+PS C:\autopilot> Start-VM -VMName WindowsAutopilot
+PS C:\autopilot> vmconnect.exe localhost WindowsAutopilot
+PS C:\autopilot> dir
+
+ Directory: C:\autopilot
+
+Mode LastWriteTime Length Name
+---- ------------- ------ ----
+d----- 3/12/2019 3:15 PM VMData
+d----- 3/12/2019 3:42 PM VMs
+
+PS C:\autopilot>
+
### Install Windows 10
-Now that the Virtual Machine was created and started, open **Hyper-V Manager** and connect to the **WindowsAutopilot** Virtual Machine.
-Make sure the Virtual Machine booted from the installation media you've provided and complete the Windows installation process.
+Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples:
-Once the installation is complete, create a checkpoint. You will create multiple checkpoints throughout this process, which you can later use to go through the process again.
+ 
+ 
+ 
+ 
+ 
+ 
+
+>After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example:
+
+ 
+
+Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again.
+
+ 
+
+To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following:
-To create the checkpoint, open a PowerShell prompt **as an administrator** and run the following:
```powershell
Checkpoint-VM -Name WindowsAutopilot -SnapshotName "Finished Windows install"
```
-## Capture your Virtual Machine's hardware ID
+Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see **Finished Windows Install** listed in the Checkpoints pane.
-On the newly created Virtual Machine, open a PowerShell prompt **as an administrator** and run the following:
-```powershell
-md c:\HWID
-Set-Location c:\HWID
-Set-ExecutionPolicy Unrestricted
-Install-Script -Name Get-WindowsAutopilotInfo
-Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
-```
+## Capture the hardware ID
+
+>NOTE: Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool.
+
+Follow these steps to run the PS script:
+
+1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device:
+
+ ```powershell
+ md c:\HWID
+ Set-Location c:\HWID
+ Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
+ Install-Script -Name Get-WindowsAutopilotInfo -Force
+ $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
+ Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
+ ```
+
+When you are prompted to install the NuGet package, choose **Yes**.
+
+See the sample output below.
+
+
+PS C:\> md c:\HWID
+
+ Directory: C:\
+
+Mode LastWriteTime Length Name
+---- ------------- ------ ----
+d----- 3/14/2019 11:33 AM HWID
+
+PS C:\> Set-Location c:\HWID
+PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
+PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
+
+NuGet provider is required to continue
+PowerShellGet requires NuGet provider version '2.8.5.201' or newer to interact with NuGet-based repositories. The NuGet
+ provider must be available in 'C:\Program Files\PackageManagement\ProviderAssemblies' or
+'C:\Users\user1\AppData\Local\PackageManagement\ProviderAssemblies'. You can also install the NuGet provider by running
+ 'Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force'. Do you want PowerShellGet to install and
+import the NuGet provider now?
+[Y] Yes [N] No [S] Suspend [?] Help (default is "Y"): Y
+PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
+PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
+PS C:\HWID> dir
+
+ Directory: C:\HWID
+
+Mode LastWriteTime Length Name
+---- ------------- ------ ----
+-a---- 3/14/2019 11:33 AM 8184 AutopilotHWID.csv
+
+PS C:\HWID>
+
+
+Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH.
+
+**Note**: Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below.
+
+
+
+You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM).
+
+If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this.
>[!NOTE]
->Accept all prompts while running the above cmdlets.
+>When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste.
-### Mount the Virtual Hard Drive (VHD)
+## Reset the VM back to Out-Of-Box-Experience (OOBE)
-To gain access to the AutopilotHWID.csv that contains the hardware ID, stop the Virtual Machine to unlock the Virtual Hard Drive.
-
-To do that, on your device (**not** on the Virtual Machine), open a PowerShell prompt **as an administrator** and run the following:
-```powershell
-Stop-VM -VMName WindowsAutopilot
-```
-
-Once the Virtual Machine has stopped, create a checkpoint:
-```powershell
-Checkpoint-VM -Name WindowsAutopilot -SnapshotName "HWID captured"
-```
-
-With the checkpoint created, continue to mount the VHD:
-```powershell
-Mount-VHD -path (Get-VMHardDiskDrive -VMName WindowsAutopilot).Path
-```
-
-Once mounted, navigate to the new drive and copy **AutopilotHWID.csv** to a location on your device.
-
-Before you proceed, unmount the VHD to unlock it and start the Virtual Machine:
-```powershell
-Dismount-VHD -path (Get-VMHardDiskDrive -VMName WindowsAutopilot).Path
-Start-VM -VMName WindowsAutopilot
-```
-
-## Reset Virtual Machine back to Out-Of-Box-Experience (OOBE)
-
-With the hardware ID captured, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE.
+With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE.
On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**.
Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**.
-Resetting your Virtual Machine can take a while. Proceed to the next steps while your Virtual Machine is resetting.
+Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process.
+## Verify subscription level
+
+For this lab, you need an AAD Premium subscription. You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example:
+
+**Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune**
+
+
+
+If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium.
+
+To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5.
+
+
+
## Configure company branding
->[!IMPORTANT]
->If you already have company branding configured in Azure Active Directory, you can skip this step.
-
-Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding).
+If you already have company branding configured in Azure Active Directory, you can skip this step.
>[!IMPORTANT]
>Make sure to sign-in with a Global Administrator account.
-Click on **Configure** and configure any type of company branding you'd like to see during the OOBE.
+Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE.
-
+
-Once finished, click **Save**.
+When you are finished, click **Save**.
>[!NOTE]
>Changes to company branding can take up to 30 minutes to apply.
-
## Configure Microsoft Intune auto-enrollment
->[!IMPORTANT]
->If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step.
+If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step.
-Navigate to [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**.
+Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, click **Add application** and choose **Intune**.
For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**.
-
+
-## Register your Virtual Machine to your organization
+## Register your VM
-Navigate to [Microsoft Store for Business device management](https://businessstore.microsoft.com/en-us/manage/devices). Click on **Add devices** and select the **AutopilotHWID.csv** you've saved earlier. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your Virtual Machine added.
+Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but only pick one for purposes of this lab. We highly recommend using Intune rather than MSfB.
-
+### Autopilot registration using Intune
+
+1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**.
+
+ 
+
+ >[!NOTE]
+ >If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared.
+
+2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank.
+
+ 
+
+ You should receive confirmation that the file is formatted correctly before uploading it, as shown above.
+
+3. Click **Import** and wait until the import process completes. This can take up to 15 minutes.
+
+4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example.
+
+ 
+
+### Autopilot registration using MSfB
+
+>[!IMPORTANT]
+>If you've already registered your VM (or device) using Intune, then skip this step.
+
+Optional: see the following video for an overview of the process.
+
+
+
+> [!video https://www.youtube.com/embed/IpLIZU_j7Z0]
+
+First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/en-us/microsoft-store/windows-store-for-business-overview) to create a new one.
+
+Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page.
+
+Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example:
+
+
+
+Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added.
+
+
## Create and assign a Windows Autopilot deployment profile
-Navigate to [Windows enrollment in Microsoft Intune](https://portal.azure.com/#blade/Microsoft_Intune_Enrollment/OverviewBlade/windowsEnrollment).
+>[!IMPORTANT]
+>Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only pick one for purposes of this lab:
-Make sure to sync the device you've just registered, by clicking on **Devices** under **Windows Autopilot Deployment Program (Preview)** and selecting **Sync**. Wait a few moments before refreshing to see your Virtual Machine added.
+Pick one:
+- [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune)
+- [Create profiles using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb)
-
+### Create a Windows Autopilot deployment profile using Intune
-### Create a Windows Autopilot deployment profile
+>[!NOTE]
+>Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first:
-Click on **Deployment profiles** under **Windows Autopilot Deployment Program (Preview)** and select **Create profile**.
+
-
+>The example above lists both a physical device and a VM. Your list should only include only one of these.
-In the **Create profile** blade, set the name to **Autopilot Intune Demo**, click on **Out-of-box experience (OOBE)** and configure the following:
-| Setting name | Value |
+To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles**
+
+
+
+Click on **Create profile**.
+
+
+
+On the **Create profile** blade, use the following values:
+
+| Setting | Value |
|---|---|
-|Privacy Settings|Hide|
-|End user license agreement (EULA)|Hide|
-|User account type|Standard|
+| Name | Autopilot Lab profile |
+| Description | blank |
+| Convert all targeted devices to Autopilot | No |
+| Deployment mode | User-driven |
+| Join to Azure AD as | Azure AD joined |
-Click on **Save** and **Create**.
+Click on **Out-of-box experience (OOBE)** and configure the following settings:
-
+| Setting | Value |
+|---|---|
+| EULA | Hide |
+| Privacy Settings | Hide |
+| Hide change account options | Hide |
+| User account type | Standard |
+| Apply device name template | No |
-### Assign a Windows Autopilot deployment profile
+See the following example:
-With the deployment profile created, go back to **Devices** under **Windows Autopilot Deployment Program (Preview)** and select your Virtual Machine. Click on **Assign profile** and in the **Assign Profile** blade select **Autopilot Intune Demo** under the **Autopilot profile**. Click on **Assign**.
+
-
+Click on **OK** and then click on **Create**.
-Wait a few minutes for all changes to apply.
+>If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile).
+
+#### Assign the profile
+
+Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading.
+
+To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**:
+
+
+
+Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type:
+
+Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group.
+
+
+
+Now click **Create** to finish creating the new group.
+
+Click on **All groups** and click **Refresh** to verify that your new group has been successfully created.
+
+With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results).
+
+From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile:
+
+
+
+Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**).
+
+
+
+Click **Select** and then click **Save**.
+
+
+
+It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot).
+
+### Create a Windows Autopilot deployment profile using MSfB
+
+If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section.
+
+A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below.
+
+First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab.
+
+Click **Manage** from the top menu, then click **Devices** from the left navigation tree.
+
+
+
+Click the **Windows Autopilot Deployment Program** link in the **Devices** tile.
+
+To CREATE the profile:
+
+Select your device from the **Devices** list:
+
+
+
+On the Autopilot deployment dropdown menu, select **Create new profile**:
+
+
+
+Name the profile, choose your desired settings, and then click **Create**:
+
+
+
+The new profile is added to the Autopilot deployment list.
+
+To ASSIGN the profile:
+
+To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown:
+
+
+
+Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column:
+
+
+
+>[!IMPORTANT]
+>The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
## See Windows Autopilot in action
-By now, your Virtual Machine should be back to OOBE. Make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding)
-, otherwise those changes might not show up.
+If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**:
+
+
+
+Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up.
+
+>[!TIP]
+>If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset).
+
+- Ensure your device has an internet connection.
+- Turn on the device
+- Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip).
+
+
+
+Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated.
+
+
Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done.
-
+Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings.
-Windows Autopilot will now take over to automatically join your Virtual Machine into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings.
+## Remove devices from Autopilot
+To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/en-us/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below.
+
+### Delete (deregister) Autopilot device
+
+You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu.
+
+
+
+Click **X** when challenged to complete the operation:
+
+
+
+This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**.
+
+
+
+The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. Note: A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.
+
+To remove the device from the Autopilot program, select the device and click Delete.
+
+
+
+A warning message appears reminding you to first remove the device from Intune, which we previously did.
+
+
+
+At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program:
+
+
+
+Once the device no longer appears, you are free to reuse it for other purposes.
+
+If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button:
+
+
+
+## Appendix A: Verify support for Hyper-V
+
+Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information.
+
+To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example:
+
+
+C:\>systeminfo
+
+...
+Hyper-V Requirements: VM Monitor Mode Extensions: Yes
+ Virtualization Enabled In Firmware: Yes
+ Second Level Address Translation: Yes
+ Data Execution Prevention Available: Yes
+
+
+In this example, the computer supports SLAT and Hyper-V.
+
+>If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings.
+
+You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example:
+
+
+C:\>coreinfo -v
+
+Coreinfo v3.31 - Dump information on system CPU and memory topology
+Copyright (C) 2008-2014 Mark Russinovich
+Sysinternals - www.sysinternals.com
+
+Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
+Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
+Microcode signature: 0000001B
+HYPERVISOR - Hypervisor is present
+VMX * Supports Intel hardware-assisted virtualization
+EPT * Supports Intel extended page tables (SLAT)
+
+
+Note: A 64-bit operating system is required to run Hyper-V.
+
+## Appendix B: Adding apps to your profile
+
+### Add a Win32 app
+
+#### Prepare the app for Intune
+
+Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool:
+
+1. The source folder for your application
+2. The name of the setup executable file
+3. The output folder for the new file
+
+For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app.
+
+Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then opy the file to a known location, such as C:\Notepad++msi.
+
+Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example:
+
+
+
+After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps.
+
+#### Create app in Intune
+
+Log into the Azure portal and select **Intune**.
+
+Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package.
+
+
+
+Under **App Type**, select **Windows app (Win32)**:
+
+
+
+On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**:
+
+
+
+On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as:
+
+
+
+On the **Program Configuration** blade, supply the install and uninstall commands:
+
+Install: msiexec /i "npp.7.6.3.installer.x64.msi" /q
+Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q
+
+NOTE: Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool) automatically generated them when it converted the .msi file into a .intunewin file.
+
+
+
+Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available).
+
+Click **OK** to save your input and activate the **Requirements** blade.
+
+On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**:
+
+
+
+Next, configure the **Detection rules**. For our purposes, we will select manual format:
+
+
+
+Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule:
+
+
+
+Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration.
+
+**Return codes**: For our purposes, leave the return codes at their default values:
+
+
+
+Click **OK** to exit.
+
+You may skip configuring the final **Scope (Tags)** blade.
+
+Click the **Add** button to finalize and save your app package.
+
+Once the indicator message says the addition has completed.
+
+
+
+You will be able to find your app in your app list:
+
+
+
+#### Assign the app to your Intune profile
+
+**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
+
+In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu:
+
+
+
+Select **Add Group** to open the **Add group** pane that is related to the app.
+
+For our purposes, select *8Required** from the **Assignment type** dropdown menu:
+
+>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website.
+
+Select **Included Groups** and assign the groups you previously created that will use this app:
+
+
+
+
+
+In the **Select groups** pane, click the **Select** button.
+
+In the **Assign group** pane, select **OK**.
+
+In the **Add group** pane, select **OK**.
+
+In the app **Assignments** pane, select **Save**.
+
+
+
+At this point, you have completed steps to add a Win32 app to Intune.
+
+For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/en-us/intune/apps-win32-app-management).
+
+### Add Office 365
+
+#### Create app in Intune
+
+Log into the Azure portal and select **Intune**.
+
+Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package.
+
+
+
+Under **App Type**, select **Office 365 Suite > Windows 10**:
+
+
+
+Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel:
+
+
+
+Click **OK**.
+
+In the **App Suite Information** pane, enter a unique suite name, and a suitable description.
+
+>Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal.
+
+
+
+Click **OK**.
+
+In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**:
+
+
+
+Click **OK** and then click **Add**.
+
+#### Assign the app to your Intune profile
+
+**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here.
+
+In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu:
+
+
+
+Select **Add Group** to open the **Add group** pane that is related to the app.
+
+For our purposes, select **Required** from the **Assignment type** dropdown menu:
+
+>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website.
+
+Select **Included Groups** and assign the groups you previously created that will use this app:
+
+
+
+
+
+In the **Select groups** pane, click the **Select** button.
+
+In the **Assign group** pane, select **OK**.
+
+In the **Add group** pane, select **OK**.
+
+In the app **Assignments** pane, select **Save**.
+
+
+
+At this point, you have completed steps to add Office to Intune.
+
+For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/en-us/intune/apps-add-office365).
+
+If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate:
+
+
+
+## Glossary
+
+
+
diff --git a/windows/deployment/windows-autopilot/images/aad-lic1.png b/windows/deployment/windows-autopilot/images/aad-lic1.png
new file mode 100644
index 0000000000..569d601066
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/aad-lic1.png differ
diff --git a/windows/deployment/windows-autopilot/images/all-groups.png b/windows/deployment/windows-autopilot/images/all-groups.png
new file mode 100644
index 0000000000..6ae904ed62
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/all-groups.png differ
diff --git a/windows/deployment/windows-autopilot/images/app01.png b/windows/deployment/windows-autopilot/images/app01.png
new file mode 100644
index 0000000000..f551c5ca68
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app01.png differ
diff --git a/windows/deployment/windows-autopilot/images/app02.png b/windows/deployment/windows-autopilot/images/app02.png
new file mode 100644
index 0000000000..e5036043cc
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app02.png differ
diff --git a/windows/deployment/windows-autopilot/images/app03.png b/windows/deployment/windows-autopilot/images/app03.png
new file mode 100644
index 0000000000..63ef76b3f8
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app03.png differ
diff --git a/windows/deployment/windows-autopilot/images/app04.png b/windows/deployment/windows-autopilot/images/app04.png
new file mode 100644
index 0000000000..bd307c4a46
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app04.png differ
diff --git a/windows/deployment/windows-autopilot/images/app05.png b/windows/deployment/windows-autopilot/images/app05.png
new file mode 100644
index 0000000000..83861dcd51
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app05.png differ
diff --git a/windows/deployment/windows-autopilot/images/app06.png b/windows/deployment/windows-autopilot/images/app06.png
new file mode 100644
index 0000000000..9563e0514c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app06.png differ
diff --git a/windows/deployment/windows-autopilot/images/app07.png b/windows/deployment/windows-autopilot/images/app07.png
new file mode 100644
index 0000000000..59025e69fa
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app07.png differ
diff --git a/windows/deployment/windows-autopilot/images/app08.png b/windows/deployment/windows-autopilot/images/app08.png
new file mode 100644
index 0000000000..cea5edfc57
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app08.png differ
diff --git a/windows/deployment/windows-autopilot/images/app09.png b/windows/deployment/windows-autopilot/images/app09.png
new file mode 100644
index 0000000000..250c85dd8a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app09.png differ
diff --git a/windows/deployment/windows-autopilot/images/app10.png b/windows/deployment/windows-autopilot/images/app10.png
new file mode 100644
index 0000000000..8d5af2ece1
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app10.png differ
diff --git a/windows/deployment/windows-autopilot/images/app11.png b/windows/deployment/windows-autopilot/images/app11.png
new file mode 100644
index 0000000000..9ca5bc10eb
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app11.png differ
diff --git a/windows/deployment/windows-autopilot/images/app12.png b/windows/deployment/windows-autopilot/images/app12.png
new file mode 100644
index 0000000000..3f82bf78a9
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app12.png differ
diff --git a/windows/deployment/windows-autopilot/images/app13.png b/windows/deployment/windows-autopilot/images/app13.png
new file mode 100644
index 0000000000..2b499f4ec2
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app13.png differ
diff --git a/windows/deployment/windows-autopilot/images/app14.png b/windows/deployment/windows-autopilot/images/app14.png
new file mode 100644
index 0000000000..e809db6134
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app14.png differ
diff --git a/windows/deployment/windows-autopilot/images/app15.png b/windows/deployment/windows-autopilot/images/app15.png
new file mode 100644
index 0000000000..b85a96bf9e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app15.png differ
diff --git a/windows/deployment/windows-autopilot/images/app16.png b/windows/deployment/windows-autopilot/images/app16.png
new file mode 100644
index 0000000000..f22f74a091
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app16.png differ
diff --git a/windows/deployment/windows-autopilot/images/app17.png b/windows/deployment/windows-autopilot/images/app17.png
new file mode 100644
index 0000000000..5adfc9218f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app17.png differ
diff --git a/windows/deployment/windows-autopilot/images/app18.png b/windows/deployment/windows-autopilot/images/app18.png
new file mode 100644
index 0000000000..24c4b9f331
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app18.png differ
diff --git a/windows/deployment/windows-autopilot/images/app19.png b/windows/deployment/windows-autopilot/images/app19.png
new file mode 100644
index 0000000000..281ba9fb40
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app19.png differ
diff --git a/windows/deployment/windows-autopilot/images/app20.png b/windows/deployment/windows-autopilot/images/app20.png
new file mode 100644
index 0000000000..a5a066b45e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app20.png differ
diff --git a/windows/deployment/windows-autopilot/images/app21.png b/windows/deployment/windows-autopilot/images/app21.png
new file mode 100644
index 0000000000..d2e23f2db4
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app21.png differ
diff --git a/windows/deployment/windows-autopilot/images/app22.png b/windows/deployment/windows-autopilot/images/app22.png
new file mode 100644
index 0000000000..4541a69204
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app22.png differ
diff --git a/windows/deployment/windows-autopilot/images/app23.png b/windows/deployment/windows-autopilot/images/app23.png
new file mode 100644
index 0000000000..19b951c653
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app23.png differ
diff --git a/windows/deployment/windows-autopilot/images/app24.png b/windows/deployment/windows-autopilot/images/app24.png
new file mode 100644
index 0000000000..aa77e4083f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app24.png differ
diff --git a/windows/deployment/windows-autopilot/images/app25.png b/windows/deployment/windows-autopilot/images/app25.png
new file mode 100644
index 0000000000..544d1ae37a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app25.png differ
diff --git a/windows/deployment/windows-autopilot/images/app26.png b/windows/deployment/windows-autopilot/images/app26.png
new file mode 100644
index 0000000000..e210faa31b
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app26.png differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png
new file mode 100644
index 0000000000..1533f68c7c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png differ
diff --git a/windows/deployment/windows-autopilot/images/branding.png b/windows/deployment/windows-autopilot/images/branding.png
new file mode 100644
index 0000000000..46dd37bc4a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/branding.png differ
diff --git a/windows/deployment/windows-autopilot/images/create-profile.png b/windows/deployment/windows-autopilot/images/create-profile.png
new file mode 100644
index 0000000000..52f087721d
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/create-profile.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device1.png b/windows/deployment/windows-autopilot/images/delete-device1.png
new file mode 100644
index 0000000000..e73f929fbd
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device1.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device2.png b/windows/deployment/windows-autopilot/images/delete-device2.png
new file mode 100644
index 0000000000..ed764ac1ed
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device2.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device3.png b/windows/deployment/windows-autopilot/images/delete-device3.png
new file mode 100644
index 0000000000..a2daa1c39a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device3.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device4.png b/windows/deployment/windows-autopilot/images/delete-device4.png
new file mode 100644
index 0000000000..c0119fbc39
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device4.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device5.png b/windows/deployment/windows-autopilot/images/delete-device5.png
new file mode 100644
index 0000000000..33b539d33c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device5.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device6.png b/windows/deployment/windows-autopilot/images/delete-device6.png
new file mode 100644
index 0000000000..23cbcb7c44
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device6.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device7.png b/windows/deployment/windows-autopilot/images/delete-device7.png
new file mode 100644
index 0000000000..dcdeee5205
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device7.png differ
diff --git a/windows/deployment/windows-autopilot/images/deployment-profiles.png b/windows/deployment/windows-autopilot/images/deployment-profiles.png
new file mode 100644
index 0000000000..7888da55d1
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/deployment-profiles.png differ
diff --git a/windows/deployment/windows-autopilot/images/deployment-profiles2.png b/windows/deployment/windows-autopilot/images/deployment-profiles2.png
new file mode 100644
index 0000000000..6ff9fbb89e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/deployment-profiles2.png differ
diff --git a/windows/deployment/windows-autopilot/images/device-import.png b/windows/deployment/windows-autopilot/images/device-import.png
new file mode 100644
index 0000000000..3be4cff996
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/device-import.png differ
diff --git a/windows/deployment/windows-autopilot/images/device-status.png b/windows/deployment/windows-autopilot/images/device-status.png
new file mode 100644
index 0000000000..5a78973ce5
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/device-status.png differ
diff --git a/windows/deployment/windows-autopilot/images/enabled-device.png b/windows/deployment/windows-autopilot/images/enabled-device.png
new file mode 100644
index 0000000000..96dc935309
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enabled-device.png differ
diff --git a/windows/deployment/windows-autopilot/images/hwid-csv.png b/windows/deployment/windows-autopilot/images/hwid-csv.png
new file mode 100644
index 0000000000..ac177e0b5a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hwid-csv.png differ
diff --git a/windows/deployment/windows-autopilot/images/hwid.png b/windows/deployment/windows-autopilot/images/hwid.png
new file mode 100644
index 0000000000..fcc73fa0b0
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hwid.png differ
diff --git a/windows/deployment/windows-autopilot/images/import-vm.png b/windows/deployment/windows-autopilot/images/import-vm.png
new file mode 100644
index 0000000000..5fb97cda5d
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/import-vm.png differ
diff --git a/windows/deployment/windows-autopilot/images/include-group.png b/windows/deployment/windows-autopilot/images/include-group.png
new file mode 100644
index 0000000000..fb7bca7efa
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/include-group.png differ
diff --git a/windows/deployment/windows-autopilot/images/include-group2.png b/windows/deployment/windows-autopilot/images/include-group2.png
new file mode 100644
index 0000000000..585d006bac
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/include-group2.png differ
diff --git a/windows/deployment/windows-autopilot/images/intune-devices.png b/windows/deployment/windows-autopilot/images/intune-devices.png
new file mode 100644
index 0000000000..bc29c76511
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/intune-devices.png differ
diff --git a/windows/deployment/windows-autopilot/images/mdm-intune.png b/windows/deployment/windows-autopilot/images/mdm-intune.png
new file mode 100644
index 0000000000..db9b144fad
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/mdm-intune.png differ
diff --git a/windows/deployment/windows-autopilot/images/mdm-intune2.png b/windows/deployment/windows-autopilot/images/mdm-intune2.png
new file mode 100644
index 0000000000..d464863f37
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/mdm-intune2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-assign1.png b/windows/deployment/windows-autopilot/images/msfb-assign1.png
new file mode 100644
index 0000000000..c1e8e27e21
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-assign1.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-assign2.png b/windows/deployment/windows-autopilot/images/msfb-assign2.png
new file mode 100644
index 0000000000..fd3be16853
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-assign2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-create1.png b/windows/deployment/windows-autopilot/images/msfb-create1.png
new file mode 100644
index 0000000000..f76aa82991
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-create1.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-create2.png b/windows/deployment/windows-autopilot/images/msfb-create2.png
new file mode 100644
index 0000000000..ec6c260fcd
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-create2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-create3.png b/windows/deployment/windows-autopilot/images/msfb-create3.png
new file mode 100644
index 0000000000..a6241fb5ea
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-create3.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-device.png b/windows/deployment/windows-autopilot/images/msfb-device.png
new file mode 100644
index 0000000000..d338056013
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-device.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage.png b/windows/deployment/windows-autopilot/images/msfb-manage.png
new file mode 100644
index 0000000000..9bf684d844
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-manage.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage2.png b/windows/deployment/windows-autopilot/images/msfb-manage2.png
new file mode 100644
index 0000000000..406aaf5948
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-manage2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage3.png b/windows/deployment/windows-autopilot/images/msfb-manage3.png
new file mode 100644
index 0000000000..bf5fb1ccf9
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-manage3.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb.png b/windows/deployment/windows-autopilot/images/msfb.png
new file mode 100644
index 0000000000..af937c2c5f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb.png differ
diff --git a/windows/deployment/windows-autopilot/images/new-group.png b/windows/deployment/windows-autopilot/images/new-group.png
new file mode 100644
index 0000000000..c18c1865f6
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/new-group.png differ
diff --git a/windows/deployment/windows-autopilot/images/profile.png b/windows/deployment/windows-autopilot/images/profile.png
new file mode 100644
index 0000000000..40cf26bee2
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/profile.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup1.png b/windows/deployment/windows-autopilot/images/winsetup1.png
new file mode 100644
index 0000000000..c8048256c4
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup1.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup2.png b/windows/deployment/windows-autopilot/images/winsetup2.png
new file mode 100644
index 0000000000..43db844334
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup2.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup3.png b/windows/deployment/windows-autopilot/images/winsetup3.png
new file mode 100644
index 0000000000..dbea3969de
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup3.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup4.png b/windows/deployment/windows-autopilot/images/winsetup4.png
new file mode 100644
index 0000000000..1121b1dff5
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup4.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup5.png b/windows/deployment/windows-autopilot/images/winsetup5.png
new file mode 100644
index 0000000000..2757253097
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup5.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup6.png b/windows/deployment/windows-autopilot/images/winsetup6.png
new file mode 100644
index 0000000000..e91843e1ff
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup6.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup7.png b/windows/deployment/windows-autopilot/images/winsetup7.png
new file mode 100644
index 0000000000..dadf85485e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup7.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup8.png b/windows/deployment/windows-autopilot/images/winsetup8.png
new file mode 100644
index 0000000000..9d7a499db0
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup8.png differ
diff --git a/windows/deployment/windows-autopilot/user-driven-hybrid.md b/windows/deployment/windows-autopilot/user-driven-hybrid.md
index c084916d3e..d69c5869ba 100644
--- a/windows/deployment/windows-autopilot/user-driven-hybrid.md
+++ b/windows/deployment/windows-autopilot/user-driven-hybrid.md
@@ -32,7 +32,7 @@ To perform a user-driven hybrid AAD joined deployment using Windows Autopilot:
- The device must be connected to the Internet and have access to an Active Directory domain controller.
- The Intune Connector for Active Directory must be installed.
- Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf.
-- If using Proxy, WDAP Proxy settings option must be enabled and configured.
+- If using Proxy, WPAD Proxy settings option must be enabled and configured.
**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default.
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md
index 30fb733eb0..7e67c7eca1 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md
@@ -21,7 +21,7 @@ ms.topic: article
When performing a remote Windows Autopilot Reset, an MDM service such an Microsoft Intune can be used to initiate the reset process, avoiding the need for IT staff or other administrators to visit each machine to initiate the process.
-To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed, joined to Azure AD, and configured to use the [enrollment status page](enrollment-status.md).
+To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed, joined to Azure AD, and configured to use the [enrollment status page](enrollment-status.md). This feature is not supported on devices that were enrolled using [Autopilot self deploying mode](self-deploying.md).
## Triggering a remote Windows Autopilot Reset
@@ -34,5 +34,8 @@ To trigger a remote Windows Autopilot Reset via Intune, follow these steps:
>[!NOTE]
>The Autopilot Reset option will not be enabled in Microsoft Intune for devices not running Windows 10 build 17672 or higher.
+>[!IMPORTANT]
+>The feature for Autopilot Reset (preview) will stay grayed out, **unless** you reset the device using Autopilot (either using Fresh Reset or manually sysprep the device).
+
Once the reset is complete, the device is again ready for use.
-
\ No newline at end of file
+
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset.md b/windows/deployment/windows-autopilot/windows-autopilot-reset.md
index 1a5c9e982d..78eca0eb39 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot-reset.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot-reset.md
@@ -33,6 +33,9 @@ Windows Autopilot Reset will block the user from accessing the desktop until thi
>[!IMPORTANT]
>To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection.
+>[!NOTE]
+>The Autopilot Reset does not support Hybrid Azure AD joined devices.
+
## Scenarios
Windows Autopilot Reset supports two scenarios:
diff --git a/windows/hub/TOC.md b/windows/hub/TOC.md
index 1883594880..a811ff7119 100644
--- a/windows/hub/TOC.md
+++ b/windows/hub/TOC.md
@@ -1,6 +1,6 @@
# [Windows 10 and Windows 10 Mobile](index.md)
## [What's new](/windows/whats-new)
-## [Release information](release-information.md)
+## [Release information](/windows/release-information)
## [Deployment](/windows/deployment)
## [Configuration](/windows/configuration)
## [Client management](/windows/client-management)
diff --git a/windows/hub/breadcrumb/toc.yml b/windows/hub/breadcrumb/toc.yml
index 4539d3b751..a28aaa3b77 100644
--- a/windows/hub/breadcrumb/toc.yml
+++ b/windows/hub/breadcrumb/toc.yml
@@ -25,9 +25,9 @@
- name: Mobile Device Management
tocHref: /windows/client-management/mdm/
topicHref: /windows/client-management/mdm/index
- - name: Known issues
- tocHref: /windows/known-issues/
- topicHref: /windows/known-issues/index
+ - name: Release information
+ tocHref: /windows/release-information/
+ topicHref: /windows/release-information/index
- name: Privacy
tocHref: /windows/privacy/
topicHref: /windows/privacy/index
diff --git a/windows/hub/release-information.md b/windows/hub/release-information.md
deleted file mode 100644
index 2aa38be1de..0000000000
--- a/windows/hub/release-information.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Windows 10 - release information
-description: Learn release information for Windows 10 releases
-keywords: ["Windows 10", "Windows 10 October 2018 Update"]
-ms.prod: w10
-layout: LandingPage
-ms.topic: landing-page
-ms.mktglfcycl: deploy
-ms.sitesec: library
-author: lizap
-ms.author: elizapo
-ms.localizationpriority: high
----
-# Windows 10 release information
-
-Feature updates for Windows 10 are released twice a year, targeting March and September, via the Semi-Annual Channel (SAC) and will be serviced with monthly quality updates for 18 months from the date of the release. We recommend that you begin deployment of each SAC release immediately to devices selected for early adoption and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible.
-
-Starting with Windows 10, version 1809, feature updates for Windows 10 Enterprise and Education editions with a targeted release month of September will be serviced for 30 months from their release date. For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853).
-
->[!NOTE]
->If you are not using Windows Update for Business today, the "Semi-Annual Channel (Targeted)" servicing option has no impact on when your devices will be updated. It merely reflects a milestone for the semi-annual release, the period of time during which Microsoft recommends that your IT team make the release available to specific, "targeted" devices for the purpose of validating and generating data in order to get to a broad deployment decision. For more information, see [this blog post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523).
-
-
-OEM Original Equipment Manufacturer CSV Comma Separated Values MPC Microsoft Partner Center CSP Cloud Solution Provider MSfB Microsoft Store for Business AAD Azure Active Directory 4K HH 4K Hardware Hash CBR Computer Build Report EC Enterprise Commerce (server) DDS Device Directory Service OOBE Out of the Box Experience VM Virtual Machine
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved MSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4493475April 09, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 10240.18158
March 12, 2019
KB4489872Resolved
KB4493475April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4493475April 09, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >OS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4489872March 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.
See details >OS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4489872March 12, 2019
10:00 AM PTFirst character of Japanese era name not recognized
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4489872March 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >OS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4491101February 21, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >OS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4487018February 12, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >OS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4487018February 12, 2019
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >OS Build 10240.18005
October 09, 2018
KB4462922Resolved
KB4471323December 11, 2018
10:00 AM PTGuest VMs running Unicast NLB fail to respond after restart
All guest virtual machines running Unicast NLB fail to respond to NLB requests after the virtual machines restart.
See details >OS Build 10240.17976
September 11, 2018
KB4457132Resolved
KB4462922October 09, 2018
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 10240.18158
March 12, 2019
KB4489872Resolved
KB4493475Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4493475Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topOS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4489872Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topOS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4489872Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTFirst character of Japanese era name not recognized
Back to topOS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4489872Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Back to topOS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4491101Resolved:
February 21, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History MSXML6 may cause applications to stop responding
Back to topOS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4493475Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topOS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4487018Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topOS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4487018Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: September 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOS Build 10240.18005
October 09, 2018
KB4462922Resolved
KB4471323Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml
new file mode 100644
index 0000000000..72407b6ba9
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1607.yml
@@ -0,0 +1,135 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1607 and Windows Server 2016
+metadata:
+ document_id:
+ title: Resolved issues in Windows 10, version 1607 and Windows Server 2016
+ description: Resolved issues in Windows 10, version 1607
+ keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1607"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 10, version 1607 and Windows Server 2016 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Guest VMs running Unicast NLB fail to respond after restart
Back to topOS Build 10240.17976
September 11, 2018
KB4457132Resolved
KB4462922Resolved:
October 09, 2018
10:00 AM PT
Opened:
September 11, 2018
10:00 AM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Custom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 14393.2848
March 12, 2019
KB4489882Resolved
KB4493473April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup.
See details >OS Build 14393.2879
March 19, 2019
KB4489889Resolved
KB4493470April 09, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >OS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4493470April 09, 2019
10:00 AM PTIssue hosting multiple terminal server sessions and a user logs off on Windows Server
In some cases, Windows Server will stop working and restart when hosting multiple terminal server sessions and a user logs off.
See details >OS Build 14393.2828
February 19, 2019
KB4487006Resolved
KB4489882March 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.
See details >OS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4489882March 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >OS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4487006February 19, 2019
02:00 PM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 14393.2759
January 17, 2019
KB4480977Resolved
KB4487006February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >OS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4487006February 19, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >OS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4487026February 12, 2019
10:00 AM PTInstant search in Microsoft Outlook fails on Windows Server 2016
Instant search in Microsoft Outlook clients fail with the error, \"Outlook cannot perform the search\" on Windows Server 2016.
See details >OS Build 14393.2639
November 27, 2018
KB4467684Resolved
KB4487026February 12, 2019
10:00 AM PTSqlConnection instantiation exception on .NET 4.6 and later
Instantiation of SqlConnection can throw an exception after certain updates have been installed.
See details >OS Build 14393.2457
August 30, 2018
KB4343884Resolved
KB4480977January 17, 2019
02:00 PM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >OS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4480977January 17, 2019
02:00 PM PTSystem becomes unresponsive when end-user-defined characters (EUDC) are used
When features related to end-user-defined characters (EUDC) are used, the entire system may become unresponsive.
See details >OS Build 14393.2639
November 27, 2018
KB4467684Resolved
KB4471321December 11, 2018
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >OS Build 14393.2551
October 09, 2018
KB4462917Resolved
KB4471321December 11, 2018
10:00 AM PTIssues with install and activation of Key Management Service (KMS) (CSVLK) host keys
Installation and client activation of Windows Server 2019 and 1809 LTSC Key Management Service (KMS) (CSVLK) host keys do not work as expected.
See details >OS Build 14393.2457
August 30, 2018
KB4343884Resolved
KB4467684November 27, 2018
10:00 AM PTPromotions that create non-root domains fail with optional features enabled
Windows Server 2016 promotions that create non-root domains fail in forests in which optional features like Active Directory recycle have been enabled.
See details >OS Build 14393.2515
September 20, 2018
KB4457127Resolved
KB4467684November 27, 2018
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 14393.2848
March 12, 2019
KB4489882Resolved
KB4493473Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 14393.2879
March 19, 2019
KB4489889Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTIssue hosting multiple terminal server sessions and a user logs off on Windows Server
Back to topOS Build 14393.2828
February 19, 2019
KB4487006Resolved
KB4489882Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 19, 2019
02:00 PM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topOS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4489882Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topOS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4487006Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Back to topOS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4487006Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: November 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Internet Explorer 11 authentication issue with multiple concurrent logons
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
Back to topOS Build 14393.2759
January 17, 2019
KB4480977Resolved
KB4487006Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 17, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4487026Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4480977Resolved:
January 17, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Instant search in Microsoft Outlook fails on Windows Server 2016
Back to topOS Build 14393.2639
November 27, 2018
KB4467684Resolved
KB4487026Resolved:
February 12, 2019
10:00 AM PT
Opened:
November 27, 2018
10:00 AM PTSystem becomes unresponsive when end-user-defined characters (EUDC) are used
Back to topOS Build 14393.2639
November 27, 2018
KB4467684Resolved
KB4471321Resolved:
December 11, 2018
10:00 AM PT
Opened:
November 27, 2018
10:00 AM PT
+ "
+
+- title: September 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOS Build 14393.2551
October 09, 2018
KB4462917Resolved
KB4471321Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
+
+- title: August 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Promotions that create non-root domains fail with optional features enabled
Back to topOS Build 14393.2515
September 20, 2018
KB4457127Resolved
KB4467684Resolved:
November 27, 2018
10:00 AM PT
Opened:
September 20, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml
new file mode 100644
index 0000000000..a32bfe383c
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1703.yml
@@ -0,0 +1,113 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1703
+metadata:
+ document_id:
+ title: Resolved issues in Windows 10, version 1703
+ description: Resolved issues in Windows 10, version 1703
+ keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1703"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 10, version 1703 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History SqlConnection instantiation exception on .NET 4.6 and later
Back to topOS Build 14393.2457
August 30, 2018
KB4343884Resolved
KB4480977Resolved:
January 17, 2019
02:00 PM PT
Opened:
August 30, 2018
05:00 PM PTIssues with install and activation of Key Management Service (KMS) (CSVLK) host keys
Back to topOS Build 14393.2457
August 30, 2018
KB4343884Resolved
KB4467684Resolved:
November 27, 2018
10:00 AM PT
Opened:
August 30, 2018
05:00 PM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Custom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 15063.1689
March 12, 2019
KB4489871Resolved
KB4493436April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 15063.1716
March 19, 2019
KB4489888Resolved
KB4493474April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4493474April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4493474April 09, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.
See details >OS Build 15063.1659
February 19, 2019
KB4487011Resolved
KB4489871March 12, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 15063.1596
January 15, 2019
KB4480959Resolved
KB4487011February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >OS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4487011February 19, 2019
02:00 PM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >OS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4487011February 19, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >OS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4487020February 12, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Microsoft Edge users report difficulty browsing and loading webpages.
See details >OS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4487020February 12, 2019
10:00 AM PTSqlConnection instantiation exception on .NET 4.6 and later
Instantiation of SqlConnection can throw an exception after certain updates have been installed.
See details >OS Build 15063.1292
August 30, 2018
KB4343889Resolved
KB4480959January 15, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >OS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4480959January 15, 2019
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >OS Build 15063.1387
October 09, 2018
KB4462937Resolved
KB4471327December 11, 2018
10:00 AM PTLongonUI.exe stops working intermittently
LongonUI.exe stops working intermittently.
See details >OS Build 15063.1387
October 09, 2018
KB4462937Resolved
KB4467699November 27, 2018
10:00 AM PTError message beginning with “Hosted by…” when launching Microsoft Edge
Some users may encounter an error message beginning with “Hosted by…” when launching Microsoft Edge.
See details >OS Build 15063.1387
October 09, 2018
KB4462937Resolved
KB4462939October 18, 2018
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 15063.1689
March 12, 2019
KB4489871Resolved
KB4493436Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 15063.1716
March 19, 2019
KB4489888Resolved
KB4493474Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4493474Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topOS Build 15063.1659
February 19, 2019
KB4487011Resolved
KB4489871Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Back to topOS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4487011Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topOS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4487011Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History MSXML6 may cause applications to stop responding
Back to topOS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4493474Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
Back to topOS Build 15063.1596
January 15, 2019
KB4480959Resolved
KB4487011Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 15, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topOS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4487020Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Back to topOS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4487020Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topOS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4480959Resolved:
January 15, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: August 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOS Build 15063.1387
October 09, 2018
KB4462937Resolved
KB4471327Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PTLongonUI.exe stops working intermittently
Back to topOS Build 15063.1387
October 09, 2018
KB4462937Resolved
KB4467699Resolved:
November 27, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PTError message beginning with “Hosted by…” when launching Microsoft Edge
Back to topOS Build 15063.1387
October 09, 2018
KB4462937Resolved
KB4462939Resolved:
October 18, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml
new file mode 100644
index 0000000000..e030af13f9
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1709.yml
@@ -0,0 +1,113 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1709 and Windows Server, vesion 1709
+metadata:
+ document_id:
+ title: Resolved issues in Windows 10, version 1709 and Windows Server, vesion 1709
+ description: Resolved issues in Windows 10, version 1709 and Windows Server 1709
+ keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1709"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 10, version 1709 and Windows Server, version 1709 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History SqlConnection instantiation exception on .NET 4.6 and later
Back to topOS Build 15063.1292
August 30, 2018
KB4343889Resolved
KB4480959Resolved:
January 15, 2019
10:00 AM PT
Opened:
August 30, 2018
05:00 PM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Custom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493440April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 16299.1059
March 19, 2019
KB4489890Resolved
KB4493441April 09, 2019
10:00 AM PTMSXML6 causes applications to stop responding if an exception was thrown
MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4493441April 09, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.
See details >OS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493441April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4493441April 09, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.
See details >OS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4489886March 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >OS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4487021February 19, 2019
02:00 PM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 16299.936
January 15, 2019
KB4480967Resolved
KB4487021February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >OS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4487021February 19, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >OS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4486996February 12, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Microsoft Edge users report difficulty browsing and loading webpages.
See details >OS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4486996February 12, 2019
10:00 AM PTSqlConnection instantiation exception on .NET 4.6 and later
Instantiation of SqlConnection can throw an exception after certain updates have been installed.
See details >OS Build 16299.637
August 30, 2018
KB4343893Resolved
KB4480967January 15, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >OS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4480967January 15, 2019
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >OS Build 16299.726
October 09, 2018
KB4462918Resolved
KB4471329December 11, 2018
10:00 AM PTError message beginning with “Hosted by…” when launching Microsoft Edge
Some users may encounter an error message beginning with “Hosted by…” when launching Microsoft Edge.
See details >OS Build 16299.726
October 09, 2018
KB4462918Resolved
KB4462932October 18, 2018
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493440Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 16299.1059
March 19, 2019
KB4489890Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
Back to topOS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topOS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4489886Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topOS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4487021Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Back to topOS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4487021Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History MSXML6 causes applications to stop responding if an exception was thrown
Back to topOS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
Back to topOS Build 16299.936
January 15, 2019
KB4480967Resolved
KB4487021Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 15, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topOS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4486996Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Back to topOS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4486996Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topOS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4480967Resolved:
January 15, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: August 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOS Build 16299.726
October 09, 2018
KB4462918Resolved
KB4471329Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PTError message beginning with “Hosted by…” when launching Microsoft Edge
Back to topOS Build 16299.726
October 09, 2018
KB4462918Resolved
KB4462932Resolved:
October 18, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml
new file mode 100644
index 0000000000..8eaaa3f3c9
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1803.yml
@@ -0,0 +1,147 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1803
+metadata:
+ document_id:
+ title: Resolved issues in Windows 10, version 1803
+ description: Resolved issues in Windows 10, version 1803
+ keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1803"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 10, version 1803 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History SqlConnection instantiation exception on .NET 4.6 and later
Back to topOS Build 16299.637
August 30, 2018
KB4343893Resolved
KB4480967Resolved:
January 15, 2019
10:00 AM PT
Opened:
August 30, 2018
05:00 PM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Custom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493437April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 17134.677
March 19, 2019
KB4489894Resolved
KB4493464April 09, 2019
10:00 AM PTFirst character of the Japanese era name not recognized
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 17134.556
January 15, 2019
KB4480976Resolved
KB4487029April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4493464April 09, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.
See details >OS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493464April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4493464April 09, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.
See details >OS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4489868March 12, 2019
10:00 AM PTCannot pin a web link on the Start menu or the taskbar
Some users cannot pin a web link on the Start menu or the taskbar.
See details >OS Build 17134.471
December 11, 2018
KB4471324Resolved
KB4487029February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >OS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4487029February 19, 2019
02:00 PM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >OS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4487017February 12, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Microsoft Edge users report difficulty browsing and loading webpages.
See details >OS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4487017February 12, 2019
10:00 AM PTSqlConnection instantiation exception on .NET 4.6 and later
After you install the August Preview of Quality Rollup or the September 11, 2018 .NET Framework update, instantiation of SqlConnection can throw an exception.
See details >OS Build 17134.285
September 11, 2018
KB4457128Resolved
KB4480976January 15, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >OS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4480976January 15, 2019
10:00 AM PTBlue or black screen with \"System thread exception not handled\" error
Some users may get a blue or black screen with the error code, “System thread exception not handled.”
See details >OS Build 17134.441
November 27, 2018
KB4467682Resolved
KB4471324December 11, 2018
10:00 AM PTCustom Start menu layouts display incorrectly
Custom Start menu layouts may display incorrectly.
See details >OS Build 17134.441
November 27, 2018
KB4467682Resolved
KB4471324December 11, 2018
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >OS Build 17134.345
October 09, 2018
KB4462919Resolved
KB4471324December 11, 2018
10:00 AM PTUsers cannot set Win32 program defaults
Some users cannot set Win32 program defaults for certain app and file type combinations.
See details >OS Build 17134.320
September 26, 2018
KB4458469Resolved
KB4467682November 27, 2018
10:00 AM PTDeveloper Tools (F12) fail to start in Microsoft Edge
Developer Tools (F12) may fail to start in Microsoft Edge.
See details >OS Build 17134.376
October 24, 2018
KB4462933Resolved
KB4467702November 13, 2018
10:00 AM PTGuest VMs running Unicast NLB fail to respond after restart
All guest virtual machines running Unicast NLB fail to respond to NLB requests after the virtual machines restart.
See details >OS Build 17134.285
September 11, 2018
KB4457128Resolved
KB4458469September 26, 2018
10:00 AM PTMicrosoft Intune takes a long time to deliver user profiles
Windows no longer recognizes the Personal Information exchange (PFX) certificate used for Wi-Fi or VPN authentication, causing delays in Microsoft Intune delivering user profiles.
See details >OS Build 17134.191
July 24, 2018
KB4340917Resolved
KB4464218September 17, 2018
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493437Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 17134.677
March 19, 2019
KB4489894Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
Back to topOS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topOS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4489868Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Back to topOS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4487029Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: December 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History First character of the Japanese era name not recognized
Back to topOS Build 17134.556
January 15, 2019
KB4480976Resolved
KB4487029Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topOS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4487017Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Back to topOS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4487017Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topOS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4480976Resolved:
January 15, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: November 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Cannot pin a web link on the Start menu or the taskbar
Back to topOS Build 17134.471
December 11, 2018
KB4471324Resolved
KB4487029Resolved:
February 19, 2019
02:00 PM PT
Opened:
December 11, 2018
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Blue or black screen with \"System thread exception not handled\" error
Back to topOS Build 17134.441
November 27, 2018
KB4467682Resolved
KB4471324Resolved:
December 11, 2018
10:00 AM PT
Opened:
November 27, 2018
10:00 AM PTCustom Start menu layouts display incorrectly
Back to topOS Build 17134.441
November 27, 2018
KB4467682Resolved
KB4471324Resolved:
December 11, 2018
10:00 AM PT
Opened:
November 27, 2018
10:00 AM PT
+ "
+
+- title: September 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOS Build 17134.345
October 09, 2018
KB4462919Resolved
KB4471324Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PTDeveloper Tools (F12) fail to start in Microsoft Edge
Back to topOS Build 17134.376
October 24, 2018
KB4462933Resolved
KB4467702Resolved:
November 13, 2018
10:00 AM PT
Opened:
October 24, 2018
02:00 PM PT
+ "
+
+- title: July 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History SqlConnection instantiation exception on .NET 4.6 and later
Back to topOS Build 17134.285
September 11, 2018
KB4457128Resolved
KB4480976Resolved:
January 15, 2019
10:00 AM PT
Opened:
September 11, 2018
10:00 AM PTUsers cannot set Win32 program defaults
Back to topOS Build 17134.320
September 26, 2018
KB4458469Resolved
KB4467682Resolved:
November 27, 2018
10:00 AM PT
Opened:
September 26, 2018
02:00 PM PTGuest VMs running Unicast NLB fail to respond after restart
Back to topOS Build 17134.285
September 11, 2018
KB4457128Resolved
KB4458469Resolved:
September 26, 2018
10:00 AM PT
Opened:
September 11, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
new file mode 100644
index 0000000000..9e6e80d5cc
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
@@ -0,0 +1,137 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1809 and Windows Server 2019
+metadata:
+ document_id:
+ title: Resolved issues in Windows 10, version 1809 and Windows Server 2019
+ description: Resolved issues in Windows 10, version 1809 or Windows Server 2019
+ keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10 1809"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 10, version 1809 and Windows Server 2019 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Microsoft Intune takes a long time to deliver user profiles
Back to topOS Build 17134.191
July 24, 2018
KB4340917Resolved
KB4464218Resolved:
September 17, 2018
10:00 AM PT
Opened:
July 24, 2018
10:00 AM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved End-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 17763.404
April 02, 2019
KB4490481Resolved
KB4493509April 09, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >OS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4493509April 09, 2019
10:00 AM PTApps may stop working after selecting an audio output device other than the default
Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly.
See details >OS Build 17763.348
March 01, 2019
KB4482887Resolved
KB4490481April 02, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.
See details >OS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4489899March 12, 2019
10:00 AM PTGlobal DNS outage affects Windows Update customers
Windows Update customers were recently affected by a network infrastructure event caused by an external DNS service provider's global outage.
See details >N/A Resolved March 08, 2019
11:15 AM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >OS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4482887March 01, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 9 file format may randomly stop working.
See details >OS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4482887March 01, 2019
10:00 AM PTFirst character of the Japanese era name not recognized
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4482887March 01, 2019
10:00 AM PTShared albums may not sync with iCloud for Windows
Upgrade block: Apple has identified an incompatibility with iCloud for Windows (version 7.7.0.27) where users may experience issues updating or synching Shared Albums.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4482887March 01, 2019
10:00 AM PTIntel Audio Display (intcdaud.sys) notification during Windows 10 Setup
Upgrade block: Users may see an Intel Audio Display (intcdaud.sys) notification during setup for devices with certain Intel Display Audio Drivers.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4482887March 01, 2019
10:00 AM PTF5 VPN clients losing network connectivity
Upgrade block: After updating to Window 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4482887March 01, 2019
10:00 AM PTWebpages become unresponsive in Microsoft Edge
Microsoft Edge users report difficulty browsing and loading webpages.
See details >OS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4487044February 12, 2019
10:00 AM PTIssues with lock screen and Microsoft Edge tabs for certain AMD Radeon video cards
Upgrade block: Devices utilizing AMD Radeon HD2000 or HD4000 series video cards may experience issues with the lock screen and Microsoft Edge tabs.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4487044February 12, 2019
10:00 AM PTTrend Micro OfficeScan and Worry-Free Business Security AV software not compatible
Upgrade block: Microsoft and Trend Micro identified a compatibility issue with the Trend Micro business endpoint security solutions OfficeScan and Worry-Free Business Security.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved February 01, 2019
09:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >OS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4476976January 22, 2019
02:00 PM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >OS Build 17763.55
October 09, 2018
KB4464330Resolved
KB4471332December 11, 2018
10:00 AM PTAudio stops working after installing Intel audio driver
Upgrade block: Windows 10 audio stops working after installing Intel Smart Sound Technology driver (version 09.21.00.3755).
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4468550December 07, 2018
10:00 AM PTOffice apps (32-bit) unable to use 'Save As…' function
Upgrade block: Devices using Morphisec Protector (or other application that uses the Morphisec SDK) may be unable to save documents when using 32-bit Microsoft Office apps.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved December 06, 2018
12:00 PM PTUsers cannot set Win32 program defaults
Some users cannot set Win32 program defaults for certain app and file type combinations.
See details >OS Build 17763.55
October 09, 2018
KB4464330Resolved
KB4469342December 05, 2018
02:00 PM PTMapped drives fail to reconnect after login
Upgrade block: Mapped drives may fail to reconnect after booting and logging on to a Windows device.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4469342December 05, 2018
02:00 PM PTMicrosoft Edge may crash or hang while playing video
Following an nVidia driver update, Microsoft Edge may crash or hang while playing video.
See details >OS Build 17763.134
November 13, 2018
KB4467708Resolved December 05, 2018
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History End-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 17763.404
April 02, 2019
KB4490481Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
April 02, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Apps may stop working after selecting an audio output device other than the default
Back to topOS Build 17763.348
March 01, 2019
KB4482887Resolved
KB4490481Resolved:
April 02, 2019
10:00 AM PT
Opened:
March 01, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topOS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4489899Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Back to topOS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4482887Resolved:
March 01, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topOS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4482887Resolved:
March 01, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTFirst character of the Japanese era name not recognized
Back to topOS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4482887Resolved:
March 01, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: November 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Internet Explorer 11 authentication issue with multiple concurrent logons
Back to topOS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTGlobal DNS outage affects Windows Update customers
Back to topN/A Resolved Resolved:
March 08, 2019
11:15 AM PT
Opened:
January 29, 2019
02:00 PM PTWebpages become unresponsive in Microsoft Edge
Back to topOS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4487044Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topOS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4476976Resolved:
January 22, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Shared albums may not sync with iCloud for Windows
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4482887Resolved:
March 01, 2019
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PTIntel Audio Display (intcdaud.sys) notification during Windows 10 Setup
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4482887Resolved:
March 01, 2019
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PTF5 VPN clients losing network connectivity
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4482887Resolved:
March 01, 2019
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PTIssues with lock screen and Microsoft Edge tabs for certain AMD Radeon video cards
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4487044Resolved:
February 12, 2019
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PTTrend Micro OfficeScan and Worry-Free Business Security AV software not compatible
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved Resolved:
February 01, 2019
09:00 AM PT
Opened:
November 13, 2018
10:00 AM PTAudio stops working after installing Intel audio driver
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4468550Resolved:
December 07, 2018
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PTOffice apps (32-bit) unable to use 'Save As…' function
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved Resolved:
December 06, 2018
12:00 PM PT
Opened:
November 13, 2018
10:00 AM PTMapped drives fail to reconnect after login
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved
KB4469342Resolved:
December 05, 2018
02:00 PM PT
Opened:
November 13, 2018
10:00 AM PTMicrosoft Edge may crash or hang while playing video
Back to topOS Build 17763.134
November 13, 2018
KB4467708Resolved Resolved:
December 05, 2018
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
new file mode 100644
index 0000000000..d034127b65
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -0,0 +1,109 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1
+metadata:
+ document_id:
+ title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1
+ description: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1
+ keywords: ["Resolved issues in Windows 7", "Windows 7", "Windows Server 2008 R2 SP1"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 7 and Windows Server 2008 R2 SP1 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOS Build 17763.55
October 09, 2018
KB4464330Resolved
KB4471332Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PTUsers cannot set Win32 program defaults
Back to topOS Build 17763.55
October 09, 2018
KB4464330Resolved
KB4469342Resolved:
December 05, 2018
02:00 PM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Devices may not respond at login or Welcome screen if running certain Avast software
Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.
See details >April 09, 2019
KB4493472Resolved April 25, 2019
02:00 PM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >January 08, 2019
KB4480970Resolved
KB4493472April 09, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >March 12, 2019
KB4489878Resolved
KB4493472April 09, 2019
10:00 AM PTNETDOM.EXE fails to run
NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.
See details >March 12, 2019
KB4489878Resolved
KB4493472April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4486563Resolved
KB4493472April 09, 2019
10:00 AM PTEvent Viewer may not show some event descriptions for network interface cards
The Event Viewer may not show some event descriptions for network interface cards (NIC).
See details >October 18, 2018
KB4462927Resolved
KB4489878March 12, 2019
10:00 AM PTVirtual machines fail to restore
Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.
See details >January 08, 2019
KB4480970Resolved
KB4490511February 19, 2019
02:00 PM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >January 17, 2019
KB4480955Resolved
KB4486565February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >February 12, 2019
KB4486563Resolved
KB4486565February 19, 2019
02:00 PM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >February 12, 2019
KB4486563Resolved
KB4486565February 19, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >January 08, 2019
KB4480970Resolved
KB4486563February 12, 2019
10:00 AM PTLocal Administrators unable to remotely access shares
Local users who are part of the local Administrators group may not be able to remotely access shares on Windows Server 2008 R2 and Windows 7 machines.
See details >January 08, 2019
KB4480970Resolved
KB4487345January 11, 2019
02:00 PM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >October 09, 2018
KB4462923Resolved
KB4471318December 11, 2018
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Devices may not respond at login or Welcome screen if running certain Avast software
Back to topApril 09, 2019
KB4493472Resolved Resolved:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topMarch 12, 2019
KB4489878Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PTNETDOM.EXE fails to run
Back to topMarch 12, 2019
KB4489878Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4486563Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTInternet Explorer may fail to load images
Back to topFebruary 12, 2019
KB4486563Resolved
KB4486565Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topFebruary 12, 2019
KB4486563Resolved
KB4486565Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Internet Explorer 11 authentication issue with multiple concurrent logons
Back to topJanuary 08, 2019
KB4480970Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTVirtual machines fail to restore
Back to topJanuary 08, 2019
KB4480970Resolved
KB4490511Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
Back to topJanuary 17, 2019
KB4480955Resolved
KB4486565Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 17, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topJanuary 08, 2019
KB4480970Resolved
KB4486563Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTLocal Administrators unable to remotely access shares
Back to topJanuary 08, 2019
KB4480970Resolved
KB4487345Resolved:
January 11, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
new file mode 100644
index 0000000000..1ef62bfe75
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
@@ -0,0 +1,109 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 8.1 and Windows Server 2012 R2
+metadata:
+ document_id:
+ title: Resolved issues in Windows 8.1 and Windows Server 2012 R2
+ description: Resolved issues in Windows 8.1 and Windows Server 2012 R2
+ keywords: ["Resolved issues in Windows 8.1", "Windows 8.1", "Windows Server 2012 R2"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows 8.1 and Windows Server 2012 R2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Event Viewer may not show some event descriptions for network interface cards
Back to topOctober 18, 2018
KB4462927Resolved
KB4489878Resolved:
March 12, 2019
10:00 AM PT
Opened:
October 18, 2018
10:00 AM PTUnable to use Seek bar in Windows Media Player
Back to topOctober 09, 2018
KB4462923Resolved
KB4471318Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Devices may not respond at login or Welcome screen if running certain Avast software
Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.
See details >April 09, 2019
KB4493446Resolved April 25, 2019
02:00 PM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >January 08, 2019
KB4480963Resolved
KB4493446April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding.
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >January 08, 2019
KB4480963Resolved
KB4493446April 09, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >March 12, 2019
KB4489881Resolved
KB4493446April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4487000Resolved
KB4493446April 09, 2019
10:00 AM PTDevices with winsock kernel client may receive error
Devices with a winsock kernel client may receive D1, FC, and other errors.
See details >March 12, 2019
KB4489881Resolved
KB4489893March 19, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.
See details >February 19, 2019
KB4487016Resolved
KB4489881March 12, 2019
10:00 AM PTVirtual machines fail to restore
Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.
See details >January 08, 2019
KB4480963Resolved
KB4490512February 19, 2019
02:00 PM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >January 15, 2019
KB4480969Resolved
KB4487016February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Internet Explorer may fail to load images with a backslash (\\) in their relative source path.
See details >February 12, 2019
KB4487000Resolved
KB4487016February 19, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >January 08, 2019
KB4480963Resolved
KB4487000February 12, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >January 08, 2019
KB4480963Resolved
KB4480969January 15, 2019
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >October 09, 2018
KB4462926Resolved
KB4471320December 11, 2018
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Devices may not respond at login or Welcome screen if running certain Avast software
Back to topApril 09, 2019
KB4493446Resolved Resolved:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topMarch 12, 2019
KB4489881Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PTDevices with winsock kernel client may receive error
Back to topMarch 12, 2019
KB4489881Resolved
KB4489893Resolved:
March 19, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4487000Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topFebruary 19, 2019
KB4487016Resolved
KB4489881Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 19, 2019
02:00 PM PTInternet Explorer may fail to load images
Back to topFebruary 12, 2019
KB4487000Resolved
KB4487016Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Internet Explorer 11 authentication issue with multiple concurrent logons
Back to topJanuary 08, 2019
KB4480963Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding.
Back to topJanuary 08, 2019
KB4480963Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTVirtual machines fail to restore
Back to topJanuary 08, 2019
KB4480963Resolved
KB4490512Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
Back to topJanuary 15, 2019
KB4480969Resolved
KB4487016Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 15, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topJanuary 08, 2019
KB4480963Resolved
KB4487000Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topJanuary 08, 2019
KB4480963Resolved
KB4480969Resolved:
January 15, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
new file mode 100644
index 0000000000..fe19c4b36e
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
@@ -0,0 +1,91 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows Server 2008 SP2
+metadata:
+ document_id:
+ title: Resolved issues in Windows Server 2008 SP2
+ description: Resolved issues in Windows Server 2008 SP2
+ keywords: ["Resolved issues in Windows Server 2008 SP2", "Windows Server 2008 SP2"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows Server 2008 SP2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOctober 09, 2018
KB4462926Resolved
KB4471320Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Embedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4487023Resolved
KB4493471April 09, 2019
10:00 AM PTNETDOM.EXE fails to run
NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.
See details >March 12, 2019
KB4489880Resolved
KB4493471April 09, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >January 17, 2019
KB4480974Resolved
KB4489880March 12, 2019
10:00 AM PTVirtual machines fail to restore
Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.
See details >January 08, 2019
KB4480968Resolved
KB4490514February 19, 2019
02:00 PM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >February 12, 2019
KB4487023Resolved
KB4487022February 19, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >January 08, 2019
KB4480968Resolved
KB4487023February 12, 2019
10:00 AM PTLocal Administrators unable to remotely access shares
Local users who are part of the local Administrators group may not be able to remotely access shares on Windows Server 2008 R2 and Windows 7 machines.
See details >January 08, 2019
KB4480968Resolved
KB4487354January 11, 2019
02:00 PM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >October 09, 2018
KB4463097Resolved
KB4471325December 11, 2018
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History NETDOM.EXE fails to run
Back to topMarch 12, 2019
KB4489880Resolved
KB4493471Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4487023Resolved
KB4493471Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topFebruary 12, 2019
KB4487023Resolved
KB4487022Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History First character of the Japanese era name not recognized as an abbreviation
Back to topJanuary 17, 2019
KB4480974Resolved
KB4489880Resolved:
March 12, 2019
10:00 AM PT
Opened:
January 17, 2019
10:00 AM PTVirtual machines fail to restore
Back to topJanuary 08, 2019
KB4480968Resolved
KB4490514Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topJanuary 08, 2019
KB4480968Resolved
KB4487023Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTLocal Administrators unable to remotely access shares
Back to topJanuary 08, 2019
KB4480968Resolved
KB4487354Resolved:
January 11, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml
new file mode 100644
index 0000000000..b2a7ce07c1
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-server-2012.yml
@@ -0,0 +1,97 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows Server 2012
+metadata:
+ document_id:
+ title: Resolved issues in Windows Server 2012
+ description: Resolved issues in Windows Server 2012
+ keywords: ["Resolved issues in Windows Server 2012", "Windows Server 2012"]
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ See a list of known issues that have been resolved for Windows Server 2012 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOctober 09, 2018
KB4463097Resolved
KB4471325Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
+
+- title: Resolved issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Date resolved Internet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >January 08, 2019
KB4480975Resolved
KB4493451April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >January 08, 2019
KB4480975Resolved
KB4493451April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4487025Resolved
KB4493451April 09, 2019
10:00 AM PTEvent Viewer may not show some event descriptions for network interface cards
The Event Viewer may not show some event descriptions for network interface cards (NIC).
See details >September 11, 2018
KB4457135Resolved
KB4489891March 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.
See details >February 12, 2019
KB4487025Resolved
KB4489891March 12, 2019
10:00 AM PTVirtual machines fail to restore
Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.
See details >January 08, 2019
KB4480975Resolved
KB4490516February 19, 2019
02:00 PM PTFirst character of the Japanese era name not recognized as an abbreviation
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >January 15, 2019
KB4480971Resolved
KB4487024February 19, 2019
02:00 PM PTApplications using Microsoft Jet database and Access 95 file format stop working
Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.
See details >February 12, 2019
KB4487025Resolved
KB4487024February 19, 2019
02:00 PM PTApplications using Microsoft Jet database fail to open
Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.
See details >January 08, 2019
KB4480975Resolved
KB4487025February 12, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Third-party applications may have difficulty authenticating hotspots.
See details >January 08, 2019
KB4480975Resolved
KB4480971January 15, 2019
10:00 AM PTUnable to use Seek bar in Windows Media Player
Users may not be able to use the Seek bar in Windows Media Player when playing specific files.
See details >October 09, 2018
KB4462929Resolved
KB4471330December 11, 2018
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4487025Resolved
KB4493451Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTError 1309 when installing/uninstalling MSI or MSP files
Back to topFebruary 12, 2019
KB4487025Resolved
KB4489891Resolved:
March 12, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PTApplications using Microsoft Jet database and Access 95 file format stop working
Back to topFebruary 12, 2019
KB4487025Resolved
KB4487024Resolved:
February 19, 2019
02:00 PM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: October 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Internet Explorer 11 authentication issue with multiple concurrent logons
Back to topJanuary 08, 2019
KB4480975Resolved
KB4493451Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topJanuary 08, 2019
KB4480975Resolved
KB4493451Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTVirtual machines fail to restore
Back to topJanuary 08, 2019
KB4480975Resolved
KB4490516Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized as an abbreviation
Back to topJanuary 15, 2019
KB4480971Resolved
KB4487024Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 15, 2019
10:00 AM PTApplications using Microsoft Jet database fail to open
Back to topJanuary 08, 2019
KB4480975Resolved
KB4487025Resolved:
February 12, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTUnable to access hotspots with third-party applications
Back to topJanuary 08, 2019
KB4480975Resolved
KB4480971Resolved:
January 15, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: September 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Unable to use Seek bar in Windows Media Player
Back to topOctober 09, 2018
KB4462929Resolved
KB4471330Resolved:
December 11, 2018
10:00 AM PT
Opened:
October 09, 2018
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml
new file mode 100644
index 0000000000..3cab3fb9e9
--- /dev/null
+++ b/windows/release-information/status-windows-10-1507.yml
@@ -0,0 +1,103 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1507
+metadata:
+ document_id:
+ title: Windows 10, version 1507
+ description: View annoucements and review known issues and fixes for Windows 10 version 1507
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 10, version 1507. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Event Viewer may not show some event descriptions for network interface cards
Back to topSeptember 11, 2018
KB4457135Resolved
KB4489891Resolved:
March 12, 2019
10:00 AM PT
Opened:
September 11, 2018
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".
See details >OS Build 10240.18094
January 08, 2019
KB4480962Mitigated April 25, 2019
02:00 PM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4493475April 09, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 10240.18158
March 12, 2019
KB4489872Resolved
KB4493475April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4493475April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 10240.18158
March 12, 2019
KB4489872Resolved
KB4493475Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 10240.18132
February 12, 2019
KB4487018Resolved
KB4493475Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
new file mode 100644
index 0000000000..b22aced938
--- /dev/null
+++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
@@ -0,0 +1,134 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1607 and Windows Server 2016
+metadata:
+ document_id:
+ title: Windows 10, version 1607 and Windows Server 2016
+ description: View annoucements and review known issues and fixes for Windows 10 version 1607 and Windows Server 2016
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 10, version 1607 and Windows Server 2016. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topOS Build 10240.18094
January 08, 2019
KB4480962Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 10240.18094
January 08, 2019
KB4480962Resolved
KB4493475Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated Zone transfers over TCP may fail
Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.
See details >OS Build 14393.2941
April 25, 2019
KB4493473Investigating April 25, 2019
02:00 PM PTCluster service may fail if the minimum password length is set to greater than 14
The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters.
See details >OS Build 14393.2639
November 27, 2018
KB4467684Mitigated April 25, 2019
02:00 PM PTIssue using PXE to start a device from WDS
There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.
See details >OS Build 14393.2848
March 12, 2019
KB4489882Mitigated April 25, 2019
02:00 PM PTSCVMM cannot enumerate and manage logical switches deployed on the host
For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.
See details >OS Build 14393.2639
November 27, 2018
KB4467684Mitigated April 25, 2019
02:00 PM PTCertain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".
See details >OS Build 14393.2724
January 08, 2019
KB4480961Mitigated April 25, 2019
02:00 PM PTWindows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.
See details >OS Build 14393.2608
November 13, 2018
KB4467691Mitigated February 19, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 14393.2848
March 12, 2019
KB4489882Resolved
KB4493473April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup.
See details >OS Build 14393.2879
March 19, 2019
KB4489889Resolved
KB4493470April 09, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >OS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4493470April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Zone transfers over TCP may fail
Back to topOS Build 14393.2941
April 25, 2019
KB4493473Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 25, 2019
02:00 PM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Issue using PXE to start a device from WDS Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
+
Back to topOS Build 14393.2848
March 12, 2019
KB4489882Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Back to topOS Build 14393.2848
March 12, 2019
KB4489882Resolved
KB4493473Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 14393.2879
March 19, 2019
KB4489889Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 14393.2791
February 12, 2019
KB4487026Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: November 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 14393.2724
January 08, 2019
KB4480961Resolved
KB4493470Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml
new file mode 100644
index 0000000000..10d69d6cc5
--- /dev/null
+++ b/windows/release-information/status-windows-10-1703.yml
@@ -0,0 +1,105 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1703
+metadata:
+ document_id:
+ title: Windows 10, version 1703
+ description: View annoucements and review known issues and fixes for Windows 10 version 1703
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 10, version 1703. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Cluster service may fail if the minimum password length is set to greater than 14
Back to topOS Build 14393.2639
November 27, 2018
KB4467684Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
November 27, 2018
10:00 AM PTSCVMM cannot enumerate and manage logical switches deployed on the host
Back to topOS Build 14393.2639
November 27, 2018
KB4467684Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
November 27, 2018
10:00 AM PTWindows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
Back to topOS Build 14393.2608
November 13, 2018
KB4467691Mitigated Last updated:
February 19, 2019
10:00 AM PT
Opened:
November 13, 2018
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated Certain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".
See details >OS Build 15063.1563
January 08, 2019
KB4480973Mitigated April 25, 2019
02:00 PM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 15063.1689
March 12, 2019
KB4489871Resolved
KB4493436April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 15063.1716
March 19, 2019
KB4489888Resolved
KB4493474April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4493474April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4493474April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 15063.1689
March 12, 2019
KB4489871Resolved
KB4493436Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 15063.1716
March 19, 2019
KB4489888Resolved
KB4493474Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 15063.1631
February 12, 2019
KB4487020Resolved
KB4493474Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml
new file mode 100644
index 0000000000..45e3ada4b8
--- /dev/null
+++ b/windows/release-information/status-windows-10-1709.yml
@@ -0,0 +1,117 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1709 and Windows Server, version 1709
+metadata:
+ document_id:
+ title: Windows 10, version 1709 and Windows Server, version 1709
+ description: View annoucements and review known issues and fixes for Windows 10 version 1709 and Windows Server 1709
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 10, version 1709 and Windows Server, version 1709. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topOS Build 15063.1563
January 08, 2019
KB4480973Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 15063.1563
January 08, 2019
KB4480973Resolved
KB4493474Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated Zone transfers over TCP may fail
Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.
See details >OS Build 16299.1127
April 25, 2019
KB4493440Investigating April 25, 2019
02:00 PM PTCertain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".
See details >OS Build 16299.904
January 08, 2019
KB4480978Mitigated April 25, 2019
02:00 PM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493440April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 16299.1059
March 19, 2019
KB4489890Resolved
KB4493441April 09, 2019
10:00 AM PTMSXML6 causes applications to stop responding if an exception was thrown
MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4493441April 09, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.
See details >OS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493441April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4493441April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Zone transfers over TCP may fail
Back to topOS Build 16299.1127
April 25, 2019
KB4493440Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 25, 2019
02:00 PM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493440Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 16299.1059
March 19, 2019
KB4489890Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
Back to topOS Build 16299.1029
March 12, 2019
KB4489886Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 16299.967
February 12, 2019
KB4486996Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml
new file mode 100644
index 0000000000..3e58d9c048
--- /dev/null
+++ b/windows/release-information/status-windows-10-1803.yml
@@ -0,0 +1,122 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1803
+metadata:
+ document_id:
+ title: Windows 10, version 1803
+ description: View annoucements and review known issues and fixes for Windows 10 version 1803
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 10, version 1803. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topOS Build 16299.904
January 08, 2019
KB4480978Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 causes applications to stop responding if an exception was thrown
Back to topOS Build 16299.904
January 08, 2019
KB4480978Resolved
KB4493441Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated Zone transfers over TCP may fail
Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.
See details >OS Build 17134.753
April 25, 2019
KB4493437Investigating April 25, 2019
02:00 PM PTIssue using PXE to start a device from WDS
Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.
See details >OS Build 17134.648
March 12, 2019
KB4489868Mitigated April 25, 2019
02:00 PM PTCertain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".
See details >OS Build 17134.523
January 08, 2019
KB4480966Mitigated April 25, 2019
02:00 PM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493437April 25, 2019
02:00 PM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 17134.677
March 19, 2019
KB4489894Resolved
KB4493464April 09, 2019
10:00 AM PTFirst character of the Japanese era name not recognized
The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.
See details >OS Build 17134.556
January 15, 2019
KB4480976Resolved
KB4487029April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4493464April 09, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.
See details >OS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493464April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4493464April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Zone transfers over TCP may fail
Back to topOS Build 17134.753
April 25, 2019
KB4493437Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 25, 2019
02:00 PM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Issue using PXE to start a device from WDS Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
+
Back to topOS Build 17134.648
March 12, 2019
KB4489868Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Back to topOS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493437Resolved:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 17134.677
March 19, 2019
KB4489894Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 19, 2019
10:00 AM PTStop error when attempting to start SSH from WSL
Back to topOS Build 17134.648
March 12, 2019
KB4489868Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 17134.590
February 12, 2019
KB4487017Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
new file mode 100644
index 0000000000..82bcf3314f
--- /dev/null
+++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
@@ -0,0 +1,137 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1809 and Windows Server 2019
+metadata:
+ document_id:
+ title: Windows 10, version 1809 and Windows Server 2019
+ description: View annoucements and review known issues and fixes for Windows 10 version 1809 and Windows Server 2019
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues and the status of the rollout for Windows 10, version 1809 and Windows Server 2019. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topOS Build 17134.523
January 08, 2019
KB4480966Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTFirst character of the Japanese era name not recognized
Back to topOS Build 17134.556
January 15, 2019
KB4480976Resolved
KB4487029Resolved:
February 19, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 17134.523
January 08, 2019
KB4480966Resolved
KB4493464Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+
+ Current status:
+ Windows 10, version 1809 is designated for broad deployment and available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
+
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated System may be unresponsive after restart if ArcaBit antivirus software installed
Devices with ArcaBit antivirus software installed may become unresponsive upon restart.
See details >OS Build 17763.437
April 09, 2019
KB4493509Mitigated April 25, 2019
02:00 PM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >OS Build 17763.379
March 12, 2019
KB4489899Mitigated April 09, 2019
10:00 AM PTIssue using PXE to start a device from WDS
Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.
See details >OS Build 17763.379
March 12, 2019
KB4489899Mitigated April 09, 2019
10:00 AM PTAudio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort
Upgrade block: Microsoft has identified issues with certain new Intel display drivers, which accidentally turn on unsupported features in Windows.
See details >OS Build 17763.134
November 13, 2018
KB4467708Mitigated March 15, 2019
12:00 PM PTCertain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".
See details >OS Build 17763.253
January 08, 2019
KB4480116Mitigated January 08, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.
See details >OS Build 17763.404
April 02, 2019
KB4490481Resolved
KB4493509April 09, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >OS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >OS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >OS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4493509April 09, 2019
10:00 AM PTApps may stop working after selecting an audio output device other than the default
Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly.
See details >OS Build 17763.348
March 01, 2019
KB4482887Resolved
KB4490481April 02, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History System may be unresponsive after restart if ArcaBit antivirus software installed
Back to topOS Build 17763.437
April 09, 2019
KB4493509Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTEnd-user-defined characters (EUDC) may cause blue screen at startup
Back to topOS Build 17763.404
April 02, 2019
KB4490481Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
April 02, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Custom URI schemes may not start corresponding application
Back to topOS Build 17763.379
March 12, 2019
KB4489899Mitigated Last updated:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PTIssue using PXE to start a device from WDS Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
+
Back to topOS Build 17763.379
March 12, 2019
KB4489899Mitigated Last updated:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PTApps may stop working after selecting an audio output device other than the default
Back to topOS Build 17763.348
March 01, 2019
KB4482887Resolved
KB4490481Resolved:
April 02, 2019
10:00 AM PT
Opened:
March 01, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topOS Build 17763.316
February 12, 2019
KB4487044Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: November 2018
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topOS Build 17763.253
January 08, 2019
KB4480116Mitigated Last updated:
January 08, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Back to topOS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topOS Build 17763.253
January 08, 2019
KB4480116Resolved
KB4493509Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
new file mode 100644
index 0000000000..9c9b11c520
--- /dev/null
+++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -0,0 +1,123 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 7 and Windows Server 2008 R2 SP1
+metadata:
+ document_id:
+ title: Windows 7 and Windows Server 2008 R2 SP1
+ description: View annoucements and review known issues and fixes for Windows 7 and Windows Server 2008 R2 SP1
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 7 and Windows Server 2008 R2 SP1. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort
Back to topOS Build 17763.134
November 13, 2018
KB4467708Mitigated Last updated:
March 15, 2019
12:00 PM PT
Opened:
November 13, 2018
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated System may be unresponsive after restart if Avira antivirus software installed
Devices with Avira antivirus software installed may become unresponsive upon restart.
See details >April 09, 2019
KB4493472Investigating April 25, 2019
02:00 PM PTAuthentication may fail for services after the Kerberos ticket expires
Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.
See details >March 12, 2019
KB4489878Mitigated April 25, 2019
02:00 PM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.
See details >April 09, 2019
KB4493472Mitigated April 25, 2019
02:00 PM PTSystem may be unresponsive after restart if ArcaBit antivirus software installed
Devices with ArcaBit antivirus software installed may become unresponsive upon restart.
See details >April 09, 2019
KB4493472Mitigated April 25, 2019
02:00 PM PTSystem may be unresponsive after restart with certain McAfee antivirus products
Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.
See details >April 09, 2019
KB4493472Mitigated April 25, 2019
02:00 PM PTDevices may not respond at login or Welcome screen if running certain Avast software
Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.
See details >April 09, 2019
KB4493472Resolved April 25, 2019
02:00 PM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >January 08, 2019
KB4480970Resolved
KB4493472April 09, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >March 12, 2019
KB4489878Resolved
KB4493472April 09, 2019
10:00 AM PTNETDOM.EXE fails to run
NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.
See details >March 12, 2019
KB4489878Resolved
KB4493472April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4486563Resolved
KB4493472April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History System may be unresponsive after restart if Avira antivirus software installed
Back to topApril 09, 2019
KB4493472Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Back to topApril 09, 2019
KB4493472Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem may be unresponsive after restart if ArcaBit antivirus software installed
Back to topApril 09, 2019
KB4493472Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem may be unresponsive after restart with certain McAfee antivirus products
Back to topApril 09, 2019
KB4493472Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTDevices may not respond at login or Welcome screen if running certain Avast software
Back to topApril 09, 2019
KB4493472Resolved Resolved:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Authentication may fail for services after the Kerberos ticket expires
Back to topMarch 12, 2019
KB4489878Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Back to topMarch 12, 2019
KB4489878Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PTNETDOM.EXE fails to run
Back to topMarch 12, 2019
KB4489878Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4486563Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
new file mode 100644
index 0000000000..4a94eba224
--- /dev/null
+++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
@@ -0,0 +1,126 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 8.1 and Windows Server 2012 R2
+metadata:
+ document_id:
+ title: Windows 8.1 and Windows Server 2012 R2
+ description: View annoucements and review known issues and fixes for Windows 8.1 and Windows Server 2012 R2
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows 8.1 and Windows Server 2012 R2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Internet Explorer 11 authentication issue with multiple concurrent logons
Back to topJanuary 08, 2019
KB4480970Resolved
KB4493472Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated System may be unresponsive after restart if Avira antivirus software installed
Devices with Avira antivirus software installed may become unresponsive upon restart.
See details >April 09, 2019
KB4493446Investigating April 25, 2019
02:00 PM PTIssue using PXE to start a device from WDS
There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.
See details >March 12, 2019
KB4489881Mitigated April 25, 2019
02:00 PM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.
See details >April 09, 2019
KB4493446Mitigated April 25, 2019
02:00 PM PTSystem may be unresponsive after restart if ArcaBit antivirus software installed
Devices with ArcaBit antivirus software installed may become unresponsive upon restart.
See details >April 09, 2019
KB4493446Mitigated April 25, 2019
02:00 PM PTCertain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.
See details >January 08, 2019
KB4480963Mitigated April 25, 2019
02:00 PM PTSystem may be unresponsive after restart with certain McAfee antivirus products
Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.
See details >April 09, 2019
KB4493446Mitigated April 18, 2019
05:00 PM PTDevices may not respond at login or Welcome screen if running certain Avast software
Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.
See details >April 09, 2019
KB4493446Resolved April 25, 2019
02:00 PM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >January 08, 2019
KB4480963Resolved
KB4493446April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding.
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >January 08, 2019
KB4480963Resolved
KB4493446April 09, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.
See details >March 12, 2019
KB4489881Resolved
KB4493446April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4487000Resolved
KB4493446April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History System may be unresponsive after restart if Avira antivirus software installed
Back to topApril 09, 2019
KB4493446Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Back to topApril 09, 2019
KB4493446Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem may be unresponsive after restart if ArcaBit antivirus software installed
Back to topApril 09, 2019
KB4493446Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem may be unresponsive after restart with certain McAfee antivirus products
Back to topApril 09, 2019
KB4493446Mitigated Last updated:
April 18, 2019
05:00 PM PT
Opened:
April 09, 2019
10:00 AM PTDevices may not respond at login or Welcome screen if running certain Avast software
Back to topApril 09, 2019
KB4493446Resolved Resolved:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Issue using PXE to start a device from WDS Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
+
Back to topMarch 12, 2019
KB4489881Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTCustom URI schemes may not start corresponding application
Back to topMarch 12, 2019
KB4489881Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4487000Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml
new file mode 100644
index 0000000000..40672e97b4
--- /dev/null
+++ b/windows/release-information/status-windows-server-2008-sp2.yml
@@ -0,0 +1,105 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows Server 2008 SP2
+metadata:
+ document_id:
+ title: Windows Server 2008 SP2
+ description: View annoucements and review known issues and fixes for Windows Server 2008 SP2
+ keywords: Windows, Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows Server 2008 SP2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topJanuary 08, 2019
KB4480963Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Back to topJanuary 08, 2019
KB4480963Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding.
Back to topJanuary 08, 2019
KB4480963Resolved
KB4493446Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated System may be unresponsive after restart if Avira antivirus software installed
Devices with Avira antivirus software installed may become unresponsive upon restart.
See details >April 09, 2019
KB4493471Investigating April 25, 2019
02:00 PM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.
See details >April 09, 2019
KB4493471Mitigated April 25, 2019
02:00 PM PTAuthentication may fail for services after the Kerberos ticket expires
Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.
See details >March 12, 2019
KB4489880Mitigated April 25, 2019
02:00 PM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4487023Resolved
KB4493471April 09, 2019
10:00 AM PTNETDOM.EXE fails to run
NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.
See details >March 12, 2019
KB4489880Resolved
KB4493471April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History System may be unresponsive after restart if Avira antivirus software installed
Back to topApril 09, 2019
KB4493471Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Back to topApril 09, 2019
KB4493471Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Authentication may fail for services after the Kerberos ticket expires
Back to topMarch 12, 2019
KB4489880Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PTNETDOM.EXE fails to run
Back to topMarch 12, 2019
KB4489880Resolved
KB4493471Resolved:
April 09, 2019
10:00 AM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml
new file mode 100644
index 0000000000..046f75de26
--- /dev/null
+++ b/windows/release-information/status-windows-server-2012.yml
@@ -0,0 +1,118 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows Server 2012
+metadata:
+ document_id:
+ title: Windows Server 2012
+ description: View annoucements and review known issues and fixes for Windows Server 2012
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+- items:
+ - type: markdown
+ text: "
+ Find information on known issues for Windows Server 2012. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+
+ "
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 3
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+- items:
+ - type: markdown
+ text: "
+
+ "
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4487023Resolved
KB4493471Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
+
+- title: Known issues
+- items:
+ - type: markdown
+ text: "
+
+ "
+
+- title: Issue details
+- items:
+ - type: markdown
+ text: "
+ Summary Originating update Status Last updated System may be unresponsive after restart if Avira antivirus software installed
Devices with Avira antivirus software installed may become unresponsive upon restart.
See details >April 09, 2019
KB4493451Investigating April 25, 2019
02:00 PM PTIssue using PXE to start a device from WDS
There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.
See details >March 12, 2019
KB4489891Mitigated April 25, 2019
02:00 PM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.
See details >April 09, 2019
KB4493451Mitigated April 25, 2019
02:00 PM PTCertain operations performed on a Cluster Shared Volume may fail
Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.
See details >January 08, 2019
KB4480975Mitigated April 25, 2019
02:00 PM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.
See details >January 08, 2019
KB4480975Resolved
KB4493451April 09, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
See details >January 08, 2019
KB4480975Resolved
KB4493451April 09, 2019
10:00 AM PTEmbedded objects may display incorrectly
Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.
See details >February 12, 2019
KB4487025Resolved
KB4493451April 09, 2019
10:00 AM PT
+ "
+
+- title: March 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History System may be unresponsive after restart if Avira antivirus software installed
Back to topApril 09, 2019
KB4493451Investigating Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PTSystem unresponsive after restart if Sophos Endpoint Protection installed
Back to topApril 09, 2019
KB4493451Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
April 09, 2019
10:00 AM PT
+ "
+
+- title: February 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Issue using PXE to start a device from WDS Wdsutil /Set-TransportServer /EnableTftpVariableWindowExtension:No
+
Back to topMarch 12, 2019
KB4489891Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
March 12, 2019
10:00 AM PT
+ "
+
+- title: January 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Embedded objects may display incorrectly
Back to topFebruary 12, 2019
KB4487025Resolved
KB4493451Resolved:
April 09, 2019
10:00 AM PT
Opened:
February 12, 2019
10:00 AM PT
+ "
diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml
new file mode 100644
index 0000000000..2a4ba41456
--- /dev/null
+++ b/windows/release-information/windows-message-center.yml
@@ -0,0 +1,97 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10 message center
+metadata:
+ document_id:
+ title: Windows 10 message center
+ description: Windows 10 message center
+ keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+ ms.localizationpriority: high
+ author: greg-lindsay
+ ms.author: greglin
+ manager: dougkim
+ ms.topic: article
+ ms.devlang: na
+
+sections:
+
+- items:
+ - type: list
+ style: cards
+ className: cardsM
+ columns: 2
+ items:
+
+ - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540
+ html: Read the announcement >
+ image:
+ src: https://docs.microsoft.com//media/common/i_deploy.svg
+ title: Windows 10, version 1809 designated for broad deployment
+ - href: https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency
+ html: Find out more >
+ image:
+ src: https://docs.microsoft.com/media/common/i_whats-new.svg
+ title: Improvements to the Windows 10 update experience are coming
+ - href: https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience
+ html: Learn about our approach >
+ image:
+ src: https://docs.microsoft.com/media/common/i_investigate.svg
+ title: How do we measure and improve the quality of Windows?
+ - href: https://docs.microsoft.com/windows/windows-10/release-information
+ html: Visit the Windows 10 release information page >
+ image:
+ src: https://docs.microsoft.com/media/common/i_download-monitor.svg
+ title: Find a list of currently supported versions and previous releases
+
+- title: Recent announcements
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History Certain operations performed on a Cluster Shared Volume may fail
Back to topJanuary 08, 2019
KB4480975Mitigated Last updated:
April 25, 2019
02:00 PM PT
Opened:
January 08, 2019
10:00 AM PTInternet Explorer 11 authentication issue with multiple concurrent logons
Back to topJanuary 08, 2019
KB4480975Resolved
KB4493451Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PTMSXML6 may cause applications to stop responding
Back to topJanuary 08, 2019
KB4480975Resolved
KB4493451Resolved:
April 09, 2019
10:00 AM PT
Opened:
January 08, 2019
10:00 AM PT
+ "
diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md
index 0b2f989db7..3b7f39ee7e 100644
--- a/windows/security/identity-protection/access-control/active-directory-security-groups.md
+++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md
@@ -258,279 +258,286 @@ The following tables provide descriptions of the default groups that are located
Message Date Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support
A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update.April 19, 2019
10:00 AM PTThe benefits of Windows 10 Dynamic Update
+
+April 17, 2019
11:26 AM PTImprovements to the Windows 10 update experience are coming
Find out about the changes coming to the Windows update process that will improve the experience, offer users more control, and improve the quality of Windows updates.April 04, 2019
09:00 AM PTTake action: review your Windows Update for Business deferral values
+
+
+In order avoid this, you need to set your feature update deferral policy to 273 days or less.April 03, 2019
05:47 PM PTFind a list of currently supported versions and previous releases
Every Windows product has a lifecycle. The lifecycle begins when a product is released and ends when it is no longer serviced or supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade, or make other changes to your software. Check out the updated Windows 10 release information page for a list of current versions by servicing option as well as end of service dates.March 28, 2019
02:00 PM PTWindows 10, version 1809 designated for broad deployment
Based on the data and the feedback we’ve received from consumers, OEMs, ISVs, partners, and commercial customers, Windows 10, version 1809 has transitioned to broad deployment. With this, the Windows 10 release information page will now reflect Semi-Annual Channel (SAC) for version 1809.March 28, 2019
10:00 AM PTReminder: Additional servicing for the Windows 10 Enterprise, Education, and IoT Enterprise, version 1607 ends April 9, 2019 March 12, 2019
10:00 AM PTReminder: Windows 10 Home, Pro, Pro for Workstations, and IoT Core, version 1709 will reach end of service on April 9, 2019 March 12, 2019
10:00 AM PTTake action: Install standalone security updates to introduce SHA-2 code sign support for Windows 7 amd Windows Server 2008 R2
A standalone SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7 is now available, as is a servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1 that includes the SHA-2 code signing support update.March 12, 2019
10:00 AM PTTake action: Install standalone update for WSUS 3.0 SP2 to support the delivery of SHA-2 signed updates
A standalone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.March 12, 2019
10:00 AM PTReminder: Final Delta update for Windows 10, version 1607, 1703, 1709, and 1803 will be April 9, 2019
March 12th and April 9th will be the last two Delta updates for Windows 10, version 1607, 1703, 1709, and 1803. Security and quality updates will continue to be available via the express and full cumulative update packages.March 12, 2019
10:00 AM PTHow do we measure and improve the quality of Windows?
+
+March 06, 2019
10:23 AM PTGetting to know the Windows update history pages February 21, 2019
06:37 PM PTShare your feedback: Windows update history
We read every comment you leave on our update history pages, and are always looking to improve these pages and the monthly knowledge base (KB) articles that accompany each monthly update. Take our survey and let us know how we can improve our transparency further and make these more compelling and useful to you and your organization.February 21, 2019
12:00 PM PTPlan for change: Windows Update for Business and the retirement of SAC-T
Beginning with Windows 10, version 1903 (the next feature update for Windows 10), the Windows 10 release information page will no longer list SAC-T information for version 1903 and future feature updates. Instead, you will find a single entry for each new SAC release. In addition, if you are using Windows Update for Business, you will see new UI and behavior to reflect that there is only one release date for each SAC release. If you use System Center Configuration Manager, Windows Server Update Services (WSUS), or other management tools, there will now only be one feature update published to WSUS, and this will occur at the time of release. Learn how this change will affect Windows Business for Update customers.February 14, 2019
12:00 PM PTChamps corner: Classifying Windows updates in common deployment tools
If you utilize automated update deployment tools, such as Windows Server Update Services (WSUS) or System Center Configuration Manager, you likely use automatic rules to streamline the approval and deployment of Windows updates. Using the correct update classification is, therefore, an important component of your organization’s device update process. Explore the options available and how to approach it in a WSUS or Configuration Manager environment.February 05, 2019
10:34 AM PTUpdate: Delta updates for Windows 10, version 1607, 1703, 1709, and 1803 will be available until April 9, 2019
Based on customer feedback, we are extending Delta update publication for Windows 10 versions 1607, 1703, 1709, and 1803. We will continue to provide Delta updates via the Microsoft Update Catalog through April 9th, 2019, which will be the last delta update available.February 05, 2019
09:00 AM PTGlobal DNS outage affecting Windows Update customers
Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider’s global outage. A software update to the external provider’s DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored.January 29, 2019
04:15 PM PTApplication compatibility in the Windows ecosystem
Our application ecosystem is incredibly diverse, encompassing tens of millions of applications (apps) with numerous versions, languages, architectures, services and configuration options. While our ecosystem is complex, our vision is simple. All apps on Windows devices should just work! Explore the various programs and technologies we use to improve application compatibility.January 15, 2019
10:00 AM PTModern desktop servicing: the year in review
2018 was a pivotal year for the modern desktop and the servicing transformation journey we have been taking with you and your organization. In this post, John Wilcox takes a look back and recaps the progress that has been made, highlighting significant events, and provideing nsight into what 2019 has in store.December 19, 2018
02:20 PM PTDriver quality in the Windows ecosystem
Ensuring Windows 10 works great with all the devices and accessories our customers use is a top priority. We work closely with this broad mix of partners to test new drivers, monitor health characteristics over time, and make Windows and our ecosystem more resilient architecturally. Our goal is to ensure that all the updates and drivers we deliver to non-Insider populations are validated and at production quality (including monthly optional releases) before pushing drivers broadly to all. Explore the driver distribution chain and learn how we measure driver quality and prevent conflicts.December 19, 2018
10:04 AM PTIntroducing the Modern Desktop podcast series
In this new podcast series, we'll explore the good, the bad, and, yes, the ugly of servicing and delivery for Windows 10 and Office 365 ProPlus. We'll talk about modern desktop management through Enterprise Mobility, security, and cloud-attached and co-managed environments. Listen to the first episode, in which we discuss monthly quality updates fpr Windows 10, the Microsoft 365 Stay Current pilot program, and interview a real customer to see how they ingest monthly updates in their organization.December 18, 2018
01:00 PM PTMeasuring Delivery Optimization and its impact to your network
If you've familiarized yourself with the configuration options for Delivery Optimization in Windows 10, and have started to configure the settings you feel will be the best fit for your organization’s network topology, now is the time to see how well those settings are working. This article provides tips on how evaluate performance at the device level or organization level.December 13, 2018
03:48 PM PTWindows monthly security and quality updates overview
Today’s global cybersecurity threats are both dynamic and sophisticated, and new vulnerabilities are discovered almost every day. We focus on protecting customers from these security threats by providing security updates on a timely basis and with high quality. Find out how how we deliver these critical updates on a massive scale as a key component of our ongoing Windows as a service effort.December 10, 2018
10:00 AM PTLTSC: What is it, and when should it be used?
With the Semi-Annual Channel, devices receive two feature updates per year, and benefit from the best performance, user experience, security, and stability. This servicing option continues to be our recommendation for managing Windows 10 updates; however, we acknowledge that certain devices and use cases (e.g. medical systems and industrial process controllers) dictate that functionality and features don’t change over time. Find out how we designed the Long-Term Servicing Channel (LTSC) with these types of use cases in mind, and what is offered through the LTSC.November 29, 2018
07:02 PM PTPlan for change: Local Experience Packs: What are they and when should you use them?
When we released Windows 10, version 1803, we introduced Local Experience Packs (LXPs), which are modern language packs delivered through the Microsoft Store or Microsoft Store for Business. Learn about the biggest advantage to LXPs, and the retirement of legacy language packs (lp.cab) for all Language Interface Packs (LIP).November 14, 2018
11:10 AM PTWindows 10 Quality approach for a complex ecosystem
While our measurements of quality show improving trends on aggregate for each successive Windows 10 release, if a single customer experiences an issue with any of our updates, we take it seriously. In this blog post, Windows CVP Mike Fortin shares an overview of how we work to continuously improve the quality of Windows and our Windows as a service approach. This blog will be the first in a series of more in-depth explanations of the work we do to deliver quality in our Windows releases.November 13, 2018
10:00 AM PTWindows 10, version 1809 rollout resumes; now available on VLSC
Today we are resuming the rollout of the latest Windows 10 feature update—Windows 10, version 1809—via the Software Download Center (via Update Assistant or the Media Creation Tool), Windows Server Update Services (WSUS), and Windows Update for Business. Windows 10, version 1809 is also now available on the Volume Licensing Service Center (VLSC).November 13, 2018
10:00 AM PTExpress updates for Windows Server 2016 re-enabled for November 2018 update
Starting with the November 13, 2018 Update Tuesday release, Windows will again publish Express updates for Windows Server 2016. That means that system administrators for WSUS and System Center Configuration Manager will once again see two packages for the Windows Server 2016 update: a Full update and an Express update. Read this article for more details.November 12, 2018
03:00 PM PTPlan for change: 2019 SHA-2 code signing support requirement for Windows and WSUS November 09, 2018
10:00 AM PT
[Device Owners](#bkmk-device-owners)
Yes
Yes
Yes
Yes
[Distributed COM Users](#bkmk-distributedcomusers)
Yes
Yes
Yes
Yes
[DnsUpdateProxy](#bkmk-dnsupdateproxy)
Yes
Yes
Yes
Yes
[DnsAdmins](#bkmk-dnsadmins)
Yes
Yes
Yes
Yes
[Domain Admins](#bkmk-domainadmins)
Yes
Yes
Yes
Yes
[Domain Computers](#bkmk-domaincomputers)
Yes
Yes
Yes
Yes
[Domain Controllers](#bkmk-domaincontrollers)
Yes
Yes
Yes
Yes
[Domain Guests](#bkmk-domainguests)
Yes
Yes
Yes
Yes
[Domain Users](#bkmk-domainusers)
Yes
Yes
Yes
Yes
[Enterprise Admins](#bkmk-entadmins)
Yes
Yes
Yes
Yes
[Enterprise Key Admins](#bkmk-enterprise-key-admins)
[Enterprise Key Admins](#enterprise-key-admins)
Yes
[Enterprise Read-only Domain Controllers](#bkmk-entrodc)
Yes
Yes
Yes
Yes
[Event Log Readers](#bkmk-eventlogreaders)
Yes
Yes
Yes
Yes
[Group Policy Creator Owners](#bkmk-gpcreatorsowners)
Yes
Yes
Yes
Yes
[Guests](#bkmk-guests)
Yes
Yes
Yes
Yes
[Hyper-V Administrators](#bkmk-hypervadministrators)
Yes
Yes
Yes
[IIS_IUSRS](#bkmk-iis-iusrs)
Yes
Yes
Yes
Yes
[Incoming Forest Trust Builders](#bkmk-inforesttrustbldrs)
Yes
Yes
Yes
Yes
[Key Admins](#key-admins)
Yes
[Network Configuration Operators](#bkmk-networkcfgoperators)
Yes
Yes
Yes
Yes
[Performance Log Users](#bkmk-perflogusers)
Yes
Yes
Yes
Yes
[Performance Monitor Users](#bkmk-perfmonitorusers)
Yes
Yes
Yes
Yes
[Pre–Windows 2000 Compatible Access](#bkmk-pre-ws2kcompataccess)
Yes
Yes
Yes
Yes
[Print Operators](#bkmk-printoperators)
Yes
Yes
Yes
Yes
[Protected Users](#bkmk-protectedusers)
Yes
Yes
[RAS and IAS Servers](#bkmk-rasandias)
Yes
Yes
Yes
Yes
[RDS Endpoint Servers](#bkmk-rdsendpointservers)
Yes
Yes
Yes
[RDS Management Servers](#bkmk-rdsmanagementservers)
Yes
Yes
Yes
[RDS Remote Access Servers](#bkmk-rdsremoteaccessservers)
Yes
Yes
Yes
[Read-only Domain Controllers](#bkmk-rodc)
Yes
Yes
Yes
Yes
[Remote Desktop Users](#bkmk-remotedesktopusers)
Yes
Yes
Yes
Yes
[Remote Management Users](#bkmk-remotemanagementusers)
Yes
Yes
Yes
[Replicator](#bkmk-replicator)
Yes
Yes
Yes
Yes
[Schema Admins](#bkmk-schemaadmins)
Yes
Yes
Yes
Yes
[Server Operators](#bkmk-serveroperators)
Yes
Yes
Yes
Yes
[Storage Replica Administrators](#storage-replica-administrators)
Yes
[System Managed Accounts Group](#system-managed-accounts-group)
Yes
[Terminal Server License Servers](#bkmk-terminalserverlic)
Yes
Yes
Yes
Yes
[Users](#bkmk-users)
Yes
Yes
Yes
Yes
[Windows Authorization Access Group](#bkmk-winauthaccess)
Yes
Yes
Yes
Yes
[WinRMRemoteWMIUsers_](#bkmk-winrmremotewmiusers-)
Yes
| Attribute | +Value | +
|---|---|
Well-Known SID/RID |
+S-1-5-32-583 |
+
Type |
+BuiltIn Local |
+
Default container |
+CN=BuiltIn, DC=<domain>, DC= |
+
Default members |
+None |
+
Default member of |
+None |
+
Protected by ADMINSDHOLDER? |
+No |
+
Safe to move out of default container? |
+Can be moved out but it is not recommended |
+
Safe to delegate management of this group to non-Service admins? |
+No |
+
Default User Rights |
+[Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight +[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight +[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege +[Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege + |
+
Azure Active Directory joined devices authenticate to Azure during sign-in and can optional authenticate to Active Directory. Hybrid Azure Active Directory joined devices authenticate to Active Directory during sign-in, and authenticate to Azure Active Directory in the background.
-[Azure AD join authentication to Azure Active Directory](#Azure-AD-join-authentication-to-Azure-Active-Directory)
-[Azure AD join authentication to Active Directory using a Key](#Azure-AD-join-authentication-to-Active-Directory-using-a-Key)
-[Azure AD join authentication to Active Directory using a Certificate](#Azure-AD-join-authentication-to-Active-Directory-using-a-Certificate)
-[Hybrid Azure AD join authentication using a Key](#Hybrid-Azure-AD-join-authentication-using-a-Key)
-[Hybrid Azure AD join authentication using a Certificate](#Hybrid-Azure-AD-join-authentication-using-a-Certificate)
+[Azure AD join authentication to Azure Active Directory](#azure-ad-join-authentication-to-azure-active-directory)
+[Azure AD join authentication to Active Directory using a Key](#azure-ad-join-authentication-to-active-directory-using-a-key)
+[Azure AD join authentication to Active Directory using a Certificate](#azure-ad-join-authentication-to-active-directory-using-a-certificate)
+[Hybrid Azure AD join authentication using a Key](#hybrid-azure-ad-join-authentication-using-a-key)
+[Hybrid Azure AD join authentication using a Certificate](#hybrid-azure-ad-join-authentication-using-a-certificate)
## Azure AD join authentication to Azure Active Directory @@ -40,7 +40,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |D | The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.| |E | The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT, and informs winlogon of the success authentication. Winlogon creates a logon session, loads the user's profile, and starts explorer.exe.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Azure AD join authentication to Active Directory using a Key  @@ -52,7 +51,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |C | The Kerberos provider ensures it can trust the response from the domain controller. First, it ensures the KDC certificate chains to a root certificate that is trusted by the device. Next, it ensures the certificate is within its validity period and that it has not be revoked. The Kerberos provider then verifies the certificate has the KDC Authentication present and that the subject alternate name listed in the KDC's certificate matches the domain name to which the user is authenticating. After passing this criteria, Kerberos returns the TGT to lsass, where it is cached and used for subsequent service ticket requests.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Azure AD join authentication to Active Directory using a Certificate  @@ -62,7 +60,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |B | The Kerberos provider sends the signed pre-authentication data and user's certificate, which includes the public key, to the Key Distribution Center (KDC) service running on the domain controller in the form of a KERB_AS_REQ.
The domain controller determines the certificate is not self-signed certificate. The domain controller ensures the certificate chains to trusted root certificate, is within its validity period, can be used for authentication, and has not been revoked. It retrieves the public key and UPN from the certificate included in the KERB_AS_REQ and searches for the UPN in Active Directory. It validates the signed pre-authentication data using the public key from the certificate. On success, the KDC returns a TGT to the client with its certificate in a KERB_AS_REP.| |C | The Kerberos provider ensures it can trust the response from the domain controller. First, it ensures the KDC certificate chains to a root certificate that is trusted by the device. Next, it ensures the certificate is within its validity period and that it has not be revoked. The Kerberos provider then verifies the certificate has the KDC Authentication present and that the subject alternate name listed in the KDC's certificate matches the domain name to which the user is authenticating. After passing this criteria, Kerberos returns the TGT to lsass, where it is cached and used for subsequent service ticket requests.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Hybrid Azure AD join authentication using a Key  @@ -76,7 +73,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Hybrid Azure AD join authentication using a Certificate  @@ -90,6 +86,3 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) - - diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md index 5bdfbc21f8..530d0923a7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index f07f4f199a..23eed38ace 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -28,6 +28,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Azure AD joined provisioning in a Federated environment](#azure-ad-joined-provisioning-in-a-federated-environment)
[Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-key-trust-deployment-in-a-managed-environment)
[Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-certificate-trust-deployment-in-a-managed-environment)
+[Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Federated environment](#hybrid-azure-ad-joined-provisioning-in-a-certificate-trust-deployment-in-a-managed-environment)
[Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-synchronous-certificate-trust-deployment-in-a-managed-environment)
[Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](#hybrid-azure-ad-joined-provisioning-in-a-synchronous-certificate-trust-deployment-in-a-federated-environment)
[Domain joined provisioning in an On-premises Key Trust deployment](#domain-joined-provisioning-in-an-on-premises-key-trust-deployment)
@@ -56,7 +57,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, |C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns key ID to the application which signals the end of user provisioning and the application exits.| [Return to top](#windows-hello-for-business-provisioning) -## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed envrionment +## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment  | Phase | Description | diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md index e3304e2432..4ef877a48b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -45,4 +45,4 @@ Provision can occur automatically through the out-of-box-experience (OOBE) on Az Authentication using Windows Hello for Business is the goal, and the first step in getting to a passwordless environment. With the device registered, and provisioning complete. Users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is avaiable on most computers and devices. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. The PIN nor the private portion of the credential are never sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential. -[How Windows Hello for Business authentication works](hello-how-it-works-authentication.md) \ No newline at end of file +[How Windows Hello for Business authentication works](hello-how-it-works-authentication.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 936c4a59e4..d12e00c028 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -187,7 +187,7 @@ Joining a device is an extension to registering a device. This means, it provide [Return to Top](hello-how-it-works-technology.md) ## Key Trust -The key trust model uses the user's Windows Hello for Business identity to authenticate to on-premises Active Directory. The certificate trust model is supported in hybrid and on-premises deployments and requires Windows Server 2016 domain controllers. +The key trust model uses the user's Windows Hello for Business identity to authenticate to on-premises Active Directory. The key trust model is supported in hybrid and on-premises deployments and requires Windows Server 2016 domain controllers. ### Related topics [Certificate Trust](#certificate-trust), [Deployment Type](#deployment-type), [Hybrid Azure AD Joined](#hybrid-azure-ad-joined), [Hybrid Deployment](#hybrid-deployment), [On-premises Deployment](#on-premises-deployment), [Trust Type](#trust-type) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index d5904c2e0e..97783034ca 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -41,4 +41,4 @@ Windows Hello for Business is a distributed system that uses several components - [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index d231dc9a9c..bf17a84426 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 5ea3bbbae9..b571ee817f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index 2bfa7ac0bd..fbd5a696c5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 4b487da424..2e3ac6b145 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -145,4 +145,4 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation 3. New Installation Baseline (*You are here*) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index cfbf292815..bab9bcf458 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index 6f443cff4f..6b4a465a9c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -71,7 +71,7 @@ The minimum required enterprise certificate authority that can be used with Wind ## Directory Synchronization ## The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. -Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect +Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema). ### Section Review > [!div class="checklist"] @@ -82,7 +82,7 @@ Organizations using older directory synchronization technology, such as DirSync
## Federation ## -Federating your on-premises Active Directory with Azure Active Directory ensures all identities have access to all resources regardless if they reside in cloud or on-premises. Windows Hello for Business hybrid certificate trust needs Windows Server 2016 Active Directory Federation Services. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. +Windows Hello for Business hybrid certificate trust requires Active Directory being federated with Azure Active Directory and needs Windows Server 2016 Active Directory Federation Services or newer. Windows Hello for Business hybrid certificate trust doesn’t support Managed Azure Active Directory using Pass-through authentication or password hash sync. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index 317a2481b3..f8613819f5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -52,4 +52,4 @@ Regardless of the baseline you choose, you’re next step is to familiarize your 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 5350a7e35a..e295b98d48 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -1,4 +1,4 @@ ---- +--- title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) description: Provisioning for Hybrid Windows Hello for Business Deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,7 +18,7 @@ ms.date: 08/19/2018 # Hybrid Windows Hello for Business Provisioning **Applies to** -- Windows 10, version 1703 or later +- Windows10, version 1703 or later - Hybrid deployment - Certificate trust @@ -65,7 +65,7 @@ After a successful key registration, Windows creates a certificate request using The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. -The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center. +The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current users certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center.
@@ -77,5 +77,5 @@ The certificate authority validates the certificate was signed by the registrati 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md) -6. Sign-in and Provision(*You are here*) +6. Sign-in and Provision(*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index 4f7dca8320..005677d027 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -78,4 +78,4 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: Active Directory (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index fb95263ea4..5784150435 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 559462a9db..9333aeef18 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 56921a06b0..59da54619d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 0ffc39e4d5..621cb9ab0b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -201,4 +201,4 @@ Users must receive the Windows Hello for Business group policy settings and have 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business policy settings (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 49af90f1e4..3d78b7a719 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -48,4 +48,4 @@ For the most efficient deployment, configure these technologies in order beginni 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 27ed68512f..d9874f88c3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index baf9a0401a..9a49d7ab15 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 3e829f4aa7..2c4dc3093c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -43,4 +43,4 @@ Next, you need to synchronizes the on-premises Active Directory with Azure Activ 4. Configure Directory Synchronization (*You are here*) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 1993139da7..f59a78c750 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 6759f1e112..303b6ce403 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -50,4 +50,4 @@ You’re next step is to familiarize yourself with the prerequisites needed for 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 47f83cea11..b4bdf83a77 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -1,4 +1,4 @@ ---- +--- title: Hybrid Windows Hello for Business key trust Provisioning (Windows Hello for Business) description: Provisioning for Hybrid Windows Hello for Business Deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,7 +18,7 @@ ms.date: 08/20/2018 # Hybrid Windows Hello for Business Provisioning **Applies to** -- Windows 10, version 1703 or later +- Windows10, version 1703 or later - Hybrid deployment - Key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 1e1d1effdc..ce9f57fac1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 4ef86bfee8..3f6e263084 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 3382dcb530..080aa64f0a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 9f081c920a..92f7ec3365 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 448963dfbd..5aaee3a860 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 672ad0f33f..f537c8de17 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -50,7 +50,7 @@ The table shows the minimum requirements for each deployment. For key trust in a | Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
*Minimum:* Windows 10, version 1703
*Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).**Azure AD Joined:**
Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level | -| Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | +| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
andWindows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter| Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter | Azure MFA tenant, orAD FS w/Azure MFA adapter, orAD FS w/Azure MFA Server adapter, orAD FS w/3rd Party MFA Adapter | @@ -67,7 +67,7 @@ The table shows the minimum requirements for each deployment. | Windows 10, version 1703 or later | Windows 10, version 1703 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema| | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | -| Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | +| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | | AD FS with Azure MFA Server, orAD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, orAD FS with 3rd Party MFA Adapter | diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 5cef71faf7..d85cdee4d5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md index 1d92e64857..b6a8469679 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index e8cd8acaa1..44acd1c65e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -130,4 +130,4 @@ Users must receive the Windows Hello for Business group policy settings and have 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. Configure Windows Hello for Business Policy settings (*You are here*) \ No newline at end of file +5. Configure Windows Hello for Business Policy settings (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 4bd120cf26..50b9fe1ad7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: DaniHalfin audience: ITPro author: mikestephens-MS -ms.author: mstephen +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -47,4 +47,4 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 11c3a1d90a..0ac3dd3359 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 8c28287378..f7184f34a3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 773be29f77..58614660a4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: conceptual diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 04dc168342..1700566e52 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 9f76cf67c8..8d50174792 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index cea13ff9d2..4eedd3d8c6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -47,4 +47,4 @@ If the user can sign-in with a password, they can reset their PIN by clicking th > [!VIDEO https://www.youtube.com/embed/KcVTq8lTlkI] -For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. \ No newline at end of file +For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 5f1296e64e..cb2349d9bd 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index d4040d63f5..ccafee06af 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -89,7 +89,7 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r The Remote Desktop client device: -- Must be running at least Windows 10, version 1703 to be able to supply credentials. +- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. - Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host. - Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard. - Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk. @@ -176,4 +176,4 @@ mstsc.exe /remoteGuard - No credentials are sent to the target device, but the target device still acquires Kerberos Service Tickets on its own. -- The server and client must authenticate using Kerberos. \ No newline at end of file +- The server and client must authenticate using Kerberos. diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index 9879494122..1325357065 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -29,12 +29,14 @@ Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](h ## Managing devices joined to Azure Active Directory -Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access) to services like Exchange Online and SharePoint Online. +Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access) to services like Exchange Online and SharePoint Online. -Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 Business or Enterprise editions and on Windows Phones. +Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) to trigger encryption and store the recovery key in Azure AD. +This is applicable to Azure Hybrid AD as well. + ## Managing workplace-joined PCs and phones @@ -51,7 +53,7 @@ If you are installing a server manually, such as a stand-alone server, then choo Additionally, lights out data centers can take advantage of the enhanced security of a second factor while avoiding the need for user intervention during reboots by optionally using a combination of BitLocker (TPM+PIN) and BitLocker Network Unlock. BitLocker Network Unlock brings together the best of hardware protection, location dependence, and automatic unlock, while in the trusted location. For the configuration steps, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). - For more information, see the Bitlocker FAQs article and other useful links in [Related Articles](#articles). + For more information, see the Bitlocker FAQs article and other useful links in [Related Articles](#related-articles). ## PowerShell examples @@ -134,4 +136,4 @@ PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpace [BitLocker cmdlets for Windows PowerShell](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#a-href-idbkmk-blcmdletsabitlocker-cmdlets-for-windows-powershell) -[Surface Pro Specifications](https://www.microsoft.com/surface/support/surface-pro-specs) \ No newline at end of file +[Surface Pro Specifications](https://www.microsoft.com/surface/support/surface-pro-specs) diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index 86ebe29111..72fd992131 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -13,7 +13,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/17/2019 +ms.date: 04/24/2019 --- # Prepare your organization for BitLocker: Planning and policies @@ -201,8 +201,8 @@ However, you cannot use recovery passwords generated on a system in FIPS mode fo ## More information -- [Trusted Platform Module](/windows/security/hardware-protection/tpm/trusted-platform-module-overview.md) -- [TPM Group Policy settings](/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md) +- [Trusted Platform Module](https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-top-node) +- [TPM Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [BitLocker](bitlocker-overview.md) - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) diff --git a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index eacf850aab..f715eb932d 100644 --- a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -50,6 +50,24 @@ As a result, if the currently used PCR bank is switched all keys that have been Before switching PCR banks you should suspend or disable BitLocker – or have your recovery key ready. For steps on how to switch PCR banks on your PC, you should contact your OEM or UEFI vendor. +## How can I identify which PCR bank is being used? + +A TPM can be configured to have multiple PCR banks active. When BIOS is performing measurements it will do so into all active PCR banks, depending on its capability to make these measurements. BIOS may chose to deactivate PCR banks that it does not support or "cap" PCR banks that it does not support by extending a separator. The following registry value identifies which PCR banks are active. + +- Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IntegrityServices
+- DWORD: TPMActivePCRBanks
+- Defines which PCR banks are currently active. (This value should be interpreted as a bitmap for which the bits are defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 21 of Revision 1.27.)
+ +Windows checks which PCR banks are active and supported by the BIOS. Windows also checks if the measured boot log supports measurements for all active PCR banks. Windows will prefer the use of the SHA-256 bank for measurements and will fall back to SHA1 PCR bank if one of the pre-conditions is not met. + +You can identify which PCR bank is currently used by Windows by looking at the registry. + +- Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IntegrityServices
+- DWORD: TPMDigestAlgID
+- Algorithm ID of the PCR bank that Windows is currently using. (This value represents an algorithm identifier as defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 3 of Revision 1.27.)
+ +Windows only uses one PCR bank to continue boot measurements. All other active PCR banks will be extended with a separator to indicate that they are not used by Windows and measurements that appear to be from Windows should not be trusted. + ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 7728af0c4f..2a82682a3c 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -11,7 +11,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/17/2019 +ms.date: 04/29/2019 --- # Create a Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune @@ -27,13 +27,15 @@ Microsoft Intune has an easy way to create and deploy a Windows Information Prot You can create an app protection policy in Intune either with device enrollment for MDM or without device enrollment for MAM. The process to create either policy is similar, but there are important differences: -- If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Azure AD. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**), the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access. -- MAM supports only one user per device. -- MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md). - MAM has additional **Access** settings for Windows Hello for Business. - MAM can [selectively wipe company data](https://docs.microsoft.com/intune/apps-selective-wipe) from a user's personal device. - MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). - An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +- MAM supports only one user per device. +- MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md). +- Only MDM can use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) policies. +- If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Azure AD. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**), the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access. + ## Prerequisites diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md index 101b9976ad..6edf443eb3 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/05/2019 +ms.date: 04/30/2019 --- # Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager @@ -462,15 +462,6 @@ After you've decided where your protected apps can access enterprise data on you **To set your optional settings** 1. Choose to set any or all of the optional settings: - - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: - - - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. - - - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. - - >[!IMPORTANT] - >The **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box** option is only available for Configuration Manager versions 1610 and below. - - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - **Yes (recommended).** Turns on the feature and provides the additional protection. @@ -489,6 +480,8 @@ After you've decided where your protected apps can access enterprise data on you - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. + - **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Choose to set up Azure Rights Management with WIP](create-wip-policy-using-intune-azure.md#choose-to-set-up-azure-rights-management-with-wip). To confirm what templates your tenant has, run [Get-AadrmTemplate](https://docs.microsoft.com/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](https://docs.microsoft.com/azure/information-protection/administer-powershell). + 2. After you pick all of the settings you want to include, click **Summary**. ## Review your configuration choices in the Summary screen diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md index cfcae5b9de..02d2fe3e81 100644 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md @@ -13,15 +13,20 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/15/2019 +ms.date: 04/30/2019 --- # How Windows Information Protection (WIP) protects a file that has a sensitivity label **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- Windows 10, version 1903 - Windows 10, version 1809 +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label. Microsoft information protection technologies work together as an integrated solution to help enterprises: @@ -38,52 +43,73 @@ Microsoft information protection technologies include: - [Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security) is a cloud access security broker (CASB) solution that allows you to discover, classify, protect, and monitor user data in first-party and third-party Software-as-a-Service (SaaS) apps used by your organization. -End users can choose and apply sensitivity labels from a bar that appears below the ribbon in Office apps: +## How WIP protects sensitivity labels with endpoint data loss prevention + +You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center. +When you create a sensitivity label, you can specify that endpoint data loss prevention applies to content with that label. + + + +Office app users can choose a sensitivity label from a menu and apply it to a file.  -## Default WIP behaviors for a sensitivity label +WIP enforces default endpoint protection as follows: -Enterprises can create and manage sensitivity labels on the **Labels** page in the Office 365 Security & Compliance Center. -When you create a sensitivity label, you can specify that endpoint protection should apply to content with that label. -WIP enforces default endpoint protection depending on how the sensitivity label is configured: +- If endpoint data loss prevention is enabled, the device enforces work protection for any file with the label +- If endpoint data loss prevention is not enabled: + - The device enforces work protection to a file downloaded from a work site + - The device does not enforce work protection to a file downloaded from a personal site -- When the sensitivity label is configured for endpoint protection of content that includes business data, the device enforces work protection for documents with the label -- When the sensitivity label is *not configured* for endpoint protection, the device reverts to whatever WIP policy has been defined in Intune or System Center Configuration Manager (SCCM): - - If the document is downloaded from a work site, the device enforces work protection - - If the document is downloaded from a personal site, no work protection is applied - -For more information about labels, see [Overview of labels](https://docs.microsoft.com/office365/securitycompliance/labels). - -## Use cases - -This section covers how WIP works with sensitivity labels in specific use cases. - -### User downloads from or creates a document on a work site - -If WIP policy is deployed, any document that is downloaded from a work site, or created on a work site, will have WIP protection regardless of whether the document has a sensitivity label. - -If the document also has a sensitivity label, which can be Office or PDF files, WIP protection is applied according to the label. - -### User downloads a confidential Office or PDF document from a personal site - -Windows Defender Advanced Threat Protection (Windows Defender ATP) scans for any file that gets modified or created, including files that were created on a personal site. -If the file has a sensitivity label, the corresponding WIP protection gets applied even though the file came from a personal site. -For example: +Here's an example where a file remains protected without any work context beyond the sensitivity label: 1. Sara creates a PDF file on a Mac and labels it as **Confidential**. -2. She emails the PDF from her Gmail account to Laura. -3. Laura opens the PDF file on her Windows 10 device. -4. WIP policy gets applied and the file is protected. +1. She emails the PDF from her Gmail account to Laura. +1. Laura opens the PDF file on her Windows 10 device. +1. Windows Defender Advanced Threat Protection (Windows Defender ATP) scans Windows 10 for any file that gets modified or created, including files that were created on a personal site. +1. Windows Defender ATP triggers WIP policy. +1. WIP policy protects the file even though it came from a personal site. -The PDF file doesn't need any work context beyond the sensitivity label. +## How WIP protects automatically classified files + +The next sections cover how Windows Defender ATP extends discovery and protection of sensitive information with improvements in Windows 10 version 1903. + +### Discovery + +Windows Defender ATP can extract the content of the file itself and evaluate whether it contains sensitive information types such as credit card numbers or employee ID numbers. +When you create a sensitivity label, you can specify that the label be added to any file that contains a sensitive information type. + + + +A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver’s license numbers, and so on. +You can also [create a custom sensitive information type](https://docs.microsoft.com/office365/securitycompliance/create-a-custom-sensitive-information-type), which can include any keyword or expression that you want to evaluate. + +### Protection + +When a file is created or edited on a Windows 10 endpoint, Windows Defender ATP extracts the content and evaluates if it contains any default or custom sensitive information types that have been defined. +If the file has a match, Windows Defender ATP applies endpoint data loss prevention even if the file had no label previously. + +Windows Defender ATP is integrated with Azure Information Protection for data discovery and reports sensitive information types that were discovered. +Azure Information Protection aggregates the files with sensitivity labels and the sensitive information types they contain across the enterprise. + + + +You can see sensitive information types in Microsoft 365 compliance under **Classifications**. Default sensitive information types have Microsoft as the publisher. The publisher for custom types is the tenant name. + + + +>[!NOTE] +>Automatic classification does not change the file itself, but it applies protection based on the label. +>WIP protects a file that contains a sensitive information type as a work file. +>Azure Information Protection works differently in that it extends a file with a new attribute so the protection persists if the file is copied. ## Prerequisites -- Windows 10, version 1809 -- [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection) scans content for a label and applies corresponding WIP protection -- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in the Office 365 Security & Compliance Center -- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager (SCCM)](overview-create-wip-policy-sccm.md). +- Endpoint data loss prevention requires Windows 10, version 1809 +- Auto labelling requires Windows 10, version 1903 +- Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy +- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center +- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager (SCCM)](overview-create-wip-policy-sccm.md) diff --git a/windows/security/information-protection/windows-information-protection/images/azure-data-discovery.png b/windows/security/information-protection/windows-information-protection/images/azure-data-discovery.png new file mode 100644 index 0000000000..0148a800b2 Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/azure-data-discovery.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/sensitive-info-types.png b/windows/security/information-protection/windows-information-protection/images/sensitive-info-types.png new file mode 100644 index 0000000000..58f675399a Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/sensitive-info-types.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/sensitivity-label-auto-label.png b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-auto-label.png new file mode 100644 index 0000000000..dd6450af37 Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-auto-label.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/sensitivity-label-endpoint-dlp.png b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-endpoint-dlp.png new file mode 100644 index 0000000000..3dbbb4e09b Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-endpoint-dlp.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png index e6c9769e68..5da4686e3f 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png index 4b66070098..89c1eae2a8 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png index 8d1815ddf9..b2fc9ee966 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png index 495fdfdb95..8af8967001 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png index c2c85c62d4..2d6cadb5c6 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png index c52e7a4fdb..f3d12e7f2f 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png differ diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index 6574cf15e2..bb80483994 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -24,7 +24,7 @@ ms.date: 02/26/2019 - Windows 10, version 1703 and later - Windows 10 Mobile, version 1703 and later -With WIP Learning, you can intelligently tune which apps and websites are included in your WIP policy to help reduce disruptive prompts and keep it accurate and relevant. WIP Learning generates two reports: The **App learning report** and the **Website learning report**. Both reports are accessed from Microsoft Azure Intune, and you can alternately access the App learning report from Microsoft Operations Management Suite (OMS). +With WIP Learning, you can intelligently tune which apps and websites are included in your WIP policy to help reduce disruptive prompts and keep it accurate and relevant. WIP Learning generates two reports: The **App learning report** and the **Website learning report**. Both reports can be accessed from Microsoft Azure Intune. The **App learning report** monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with [“Block”](protect-enterprise-data-using-wip.md#bkmk-modes) mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly. @@ -44,59 +44,42 @@ In the **Website learning report**, you can view a summary of the devices that h  -Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. Next, we'll look at how to do that in Operations Management Suite (OMS). +Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. -## View the WIP app learning report in Microsoft Operations Management Suite +## Use the WIP section of Device Health -From Intune, you can open OMS by choosing **WIP in the OMS console**. Then you can view the WIP App learning blade to monitor access events per app, and devices that have reported WIP access events: +You can use Device Health to adjust your WIP protection policy. See [Using Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-using#windows-information-protection) to learn more. - - -If you don't have OMS linked to your Microsoft Azure Account, and want to configure your environment for Windows Analytics: Device Health, see [Get Started with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-get-started) for more information. - ->[!NOTE] ->Intune has a 14 day data retention capacity, while OMS offers better querying capabilities and longer data retention. +If you want to configure your environment for Windows Analytics: Device Health, see [Get Started with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-get-started) for more information. Once you have WIP policies in place, by using the WIP section of Device Health, you can: - Reduce disruptive prompts by adding rules to allow data sharing from approved apps. - Tune WIP rules by confirming that certain apps are allowed or denied by current policy. - +## Use Device Health and Intune to adjust WIP protection policy -The **APP LEARNING** tile shows details of app statistics that you can use to evaluate each incident and update app policies by using WIP AppIDs. +The information needed for the following steps can be found using Device Health, which you will first have to set up. Learn more about how you can [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor). - +1. In **Device Health** click the app you want to add to your policy and copy the publisher information. -In this chart view, you can see apps that have been used on connected devices which, when clicked on, will open additional details on the app, including details you need to adjust your WIP Policy: - - +2. In Intune, click **App protection policies** and then choose the app policy you want to add an application to. -Here, you can copy the **WipAppid** and use it to adjust your WIP protection policies. +3. Click **Protected apps**, and then click **Add Apps**. -## Use OMS and Intune to adjust WIP protection policy - -1. Click the **APP LEARNING** tile in OMS, as described above, to determine which apps are being used for work so you can add those you choose to your WIP policy. - -2. Click the app you want to add to your policy and copy the publisher information from the app details screen. - -3. Back in Intune, click **App protection policies** and then choose the app policy you want to add an application to. - -4. Click **Protected apps**, and then click **Add Apps**. - -5. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app). +4. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app).  -6. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 2 above. +5. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 1 above.  -7. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). +6. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). -8. Back in OMS, copy the name of the executable (for example, snippingtool.exe) and then go back to Intune and paste it in **FILE** (required). +7. Copy the name of the executable (for example, snippingtool.exe) and paste it in **FILE** (required). -9. Go back to OMS one more time and note the version number of the app and type it in **MIN VERSION** in Intune (alternately, you can specify the max version, but one or the other is required), and then select the **ACTION**: **Allow** or **Deny** +8. Type the version number of the app into **MIN VERSION** in Intune (alternately, you can specify the max version, but one or the other is required), and then select the **ACTION**: **Allow** or **Deny** When working with WIP-enabled apps and WIP-unknown apps, it is recommended that you start with **Silent** or **Allow overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Block**. For more information about WIP modes, see: [Protect enterprise data using WIP: WIP-modes](protect-enterprise-data-using-wip.md#bkmk-modes) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 178b297aa0..e65fbfe36a 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -228,6 +228,7 @@ ####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) ###### [Onboard servers](windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md) ###### [Onboard non-Windows machines](windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +###### [Onboard machines without Internet access](windows-defender-atp/onboard-offline-machines.md) ###### [Run a detection test on a newly onboarded machine](windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md) ###### [Run simulated attacks on machines](windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md) ###### [Configure proxy and Internet connectivity settings](windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md) @@ -345,6 +346,10 @@ ###### [Threat protection reports](windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md) ###### [Machine health and compliance reports](windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md) +##### Interoperability +###### [Partner applications](windows-defender-atp/partner-applications.md) + + ##### Role-based access control ###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) ####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md) @@ -389,7 +394,7 @@ #####Rules ###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md) ###### [Manage automation allowed/blocked lists](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -###### [Manage allowed/blocked lists](windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +###### [Manage indicators](windows-defender-atp/manage-indicators.md) ###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) ###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 1bd7c641e8..6187a558da 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -132,7 +132,7 @@ This event is generated only on domain controllers. | 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.
Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/library/cc223991.aspx).
Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | -| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are [more stringently filtered](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.
Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
Only evaluated if SID Filtering is used.
Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are [more stringently filtered](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts.
Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
Only evaluated if SID Filtering is used.
Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](https://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/library/cc223782.aspx).
Only evaluated on TRUST\_TYPE\_MIT | | 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section 3.3.5.7.5.
Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | | 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.
Evaluated only on Windows Server 2016
Evaluated only if SID Filtering is used.
Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index ea200b936f..4387af7e0b 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -224,7 +224,7 @@ The most common values: | 0x18 | KDC\_ERR\_PREAUTH\_FAILED | Pre-authentication information was invalid | The wrong password was provided.
This error code cannot occur in event “[4768](event-4768.md). A Kerberos authentication ticket (TGT) was requested”. It occurs in “[4771](event-4771.md). Kerberos pre-authentication failed” event. | | 0x19 | KDC\_ERR\_PREAUTH\_REQUIRED | Additional pre-authentication required | This error often occurs in UNIX interoperability scenarios. MIT-Kerberos clients do not request pre-authentication when they send a KRB\_AS\_REQ message. If pre-authentication is required (the default), Windows systems will send this error. Most MIT-Kerberos clients will respond to this error by giving the pre-authentication, in which case the error can be ignored, but some clients might not respond in this way. | | 0x1A | KDC\_ERR\_SERVER\_NOMATCH | KDC does not know about the requested server | No information. | -| 0x1B | KDC\_ERR\_SVC\_UNAVAILABLE | KDC is unavailable | No information. | +| 0x1B | KDC\_ERR\_MUST\_USE\_USER2USER | Server principal valid for user2user only | This error occurs because the service is missing an SPN. | | 0x1F | KRB\_AP\_ERR\_BAD\_INTEGRITY | Integrity check on decrypted field failed | The authenticator was encrypted with something other than the session key. The result is that the client cannot decrypt the resulting message. The modification of the message could be the result of an attack or it could be because of network noise. | | 0x20 | KRB\_AP\_ERR\_TKT\_EXPIRED | The ticket has expired | The smaller the value for the “Maximum lifetime for user ticket” Kerberos policy setting, the more likely it is that this error will occur. Because ticket renewal is automatic, you should not have to do anything if you get this message. | | 0x21 | KRB\_AP\_ERR\_TKT\_NYV | The ticket is not yet valid | The ticket presented to the server is not yet valid (in relationship to the server time). The most probable cause is that the clocks on the KDC and the client are not synchronized.
If cross-realm Kerberos authentication is being attempted, then you should verify time synchronization between the KDC in the target realm and the KDC in the client realm, as well. | diff --git a/windows/security/threat-protection/auditing/event-5159.md b/windows/security/threat-protection/auditing/event-5159.md index 74fd606119..a1cf9746d1 100644 --- a/windows/security/threat-protection/auditing/event-5159.md +++ b/windows/security/threat-protection/auditing/event-5159.md @@ -17,37 +17,48 @@ ms.date: 04/19/2017 - Windows Server 2016 -This event is logged if the Windows Filtering Platform has blocked a bind to a local port. - -There is no example of this event in this document. +
***Subcategory:*** [Audit Filtering Platform Connection](audit-filtering-platform-connection.md)
-***Event Schema:***
+***Event Description:***
-*The Windows Filtering Platform has blocked a bind to a local port.*
+This event is logged if the Windows Filtering Platform has blocked a bind to a local port.
-*Application Information:*
+-> *Process ID:%1* -> -> *Application Name:%2* +***Event XML:*** +``` +-
+
+ If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager.
+
+ You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**.
+
+
+
+- **Application Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process.
+
+ Logical disk is displayed in format \\device\\harddiskvolume\#. You can get all local volume numbers by using **diskpart** utility. The command to get volume numbers using diskpart is “**list volume”**:
+
+
+
+**Network Information:**
+
+- **Source Address** \[Type = UnicodeString\]**:** the local IP address of the computer running the application.
+
+ - IPv4 Address
+
+ - IPv6 Address
+
+ - :: - all IP addresses in IPv6 format
+
+ - 0.0.0.0 - all IP addresses in IPv4 format
+
+ - 127.0.0.1 , ::1 - localhost
+
+- **Source Port** \[Type = UnicodeString\]**:** the port number used by the application.
+
+- **Protocol** \[Type = UInt32\]: the protocol number being used.
+
+| Service | Protocol Number |
+|----------------------------------------------------|-----------------|
+| Internet Control Message Protocol (ICMP) | 1 |
+| Transmission Control Protocol (TCP) | 6 |
+| User Datagram Protocol (UDP) | 17 |
+| General Routing Encapsulation (PPTP data over GRE) | 47 |
+| Authentication Header (AH) IPSec | 51 |
+| Encapsulation Security Payload (ESP) IPSec | 50 |
+| Exterior Gateway Protocol (EGP) | 8 |
+| Gateway-Gateway Protocol (GGP) | 3 |
+| Host Monitoring Protocol (HMP) | 20 |
+| Internet Group Management Protocol (IGMP) | 88 |
+| MIT Remote Virtual Disk (RVD) | 66 |
+| OSPF Open Shortest Path First | 89 |
+| PARC Universal Packet Protocol (PUP) | 12 |
+| Reliable Datagram Protocol (RDP) | 27 |
+| Reservation Protocol (RSVP) QoS | 46 |
+
+**Filter Information:**
+
+- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which blocks the application from binding to the port. By default, Windows firewall won't prevent a port from binding by an application, and if this application doesn’t match any filters, you will get value 0 in this field.
+
+ To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As a result of this command, **filters.xml** file will be generated. You need to open this file and find the specific substring with the required filter ID (**<filterId>**)**,** for example:
+
+ 
+
+- **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name.
+
+- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example:
+
+
+
## Security Monitoring Recommendations
- There is no recommendation for this event in this document.
diff --git a/windows/security/threat-protection/auditing/images/event-5159.png b/windows/security/threat-protection/auditing/images/event-5159.png
new file mode 100644
index 0000000000..a2f9134fe8
Binary files /dev/null and b/windows/security/threat-protection/auditing/images/event-5159.png differ
diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md
index 4c4b362d5c..0359a92351 100644
--- a/windows/security/threat-protection/index.md
+++ b/windows/security/threat-protection/index.md
@@ -113,7 +113,7 @@ Windows Defender ATP's new managed threat hunting service provides proactive hun
- [Targeted attack notification](windows-defender-atp/microsoft-threat-experts.md)
- [Experts-on-demand](windows-defender-atp/microsoft-threat-experts.md)
-- [Configure your Microsoft Threat Protection managed hunting service](windows-defender-atp/configure-microsoft-threat-experts.md)
+- [Configure your Microsoft Threat Experts managed hunting service](windows-defender-atp/configure-microsoft-threat-experts.md)
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md
index 14740a3224..2be015772f 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md
@@ -24,7 +24,7 @@ Describes the best practices, location, values, management, and security conside
## Reference
-Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver. This policy setting allows you to control the locking time by using Group Policy.
+Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine). This policy setting allows you to control the locking time by using Group Policy.
### Possible values
@@ -40,6 +40,8 @@ Set the time for elapsed user-input inactivity based on the device’s usage and
Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options (While creating and linking group policy on server)
+
### Default values
The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
index ea2b3fa6af..024554261c 100644
--- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
+++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
@@ -14,7 +14,8 @@ ms.localizationpriority: medium
# Use Windows Event Forwarding to help with intrusion detection
**Applies to**
-- Windows 10
+- Windows 10
+- Windows Server
Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
index b5d15d6b55..ad62a5c02a 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 09/03/2018
+ms.date: 04/29/2019
---
# Enable block at first sight
@@ -68,6 +68,23 @@ For more information about configuring Windows Defender Antivirus device restric
For a list of Windows Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#windows-defender-antivirus).
+### Enable block at first sight with SCCM
+
+1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **AntiMalware Policies**.
+1. Click **Home** > **Create Antimalware Policy**.
+1. Enter a name and a description, and add these settings:
+ - **Real time protection**
+ - **Advanced**
+ - **Cloud Protection Service**
+1. In the left column, click **Real time protection**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**.
+ 
+1. Click **Advanced**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**.
+ 
+1. Click **Cloud Protection Service**, set **Cloud Protection Service membership type** to **Advanced membership**, set **Level for blocking malicious files** to **High**, and set **Allow extended cloud check to block and scan suspicious files for up to (seconds)** to **50** seconds.
+ 
+1. Click **OK** to create the policy.
+
+
### Confirm block at first sight is enabled with Group Policy
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
index 78351fac00..492af0b7b7 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
@@ -24,6 +24,9 @@ You can exclude certain files from Windows Defender Antivirus scans by modifying
Generally, you shouldn't need to apply exclusions. Windows Defender Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.
+> [!NOTE]
+> Automatic exclusions apply only to Windows Server 2016 and above.
+
>[!TIP]
>The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
index 37859694d9..3d7368b36a 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
@@ -20,9 +20,9 @@ ms.date: 10/02/2018
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can identify and block PUAs from downloading and installing on endpoints in your network.
+The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can detect and block PUAs on endpoints in your network.
-These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have a poor reputation.
+These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation.
Typical PUA behavior includes:
@@ -37,25 +37,17 @@ These applications can increase the risk of your network being infected with mal
## How it works
-PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions:
+Windows Defender Antivirus blocks detected PUA files and attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantined.
-- The file is being scanned from the browser
-- The file is in a folder with "**downloads**" in the path
-- The file is in a folder with "**temp**" in the path
-- The file is on the user's desktop
-- The file does not meet one of these conditions and is not under *%programfiles%*, *%appdata%*, or *%windows%*
-
-The file is placed in the quarantine section so it won't run.
-
-When a PUA is detected on an endpoint, the endpoint will present a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:").
+When a PUA is detected on an endpoint, Windows Defender Antivirus presents a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:").
They will also appear in the usual [quarantine list in the Windows Security app](windows-defender-security-center-antivirus.md#detection-history).
## View PUA events
-PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune.
+PUA events are reported in the Windows Event Viewer, but not in System Center Configuration Manager or Intune.
-Hoever, PUA detections will be reported if you have set up email notifications for detections.
+You can turn on email notifications for PUA detections.
See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID 1160.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-advanced-settings.png b/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-advanced-settings.png
new file mode 100644
index 0000000000..1fb1745a5f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-advanced-settings.png differ
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-cloud-protection-service.png b/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-cloud-protection-service.png
new file mode 100644
index 0000000000..3a47dcf6d8
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-cloud-protection-service.png differ
diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-real-time-protection.png b/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-real-time-protection.png
new file mode 100644
index 0000000000..1a7467f581
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-real-time-protection.png differ
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
index 4e04685c61..ce5dd02552 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
@@ -143,6 +143,9 @@ If you have enabled cloud-delivered protection, Windows Defender AV will send fi
4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following:
1. Double-click **Allow real-time definition updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**.
2. Double-click **Allow notifications to disable definitions based reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**.
+
+> [!NOTE]
+> "Allow notifications to disable definitions based reports" enables Microsoft MAPS to disable those definitions known to cause false-positive reports. You must configure your computer to join Microsoft MAPS for this function to work.
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md
index 15865ca9fa..f643a3b454 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md
@@ -56,14 +56,11 @@ SIP is a built-in macOS security feature that prevents low-level tampering with
## Installation and configuration overview
There are various methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac.
In general you'll need to take the following steps:
- - [Register macOS devices](#register-macos-devices) with Windows Defender ATP
- - Deploy Microsoft Defender ATP for Mac using any of the following deployment methods and tools:
- - [Microsoft Intune based deployment](#microsoft-intune-based-deployment)
- - [JAMF based deployment](#jamf-based-deployment)
- - [Manual deployment](#manual-deployment)
-
-## Deploy Microsoft Defender ATP for Mac
-Use any of the supported methods to deploy Microsoft Defender ATP for Mac
+ - Ensure you have a Windows Defender ATP subscription and have access to the Windows Defender ATP Portal
+ - Deploy Microsoft Defender ATP for Mac using one of the following deployment methods:
+ * [Microsoft Intune based deployment](#microsoft-intune-based-deployment)
+ * [JAMF based deployment](#jamf-based-deployment)
+ * [Manual deployment](#manual-deployment)
## Microsoft Intune based deployment
@@ -293,7 +290,6 @@ After some time, the machine's User Approved MDM status will change to Yes.
You can enroll additional machines now. Optionally, can do it after system configuration and application packages are provisioned.
-
### Deployment
Enrolled client machines periodically poll the JAMF Server and install new configuration profiles and policies as soon as they are detected.
@@ -329,7 +325,7 @@ Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: No patch policies were found.
You can also check the onboarding status:
```
-mavel-mojave:~ testuser$ /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
+mavel-mojave:~ testuser$ sudo /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
uuid : 69EDB575-22E1-53E1-83B8-2E1AB1E410A6
orgid : 79109c9d-83bb-4f3e-9152-8d75ee59ae22
orgid managed : 79109c9d-83bb-4f3e-9152-8d75ee59ae22
@@ -351,13 +347,13 @@ For example, this script removes Microsoft Defender ATP from the /Applications d
```
echo "Is WDAV installed?"
-ls -ld '/Applications/Microsoft Defender.app' 2>/dev/null
+ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null
echo "Uninstalling WDAV..."
-rm -rf '/Applications/Microsoft Defender.app'
+rm -rf '/Applications/Microsoft Defender ATP.app'
echo "Is WDAV still installed?"
-ls -ld '/Applications/Microsoft Defender.app' 2>/dev/null
+ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null
echo "Done!"
```
@@ -374,7 +370,7 @@ Configure the appropriate scope in the **Scope** tab to specify the machines tha
You can check that machines are correctly onboarded by creating a script. For example, the following script checks that enrolled machines are onboarded:
```
-/Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py | grep -E 'orgid effective : [-a-zA-Z0-9]+'
+sudo /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py | grep -E 'orgid effective : [-a-zA-Z0-9]+'
```
This script returns 0 if Microsoft Defender ATP is registered with the Windows Defender ATP service, and another exit code if it is not installed or registered.
@@ -435,7 +431,7 @@ The installation will proceed.
The client machine is not associated with orgId. Note that the orgid is blank.
```
- mavel-mojave:wdavconfig testuser$ /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
+ mavel-mojave:wdavconfig testuser$ sudo /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
uuid : 69EDB575-22E1-53E1-83B8-2E1AB1E410A6
orgid :
```
@@ -449,7 +445,7 @@ The installation will proceed.
3. Verify that the machine is now associated with orgId:
```
- mavel-mojave:wdavconfig testuser$ /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
+ mavel-mojave:wdavconfig testuser$ sudo /Library/Extensions/wdavkext.kext/Contents/Resources/Tools/wdavconfig.py
uuid : 69EDB575-22E1-53E1-83B8-2E1AB1E410A6
orgid : E6875323-A6C0-4C60-87AD-114BBE7439B8
```
@@ -507,7 +503,4 @@ If you can reproduce a problem, please increase the logging level, run the syste
### Installation issues
-If an error occurs during installation, the installer will only report a general failure. The detailed log is saved to /Library/Logs/Microsoft/wdav.install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. You can also contact _**xplatpreviewsupport@microsoft.com**_ for support on onboarding issues.
-
-
-For feedback on the preview, contact: _**mdatpfeedback@microsoft.com**_.
+If an error occurs during installation, the installer will only report a general failure. The detailed log is saved to /Library/Logs/Microsoft/wdav.install.log. If you experience issues during installation, send us this file so we can help diagnose the cause.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
index 154d463930..b1e10dc63f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
@@ -61,7 +61,7 @@ AppLocker uses path variables for well-known directories in Windows. Path variab
| Windows directory or drive | AppLocker path variable | Windows environment variable |
| - | - | - |
| Windows | %WINDIR% | %SystemRoot% |
-| System32 | %SYSTEM32%| %SystemDirectory%|
+| System32 and sysWOW64 | %SYSTEM32%| %SystemDirectory%|
| Windows installation directory | %OSDRIVE%|%SystemDrive%|
| Program Files | %PROGRAMFILES%| %ProgramFiles% and %ProgramFiles(x86)%|
| Removable media (for example, CD or DVD) | %REMOVABLE%| |
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
index 8b6d1d2ef7..34fbe7530e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
@@ -60,6 +60,8 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
|Lee Christensen|@tifkin_|
|Vladas Bulavas | Kaspersky Lab |
|Lasse Trolle Borup | Langkjaer Cyber Defence |
+|Jimmy Bayne | @bohops |
+|Philip Tsukerman | @PhilipTsukerman |
diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index fc2f274410..1cb8fce44c 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -36,6 +36,6 @@ Your environment needs the following software to run Windows Defender Applicatio |Software|Description| |--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Education edition, version 1709 or higher
Windows 10 Pro Education edition, version 1803 or higher| +|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher| |Browser|Microsoft Edge and Internet Explorer| |Management system
(only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)
**-OR-**
[System Center Configuration Manager](https://docs.microsoft.com/sccm/)
**-OR-**
[Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)
**-OR-**
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 3ac4481724..d3ade96a48 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -227,6 +227,7 @@ ###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) ##### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) ##### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +##### [Onboard machines without Internet access](onboard-offline-machines.md) ##### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md) ##### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) @@ -338,6 +339,10 @@ ##### [Threat protection reports](threat-protection-reports-windows-defender-advanced-threat-protection.md) ##### [Machine health and compliance reports](machine-reports-windows-defender-advanced-threat-protection.md) + +#### Interoperability +##### [Partner applications](partner-applications.md) + #### Role-based access control ##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) ###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) @@ -374,7 +379,7 @@ ####Rules ##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) ##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -##### [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +##### [Manage indicators](manage-indicators.md) ##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) ##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) @@ -384,7 +389,6 @@ #### [Configure Windows Security app time zone settings](time-settings-windows-defender-advanced-threat-protection.md) - ## [Troubleshoot Windows Defender ATP](troubleshoot-wdatp.md) ###Troubleshoot sensor state #### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md index 5ab62122e6..ef694ec2c0 100644 --- a/windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md @@ -19,12 +19,9 @@ ms.topic: article # Add or Remove Machine Tags API **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prerelease information](prerelease.md)] - -- Adds or remove tag to a specific machine. +This API adds or remove tag to a specific machine. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md index df2d4cbab8..dff8fdeb1c 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md @@ -94,8 +94,7 @@ To receive contextual machine integration in Office 365 Threat Intelligence, you This feature is currently on public preview. When you enable this feature, you'll receive targeted attack notifications from Microsoft Threat Experts through your Windows Defender ATP portal's alerts dashboard and via email if you configure it. >[!NOTE] ->This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later. - +>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions. ## Microsoft Cloud App Security diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md index da5c717e31..da3a29ed3a 100644 --- a/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md @@ -20,8 +20,6 @@ ms.topic: article **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] - Represents an alert entity in Windows Defender ATP. # Methods diff --git a/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md index 70fb7fe34a..426f70f81a 100644 --- a/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md @@ -14,18 +14,16 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 + --- # Collect investigation package API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] Collect investigation package from a machine. -[!include[Machine actions note](machineactionsnote.md)] ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/configuration-score.md b/windows/security/threat-protection/windows-defender-atp/configuration-score.md index 746d31cc8f..f9308eff7e 100644 --- a/windows/security/threat-protection/windows-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/windows-defender-atp/configuration-score.md @@ -2,7 +2,7 @@ title: Overview of Configuration score in Microsoft Defender Security Center description: Expand your visibility into the overall security configuration posture of your organization keywords: configuration score, mdatp configuration score, secure score, security controls, improvement opportunities, security configuration score over time, security posture, baseline -search.product: Windows 10 +search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy @@ -21,7 +21,7 @@ ms.date: 04/11/2019 **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] >[!NOTE] > Secure score is now part of Threat & Vulnerability Management as Configuration score. We’ll keep the secure score page available for a few weeks. View the [Secure score](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection) page. diff --git a/windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md b/windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md index 81e1e9bed7..bb81e3d1db 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md @@ -20,7 +20,7 @@ ms.topic: article **Applies to:** - [Windows Defender Advanced Threat Protection Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] This section guides you through the steps you need to take to configure Threat & Vulnerability Management's integration with Microsoft Intune or Microsoft System Center Configuration Manager (SCCM) for a seamless collaboration of issue remediation. diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md index de556b2903..cd5b2e9c98 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md @@ -28,47 +28,40 @@ ms.topic: article -Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network. This experience leverages on a third-party security products’ sensor data. +Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network. You'll need to know the exact Linux distros and macOS versions that are compatible with Windows Defender ATP for the integration to work. + + +## Onboarding non-Windows machines You'll need to take the following steps to onboard non-Windows machines: -1. Turn on third-party integration -2. Run a detection test +1. Select your preferred method of onboarding: -## Turn on third-party integration + - For macOS devices, you can choose to onboard through Windows Defender ATP or through a third-party solution. For more information, see [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac). + - For other non-Windows devices choose **Onboard non-Windows machines through third-party integration**. + + 1. In the navigation pane, select **Interoperability** > **Partners**. Make sure the third-party solution is listed. -1. In the navigation pane, select **Settings** > **Onboarding**. Make sure the third-party solution is listed. + 2. In the **Partner Applications** tab, select the partner that supports your non-Windows devices. -2. Select **Linux, macOS, iOS and Android** as the operating system. + 3. Select **Open partner page** to open the partner's page. Follow the instructions provided on the page. -3. Turn on the third-party solution integration. + 4. After creating an account or subscribing to the partner solution, you should get to a stage where a tenant Global Admin in your organization is asked to accept a permission request from the partner application. Read the permission request carefully to make sure that it is aligned with the service that you require. -4. Click **Generate access token** button and then **Copy**. - -5. You’ll need to copy and paste the token to the third-party solution you’re using. The implementation may vary depending on the solution. - - ->[!WARNING] ->The access token has a limited validity period. If needed, regenerate the token close to the time you need to share it with the third-party solution. - -### Run detection test -Create an EICAR test file by saving the string displayed on the portal in an empty text file. Then, introduce the test file to a machine running the third-party antivirus solution. - -The file should trigger a detection and a corresponding alert on Windows Defender ATP. + +2. Run a detection test by following the instructions of the third-party solution. ## Offboard non-Windows machines -To effectively offboard the machine from the service, you'll need to disable the data push on the third-party portal first then switch the toggle to off in Windows Defender Security Center. The toggle in the portal only blocks the data inbound flow. +1. Follow the third-party's documentation to disconnect the third-party solution from Windows Defender ATP. -1. Follow the third-party documentation to opt-out on the third-party service side. +2. Remove permissions for the third-party solution in your Azure AD tenant. + 1. Sign in to the [Azure portal](https://portal.azure.com). + 2. Select **Azure Active Directory > Enterprise Applications**. + 3. Select the application you'd like to offboard. + 4. Select the **Delete** button. -2. In the navigation pane, select **Settings** > **Onboarding**. - -3. Turn off the third-party solution integration. - ->[!WARNING] ->If you decide to turn on the third-party integration again after disabling the integration, you'll need to regenerate the token and reapply it on machines. ## Related topics - [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md index 9f81f669b5..04731316ec 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md @@ -23,30 +23,29 @@ ms.date: 02/28/2019 - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] ## Before you begin -To experience the full Microsoft Threat Experts preview capability in Windows Defender ATP, you need to have a valid Premier customer service and support account. However, Premier charges will not be incurred during the preview. +To experience the full Microsoft Threat Experts targeted attack notification capability in Windows Defender ATP, and preview the experts-on-demand capability, you need to have a valid Premier customer service and support account. Premier charges will not be incurred during for the capability in preview, but for the generally available capability, there will be charges. You also need to ensure that you have Windows Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. -## Register to Microsoft Threat Experts preview -If you're already a Windows Defender ATP customer, you can apply for preview through the Windows Defender ATP portal. +## Register to Microsoft Threat Experts managed threat hunting service +If you're already a Windows Defender ATP customer, you can apply through the Windows Defender ATP portal. -1. From the navigation pane, go to **Settings > General > Advanced features > Threat Experts**. +1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**. -2. Click **Apply for preview**. +2. Click **Apply**. + -3. In the **Apply for preview** dialog box, read and make sure you understand the preview's terms of agreement. +3. Enter your name and email address so that Microsoft can get back to you on your application. + -4. Enter your name and email address so that Microsoft can get back to you on your application. - -5. Read the privacy statement, then click **Submit** when you're done. - - >[!NOTE] - >You will receive a welcome email once your application is approved. Then, from the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**. +4. Read the privacy statement, then click **Submit** when you're done. You will receive a welcome email once your application is approved. + +6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**. ## Receive targeted attack notification from Microsoft Threat Experts You can receive targeted attack notification from Microsoft Threat Experts through the following: @@ -56,7 +55,7 @@ You can receive targeted attack notification from Microsoft Threat Experts throu To receive targeted attack notifications through email, you need to create an email notification rule. ### Create an email notification rule -You can create rules to send email notifications for notification recipients. See Configure alert notifications to create, edit, delete, or troubleshoot email notification, for details. +You can create rules to send email notifications for notification recipients. See [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) to create, edit, delete, or troubleshoot email notification, for details. ## View the targeted attack notification @@ -68,6 +67,9 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert ## Ask a Microsoft threat expert about suspicious cybersecurity activities in your organization +>[!NOTE] +>The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. + You can partner with Microsoft Threat Experts who can be engaged directly from within the Windows Defender Security Center for timely and accurate response. Experts provide insights needed to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard. 1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before raising an inquiry. @@ -115,7 +117,7 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w **Threat intelligence details** - This morning, we detected a phishing email that delivered a malicious Word document to a user. This caused a series of suspicious events which triggered multiple Windows Defender alerts for [malware name] malware. Do you have any information on this malware? If yes, can you please send me a link? -- I recently saw a [social media reference e.g. Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection WDATP provides against this threat actor? +- I recently saw a [social media reference e.g. Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Windows Defender ATP provides against this threat actor? **Microsoft Threat Experts’ alert communications** - Can your incident response team help us address the targeted attack notification that we got? diff --git a/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md index d20d381975..e6a5f47f96 100644 --- a/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 + --- # Create alert from event API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Enables using event data, as obtained from the [Advanced Hunting](run-advanced-query-api.md) for creating a new alert entity. diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md index 67780a3f78..8967eb0a92 100644 --- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -36,12 +36,12 @@ Information collected includes file data (such as file names, sizes, and hashes) Microsoft stores this data securely in Microsoft Azure and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://go.microsoft.com/fwlink/?linkid=827578). -Microsoft uses this data to: +This data enables Windows Defender ATP to: - Proactively identify indicators of attack (IOAs) in your organization - Generate alerts if a possible attack was detected - Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. -Microsoft does not use your data for advertising or for any other purpose other than providing you the service. +Microsoft does not use your data for advertising. ## Data protection and encryption The Windows Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure. diff --git a/windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md index 6399e4f311..51f12e0109 100644 --- a/windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md @@ -21,10 +21,9 @@ ms.topic: article **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] >[!Note] -> Currently this API is supported only for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information) +> Currently this API is only supported for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information) - Deletes an Indicator entity by ID. diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md index 56c66b472e..abe92e9dfe 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md @@ -19,12 +19,11 @@ ms.date: 09/03/2018 # Use Windows Defender ATP APIs -**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) -[!include[Prerelease information](prerelease.md)] - This page describes how to create an application to get programmatic access to Windows Defender ATP on behalf of a user. diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md index 4d6b21364d..d26d9ddb56 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md @@ -19,11 +19,11 @@ ms.date: 09/03/2018 # Create an app to access Windows Defender ATP without a user -**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) -[!include[Prerelease information](prerelease.md)] This page describes how to create an application to get programmatic access to Windows Defender ATP without a user. diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md index 80c3f2dfdf..9256735a62 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md @@ -21,8 +21,6 @@ ms.date: 09/24/2018 **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - Full scenario using multiple APIs from Windows Defender ATP. diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md index 8892195292..3224af9ce2 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md @@ -14,18 +14,17 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/15/2018 --- # OData queries with Windows Defender ATP **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] -- If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/) -- Not all properties are filterable. +If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/) + +Not all properties are filterable. ### Properties that supports $filter: diff --git a/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md index 0491fe98c9..fa296bb3af 100644 --- a/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md @@ -20,7 +20,6 @@ ms.topic: article **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] Represent a file entity in Windows Defender ATP. diff --git a/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md index 5e8d10dd1e..10f9c1f0dc 100644 --- a/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md @@ -19,11 +19,8 @@ ms.date: 07/25/2018 # Find machine information by internal IP API -[!include[Prerelease information](prerelease.md)] - **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Find a machine by internal IP. diff --git a/windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md index 687f9ab304..7fd4ec0b04 100644 --- a/windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md @@ -14,19 +14,16 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Find machines by internal IP API - **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) -[!include[Prereleaseinformation](prerelease.md)] +Find machines seen with the requested internal IP in the time range of 15 minutes prior and after a given timestamp -- Find machines seen with the requested internal IP in the time range of 15 minutes prior and after a given timestamp -- The given timestamp must be in the past 30 days. +The given timestamp must be in the past 30 days. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md index f6ed806476..e6933232eb 100644 --- a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md @@ -49,7 +49,7 @@ If the machine was offboarded it will still appear in machines list. After 7 day If the machine is not sending any signals for more than 7 days to any of the Windows Defender ATP channels for any reason including conditions that fall under misconfigured machines classification, a machine can be considered inactive. -Do you expect a machine to be in ‘Active’ status? [Open a support ticket ticket](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561). +Do you expect a machine to be in ‘Active’ status? [Open a support ticket](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561). ## Misconfigured machines Misconfigured machines can further be classified to: diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md index 3cbd5cc31e..a7365f8291 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get alert information by ID API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves an alert by its ID. diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md index 5e0a0256ae..9048ee44e1 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get alert related domain information API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] Retrieves all domains related to a specific alert. diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md index a286bb19f9..7a06825e2d 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get alert related files information API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves all files related to a specific alert. diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md index af24309c36..fcc6714b48 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get alert related IP information API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves all IPs related to a specific alert. diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md index 55b0895b5f..0b169ac577 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md @@ -14,17 +14,13 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get alert related machine information API - **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] - -- Retrieves machine that is related to a specific alert. +Retrieves machine that is related to a specific alert. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md index a96ecfe588..484a4874d8 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get alert related user information API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves the user associated to a specific alert. diff --git a/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md index 45820ed888..9a1faba1e2 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md @@ -14,21 +14,20 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # List alerts API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] +Retrieves a collection of Alerts. +Supports [OData V4 queries](https://www.odata.org/documentation/). -- Retrieves a collection of Alerts. -- Supports [OData V4 queries](https://www.odata.org/documentation/). -- The OData's Filter query is supported on: "Id", "IncidentId", "AlertCreationTime", "Status", "Severity" and "Category". -- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) +The OData's Filter query is supported on: "Id", "IncidentId", "AlertCreationTime", "Status", "Severity" and "Category". + +See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md index 4251da56b9..3149b5d23f 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md @@ -10,10 +10,10 @@ ms.sitesec: library ms.pagetype: security ms.author: leonidzh author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance ms.topic: article ms.date: 10/07/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md index 2a44ef58e4..d09e702dfd 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -14,19 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get domain related alerts API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] - - - - +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of alerts related to a given domain address. diff --git a/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md index c1136545a5..4355e3594a 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get domain related machines API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of machines that have communicated to or from a given domain address. diff --git a/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md index f4f669e5a2..12d290b29d 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md @@ -14,15 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get domain statistics API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves the prevalence for the given domain. diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md index 792f618d5f..cfa1df6eb2 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get file information API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] - +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a file by identifier Sha1, Sha256, or MD5. diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md index 46f6a80f2a..f75ad0ee2d 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get file related alerts API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of alerts related to a given file hash. diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md index cf9e003f26..33e5bfd6ea 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get file related machines API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - Retrieves a collection of machines related to a given file hash. diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md index 17f1f3525d..00bf2bf323 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md @@ -14,19 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get file statistics API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] - - - - +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves the prevalence for the given file. diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md index 08817b8e70..80c4fcf202 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -14,15 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get IP related alerts API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of alerts related to a given IP address. diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md index e17c0a1457..02aa1f61ba 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get IP related machines API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of machines that communicated with or from a particular IP. diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md index 3c2c965ffb..becbf40d3a 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md @@ -14,17 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get IP statistics API **Applies to:** - -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] - - +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves the prevalence for the given IP. diff --git a/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md index 5a6a77b908..9710899e3a 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md @@ -14,18 +14,14 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get machine by ID API **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] - -- Retrieves a machine entity by ID. +Retrieves a machine entity by ID. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md index eb0edbe3e4..a50a37d200 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get machine log on users API - -[!include[Prereleaseinformation](prerelease.md)] - **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) Retrieves a collection of logged on users. ## Permissions diff --git a/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md index df392f1ef1..92fa67c016 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get machine related alerts API - -[!include[Prereleaseinformation](prerelease.md)] - **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) Retrieves a collection of alerts related to a given machine ID. ## Permissions diff --git a/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md index 19a78ab6d8..ede9947280 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md @@ -14,18 +14,14 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get machineAction API **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] - -- Get action performed on a machine. +Get action performed on a machine. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md index 4be4316a45..bd36b12c8a 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md @@ -14,21 +14,21 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # List MachineActions API **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) -[!include[Prereleaseinformation](prerelease.md)] +Gets collection of actions done on machines. -- Gets collection of actions done on machines. -- Get MachineAction collection API supports [OData V4 queries](https://www.odata.org/documentation/). -- The OData's Filter query is supported on: "Id", "Status", "MachineId", "Type", "Requestor" and "CreationDateTimeUtc". -- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) +Get MachineAction collection API supports [OData V4 queries](https://www.odata.org/documentation/). + +The OData's Filter query is supported on: "Id", "Status", "MachineId", "Type", "Requestor" and "CreationDateTimeUtc". + +See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md index 7e2ad2eaf1..449c19a1e5 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md @@ -17,16 +17,17 @@ ms.topic: article --- # List machines API - **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] + +This API can do the following actions: - Retrieves a collection of machines that have communicated with Windows Defender ATP cloud on the last 30 days. - Get Machines collection API supports [OData V4 queries](https://www.odata.org/documentation/). - The OData's Filter query is supported on: "Id", "ComputerDnsName", "LastSeen", "LastIpAddress", "HealthStatus", "OsPlatform", "RiskScore", "MachineTags" and "RbacGroupId". -- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) + +See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md) ## Permissions diff --git a/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md index 0de146e30c..64448439c9 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/07/2018 --- # Get Machines security states collection API diff --git a/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md index 32bc25c9bd..f2f944e0e0 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get package SAS URI API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prerelease information](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Get a URI that allows downloading of an [investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md). diff --git a/windows/security/threat-protection/windows-defender-atp/get-started.md b/windows/security/threat-protection/windows-defender-atp/get-started.md index 96a02d2c87..f3b11e8133 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-started.md +++ b/windows/security/threat-protection/windows-defender-atp/get-started.md @@ -49,6 +49,9 @@ In conjunction with being able to quickly respond to advanced attacks, Windows D **Secure score**
Windows Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network. +**Microsoft Threat Experts**
+Microsoft Threat Experts is the new managed threat hunting service in Windows Defender ATP that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately. It provides additional layer of expertise and optics that Microsoft customers can utilize to augment security operation capabilities as part of Microsoft 365. + **Advanced hunting**
Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Windows Defender Security Center. @@ -67,4 +70,4 @@ Topic | Description [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) | Explains the data storage and privacy details related to Windows Defender ATP. [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) | Set permissions to manage who can access the portal. You can set basic permissions or set granular permissions using role-based access control (RBAC). [Evaluate Windows Defender ATP](evaluate-atp.md) | Evaluate the various capabilities in Windows Defender ATP and test features out. -[Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. \ No newline at end of file +[Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. diff --git a/windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md index 837155f677..d3469d7f53 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # List Indicators API @@ -22,9 +21,8 @@ ms.date: 12/08/2017 **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] ->[!Note] +>[!NOTE] > Currently this API is supported only for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information) diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md index 75c9bc7f08..54be0763a9 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md @@ -20,7 +20,6 @@ ms.topic: article **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] Retrieve a User entity by key (user name). diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md index 6044ca7009..e239d6ca71 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get user related alerts API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of alerts related to a given user ID. diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md index a3597ff7ac..b137144be5 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md @@ -14,15 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Get user related machines API - **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Retrieves a collection of machines related to a given user ID. diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_applicationconfirmation.png b/windows/security/threat-protection/windows-defender-atp/images/MTE_applicationconfirmation.png new file mode 100644 index 0000000000..2c04ad2fc8 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/MTE_applicationconfirmation.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_apply.png b/windows/security/threat-protection/windows-defender-atp/images/MTE_apply.png new file mode 100644 index 0000000000..a7096ee4aa Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/MTE_apply.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/MTE_collaboratewithmte.png b/windows/security/threat-protection/windows-defender-atp/images/MTE_collaboratewithmte.png new file mode 100644 index 0000000000..862c5ffbd7 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/MTE_collaboratewithmte.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md b/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md index 475a844fa1..880f5e4d11 100644 --- a/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md +++ b/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Improve request performance diff --git a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md b/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md index 9eedb8b8f5..a8696ec1d9 100644 --- a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md +++ b/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md @@ -21,8 +21,6 @@ ms.date: 12/05/2018 **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - Learn how you can use Windows Defender ATP to expand the coverage of Windows Information Protection (WIP) to protect files based on their label, regardless of their origin. >[!TIP] diff --git a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md b/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md index 976dfff7e4..be963a981f 100644 --- a/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md +++ b/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 12/05/2018 --- # Information protection in Windows overview diff --git a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md index 026174d5f5..fbf715ebd3 100644 --- a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md @@ -14,15 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Was domain seen in org **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Answers whether a domain was seen in the organization. diff --git a/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md index 8cfb010fc6..73631e76cb 100644 --- a/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Was IP seen in org **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] Answers whether an IP was seen in the organization. diff --git a/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md index a09ded139b..66ef8c4c99 100644 --- a/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Isolate machine API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prerelease information](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Isolates a machine from accessing external network. diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md index 9dcb0b6f60..9560bb473f 100644 --- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md @@ -16,11 +16,10 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: article --- + # Validate licensing provisioning and complete set up for Windows Defender ATP **Applies to:** - - - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) diff --git a/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md index 86bf166722..25140e78df 100644 --- a/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md @@ -18,11 +18,8 @@ ms.topic: article --- # Machine health and compliance report in Windows Defender ATP - **Applies to:** -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) - -[!include[Prerelease information](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) The machines status report provides high-level information about the devices in your organization. The report includes trending information showing the sensor health state, antivirus status, OS platforms, and Windows 10 versions. diff --git a/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md index c4f16727e0..aa6b9b537e 100644 --- a/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # MachineAction resource type - **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] - Method|Return Type |Description :---|:---|:--- [List MachineActions](get-machineactions-collection-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | List [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) entities. diff --git a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md index fe70b2cba7..170f773f33 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 09/03/2018 --- # Manage Windows Defender Advanced Threat Protection alerts @@ -105,8 +104,7 @@ Alternatively, the team leader might assign the alert to the **Resolved** queue ## Alert classification -You can choose not to set a classification, or specify if an alert is a true alert or a false alert. - +You can choose not to set a classification, or specify whether an alert is a true alert or a false alert. It's important to provide the classification of true positive/false positive. This classification is used to monitor alert quality, and make alerts more accurate. The "determination" field defines additional fidelity for a "true positive" classification. ## Add comments and view the history of an alert You can add comments and view historical events about an alert to see previous changes made to the alert. diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md index 84706f7a5a..e311c292ff 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Manage automation file uploads diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md index 23133475a4..370187b6f0 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Manage automation folder exclusions diff --git a/windows/security/threat-protection/windows-defender-atp/manage-edr.md b/windows/security/threat-protection/windows-defender-atp/manage-edr.md index b430f21281..38ce9039ff 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-edr.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-edr.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 07/01/2018 --- # Manage endpoint detection and response capabilities diff --git a/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-indicators.md similarity index 98% rename from windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md rename to windows/security/threat-protection/windows-defender-atp/manage-indicators.md index 150cd87e78..db76c00fda 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-indicators.md @@ -1,5 +1,5 @@ --- -title: Manage allowed/blocked lists +title: Manage indicators description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Manage allowed/blocked lists +# Manage indicators **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md index 1ec412b1f3..ec47236a66 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md @@ -15,14 +15,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Manage suppression rules **Applies to:** - - - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) diff --git a/windows/security/threat-protection/windows-defender-atp/management-apis.md b/windows/security/threat-protection/windows-defender-atp/management-apis.md index c0408e9e5f..2fd2dd6083 100644 --- a/windows/security/threat-protection/windows-defender-atp/management-apis.md +++ b/windows/security/threat-protection/windows-defender-atp/management-apis.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/03/2018 --- # Overview of management and APIs diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md index 52627d87be..41f0442d90 100644 --- a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md +++ b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md @@ -15,31 +15,26 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/19/2018 - --- -# Configure Microsoft Cloud App Security in Windows +# Configure Microsoft Cloud App Security in Windows Defender ATP **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] To benefit from Windows Defender Advanced Threat Protection (ATP) cloud app discovery signals, turn on Microsoft Cloud App Security integration. >[!NOTE] ->This feature is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later. +>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions. 1. In the navigation pane, select **Preferences setup** > **Advanced features**. 2. Select **Microsoft Cloud App Security** and switch the toggle to **On**. 3. Click **Save preferences**. - - - Once activated, Windows Defender ATP will immediately start forwarding discovery signals to Cloud App Security. ## View the data collected diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md index 6c2400b885..0edfd423b9 100644 --- a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md +++ b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md @@ -18,11 +18,11 @@ ms.topic: conceptual ms.date: 10/18/2018 --- -# Microsoft Cloud App Security in Windows overview +# Microsoft Cloud App Security in Windows Defender ATP overview **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] Microsoft Cloud App Security (Cloud App Security) is a comprehensive solution that gives visibility into cloud apps and services by allowing you to control and limit access to cloud apps, while enforcing compliance requirements on data stored in the cloud. For more information, see [Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security). diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md index 8f85356b3f..8d0b702f6c 100644 --- a/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md +++ b/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md @@ -22,7 +22,7 @@ ms.date: 02/28/2019 **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed. @@ -36,6 +36,9 @@ Microsoft Threat Experts provides proactive hunting for the most important threa - Scope of compromise and as much context as can be quickly delivered to enable fast SOC response. ## Collaborate with experts, on demand +>[!NOTE] +>The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. + Customers can engage our security experts directly from within Windows Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised machines, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can: - Get additional clarification on alerts including root cause or scope of the incident - Gain clarity into suspicious machine behavior and next steps if faced with an advanced attacker @@ -44,4 +47,4 @@ Customers can engage our security experts directly from within Windows Defender ## Related topic -- [Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) \ No newline at end of file +- [Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) diff --git a/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md index dfd40d8852..ee2aca23c7 100644 --- a/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 10/29/2018 --- # Managed security service provider support diff --git a/windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md index d83dc2575a..40df258764 100644 --- a/windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -2,7 +2,7 @@ title: Next-generation Threat & Vulnerability Management description: This new capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. keywords: threat and vulnerability management, MDATP-TVM, vulnerability management, threat and vulnerability scanning -search.product: Windows 10 +search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] Effectively identifying, assessing, and remediating endpoint weaknesses is pivotal in running a healthy security program and reducing organizational risk. Threat & Vulnerability Management serves as an infrustructure for reducing organizational exposure, hardening endpoint surface area, and increasing organizational resilience. diff --git a/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md index 50855b0351..b49c5af6ec 100644 --- a/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md @@ -20,8 +20,6 @@ ms.topic: article **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] - Offboard machine from Windows Defender ATP. [!include[Machine actions note](machineactionsnote.md)] diff --git a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md index 273bfed16c..dc2b133c7a 100644 --- a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/24/2018 --- # Offboard machines from the Windows Defender ATP service diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md index a33cae087b..59fad5bda4 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 11/19/2018 --- # Onboard machines to the Windows Defender ATP service diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md b/windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md new file mode 100644 index 0000000000..9d6532688d --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md @@ -0,0 +1,53 @@ +--- +title: Onboard machines without Internet access to Windows Defender ATP +description: Onboard machines without Internet access so that they can send sensor data to the Windows Defender ATP sensor +keywords: onboard, servers, vm, on-premise, oms gateway, log analytics, azure log analytics, mma +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Onboard machines without Internet access to Windows Defender ATP + +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +To onboard machines without Internet access, you'll need to take the following general steps: + + +## On-premise machines + +- Setup Azure Log Analytics (formerly known as OMS Gateway) to act as proxy or hub: + - [Azure Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/platform/gateway#download-the-log-analytics-gateway) + - [Install and configure Microsoft Monitoring Agent (MMA)](configure-server-endpoints-windows-defender-advanced-threat-protection.md#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-windows-defender-atp) point to Microsoft Defender ATP Workspace key & ID + +- Offline machines in the same network of Azure Log Analytics + - Configure MMA to point to: + - Azure Log Analytics IP as a proxy + - Microsoft Defender ATP workspace key & ID + +## Azure virtual machines +- Configure and enable [Azure Log Analytics workspace](https://docs.microsoft.com/azure/azure-monitor/platform/gateway) + + - Setup Azure Log Analytics (formerly known as OMS Gateway) to act as proxy or hub: + - [Azure Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/platform/gateway#download-the-log-analytics-gateway) + - [Install and configure Microsoft Monitoring Agent (MMA)](configure-server-endpoints-windows-defender-advanced-threat-protection.md#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-windows-defender-atp) point to Microsoft Defender ATP Workspace key & ID + - Offline Azure VMs in the same network of OMS Gateway + - Configure Azure Log Analytics IP as a proxy + - Azure Log Analytics Workspace Key & ID + + - Azure Security Center (ASC) + - [Security Policy \> Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/security-center-wdatp#enable-windows-defender-atp-integration) + - [Threat Detection \> Allow Windows Defender ATP to access my data](https://docs.microsoft.com/azure/security-center/security-center-wdatp#enable-windows-defender-atp-integration) + + For more information, see [Working with security policies](https://docs.microsoft.com/azure/security-center/tutorial-security-policy). \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/onboard.md b/windows/security/threat-protection/windows-defender-atp/onboard.md index 319d254a8e..33c43ec774 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/03/2018 --- # Configure and manage Windows Defender ATP capabilities @@ -32,6 +31,7 @@ Topic | Description [Configure attack surface reduction capabilities](configure-attack-surface-reduction.md) | By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. [Configure next generation protection](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md) | Configure next generation protection to catch all types of emerging threats. [Configure Secure score dashboard security controls](secure-score-dashboard-windows-defender-advanced-threat-protection.md) | Configure the security controls in Secure score to increase the security posture of your organization. +[Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) | Configure and manage how you would like to get cybersecurity threat intelligence from Microsoft Threat Experts. Configure Microsoft Threat Protection integration| Configure other solutions that integrate with Windows Defender ATP. Management and API support| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports. [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) | Configure portal related settings such as general settings, advanced features, enable the preview experience and others. diff --git a/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md index c2617a285e..e6ea3aed4c 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/21/2019 --- # Overview of attack surface reduction diff --git a/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md index 13268d34ad..76fd2d9bd1 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 10/29/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md index 1fb9eea8e2..4599298025 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/03/2018 --- # Overview of endpoint detection and response diff --git a/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md index 8d95c6f102..3f92d168af 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/12/2018 --- # Overview of advanced hunting diff --git a/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md index 33671e8778..bde1e7c9b6 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/03/2018 --- # Overview of Secure score in Windows Defender Security Center diff --git a/windows/security/threat-protection/windows-defender-atp/overview.md b/windows/security/threat-protection/windows-defender-atp/overview.md index b105b4987a..d2421506b2 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview.md +++ b/windows/security/threat-protection/windows-defender-atp/overview.md @@ -1,7 +1,7 @@ --- title: Overview of Windows Defender ATP -description: -keywords: +description: Understand the concepts behind the capabilities in Windows Defender ATP so you take full advantage of the complete threat protection platform +keywords: atp, microsoft defender atp, defender, mdatp, threat protection, platform, threat, vulnerability, asr, attack, surface, reduction, next-gen, protection, edr, endpoint, detection, response, automated, air search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 11/20/2018 --- # Overview of Windows Defender ATP capabilities @@ -39,9 +38,10 @@ Topic | Description [Endpoint detection and response](overview-endpoint-detection-response.md) | Understand how Windows Defender ATP continuously monitors your organization for possible attacks against systems, networks, or users in your organization and the features you can use to mitigate and remediate threats. [Automated investigation and remediation](automated-investigations-windows-defender-advanced-threat-protection.md) | In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. [Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md) | Quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to better protect your organization - all in one place. +[Microsoft Threat Experts](microsoft-threat-experts.md) | Managed cybersecurity threat hunting service. Learn how you can get expert-driven insights and data through targeted attack notification and access to experts on demand. [Advanced hunting](overview-hunting-windows-defender-advanced-threat-protection.md) | Use a powerful search and query language to create custom queries and detection rules. [Management and APIs](management-apis.md) | Windows Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows. -[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other security capabilities in the Microsoft threat protection stack. +[Microsoft Threat Protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other security capabilities in the Microsoft threat protection stack. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) |Learn to navigate your way around Windows Defender Security Center. diff --git a/windows/security/threat-protection/windows-defender-atp/partner-applications.md b/windows/security/threat-protection/windows-defender-atp/partner-applications.md new file mode 100644 index 0000000000..4f2cd61854 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/partner-applications.md @@ -0,0 +1,64 @@ +--- +title: Partner applications in Microsoft Defender ATP +description: View supported partner applications to enhance the detection, investigation, and threat intelligence capabilities of the platform +keywords: partners, applications, third-party, connections, sentinelone, lookout, bitdefender, corrata, morphisec, paloalto, ziften, better mobile +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Partner applications in Microsoft Defender ATP +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + + +Microsoft Defender ATP supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform. + + +The support for third-party solutions help to further streamline, integrate, and orchestrate defenses from other vendors with Microsoft Defender ATP; enabling security teams to effectively respond better to modern threats. + +Microsoft Defender ATP seamlessly integrates with existing security solutions - providing out of the box integration with SIEM, ticketing and IT service management solutions, managed security service providers (MSSP), IoC indicators ingestions and matching, automated device investigation and remediation based on external alerts, and integration with Security orchestration and automation response (SOAR) systems. + +## SIEM integration +Microsoft Defender ATP supports SIEM integration through a variety of methods - specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md). + +## Ticketing and IT service management +Ticketing solution integration helps to implement manual and automatic response processes. Microsoft Defender ATP can help to create tickets automatically when an alert is generated and resolve the alerts when tickets are closed using the alerts API. + +## Security orchestration and automation response (SOAR) integration +Orchestration solutions can help build playbooks and integrate the rich data model and actions that Microsoft Defender ATP APIs expose to orchestrate responses, such as query for device data, trigger machine isolation, block/allow, resolve alert and others. + +## External alert correlation and Automated investigation and remediation +Microsoft Defender ATP offers unique automated investigation and remediation capabilities to drive incident response at scale. + +Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices. + +External alerts can be pushed into Microsoft Defender ATP and is presented side-by-side with additional device-based alerts from Microsoft Defender ATP. This view provides a full context of the alert - with the real process and the full story of attack. + +## Indicators matching +You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs). + +Microsoft Defender ATP allows you to integrate with such solutions and act on IoCs by correlating its rich telemetry and creating alerts when there's a match; leveraging prevention and automated response capabilities to block execution and take remediation actions when there's a match. + +Microsoft Defender ATP currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators. + +## Support for non-Windows platforms +Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data giving you a unified experience. + + + + + + + diff --git a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md index 9ace9bafb4..d94a65a540 100644 --- a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/24/2018 --- # Windows Defender Advanced Threat Protection portal overview @@ -112,7 +111,6 @@ Icon | Description  | Threat & Vulnerability Management - possible active alert  | Threat & Vulnerability Management - recommendation insights - ## Related topics - [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) - [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md index 1116788ea1..82d437d18a 100644 --- a/windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Submit or Update Indicator API @@ -22,7 +21,6 @@ ms.date: 12/08/2017 **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] >[!Note] > Currently this API is supported only for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information) diff --git a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md index faa5965b72..c38db1be9d 100644 --- a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/26/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md index 4a47170925..66420af797 100644 --- a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # PowerShell code examples for the custom threat intelligence API diff --git a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md index 91b8900c14..c868f2a2d3 100644 --- a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Configure Windows Defender Security Center settings diff --git a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md index 66f745bb56..469a59e63e 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Turn on the preview experience in Windows Defender ATP diff --git a/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md index f4b63ae583..c64fd1617c 100644 --- a/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Python code examples for the custom threat intelligence API diff --git a/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md index 8446e86a04..38f1c79ee9 100644 --- a/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 05/08/2018 --- # Manage portal access using role-based access control diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md index e5f643f908..544077f49b 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -253,19 +253,19 @@ If you encounter a problem when trying to submit a file, try each of the followi 1. Ensure that the file in question is a PE file. PE files typically have _.exe_ or _.dll_ extensions (executable programs or applications). 2. Ensure the service has access to the file, that it still exists, and has not been corrupted or modified. 3. You can wait a short while and try to submit the file again, in case the queue is full or there was a temporary connection or communication error. -4. Verify the policy setting enables sample collection and try to submit the file again. +4. If the sample collection policy is not configured, then the default behavior is to allow sample collection. If it is configured, then verify the policy setting allows sample collection before submitting the file again. When sample collection is configured, then check the following registry value: - a. Change the following registry entry and values to change the policy on specific machines: - ``` -HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection - Value = 0 – block sample collection - Value = 1 – allow sample collection -``` + ``` + Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection + Name: AllowSampleCollection + Type: DWORD + Hexadecimal value : + Value = 0 – block sample collection + Value = 1 – allow sample collection + ``` 5. Change the organizational unit through the Group Policy. For more information, see [Configure with Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). -> [!NOTE] -> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. ## Related topic - [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md index 37e946eb11..9d051a1e7e 100644 --- a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/28/2018 --- # Take response actions on a machine diff --git a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md index bc0073bf43..6e601dc0fd 100644 --- a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/12/2017 --- # Take response actions in Windows Defender ATP diff --git a/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md index 5cf3e7bd28..671ec7d8fe 100644 --- a/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Restrict app execution API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Restrict execution of all applications on the machine except a predefined set (see [Response machine alerts](respond-machine-alerts-windows-defender-advanced-threat-protection.md) for more information) diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md index 5077e43d6c..9d9ea6c85d 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md @@ -14,14 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 09/03/2018 --- # Advanced hunting API -**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) - -[!include[Prerelease information](prerelease.md)] +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) This API allows you to run programmatic queries that you are used to running from [Windows Defender ATP Portal](https://securitycenter.windows.com/hunting). diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md index 90d62c40c1..dd2f1dc672 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 09/24/2018 --- # Schedule Advanced Hunting using Microsoft Flow diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md index 336ac77edb..83380bfe20 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md @@ -18,7 +18,7 @@ ms.topic: article # Create custom reports using Power BI (user authentication) **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) [!include[Prerelease information](prerelease.md)] diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md index 547b531909..487b150df6 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md @@ -14,15 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 09/24/2018 --- # Advanced Hunting using PowerShell **Applies to:** - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md). diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md index 07bb15a7cf..a80cd077b7 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md @@ -18,9 +18,7 @@ ms.topic: article # Advanced Hunting using Python **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prerelease information](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md). diff --git a/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md index 4a58f9eedf..95d084af2a 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Run antivirus scan API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prerelease information](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Initiate Windows Defender Antivirus scan on a machine. diff --git a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md index b5d51b9cf4..098f8b6720 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 09/07/2018 --- # Run a detection test on a newly onboarded Windows Defender ATP machine diff --git a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md index d501a0d824..d3c9466607 100644 --- a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/26/2018 --- # Configure the security controls in Secure score diff --git a/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md index 1c071364b8..b152fd4194 100644 --- a/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 09/04/2018 --- # Windows Defender Security Center Security operations dashboard diff --git a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md index a0ace19060..6d64ca2629 100644 --- a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Check the Windows Defender Advanced Threat Protection service health diff --git a/windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md index 49687ff26c..b64296d1c8 100644 --- a/windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md @@ -14,17 +14,14 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Stop and quarantine file API - **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prereleaseinformation](prerelease.md)] -- Stop execution of a file on a machine and delete it. +Stop execution of a file on a machine and delete it. [!include[Machine actions note](machineactionsnote.md)] diff --git a/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md index 14621034da..cdcdf40b44 100644 --- a/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 12/01/2017 --- # Supported Windows Defender ATP query APIs diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics.md index 9a145edebb..4fe07149cf 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-analytics.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/29/2018 --- # Threat analytics diff --git a/windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md index a88e212a95..22ef58fb69 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -1,8 +1,8 @@ --- title: Threat & Vulnerability Management scenarios -description: -keywords: -search.product: Windows 10 +description: Learn how to use Threat & Vulnerability Management in the context of scenarios that Security Administrators encounter when collaborating with IT Administrators and SecOps while protecting their organization from cybersecurity threats. +keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase configuration score, increase threat & vulnerability configuration score, configuration score, exposure score, security controls +search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy @@ -21,7 +21,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] ## Before you begin Ensure that your machines: diff --git a/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md b/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md index 026ac5e02d..54a2033aa8 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 12/03/2018 --- # Microsoft Threat Protection diff --git a/windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md index ae5f7b984d..f9dd490e81 100644 --- a/windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md @@ -17,10 +17,8 @@ ms.topic: article --- # Indicator resource type - -**Applies to:** - Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prerelease information](prerelease.md)] +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Method|Return Type |Description :---|:---|:--- diff --git a/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md index 0a8c046f35..ea1cc5d2b6 100644 --- a/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 02/13/2018 --- # Windows Defender Security Center time zone settings diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index 500048787b..96753d16e3 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -15,18 +15,13 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: troubleshooting -ms.date: 06/25/2018 --- # Troubleshoot custom threat intelligence issues **Applies to:** - - - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - You might need to troubleshoot issues while using the custom threat intelligence feature. This page provides detailed steps to troubleshoot issues you might encounter while using the feature. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md index 3f520e22f4..4541e327e6 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md @@ -15,14 +15,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: troubleshooting -ms.date: 08/01/2018 --- # Troubleshoot subscription and portal access issues **Applies to:** - - - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index a3097cd460..a859c2f21b 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: troubleshooting -ms.date: 11/08/2018 --- # Troubleshoot SIEM tool integration issues diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md index fccd8ca55a..f0636c3363 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: troubleshooting -ms.date: 09/03/2018 --- # Troubleshoot Windows Defender Advanced Threat Protection diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md index ee883b6d7f..95c591fbec 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: troubleshooting -ms.date: 07/30/2018 --- # Troubleshoot service issues diff --git a/windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md index 9613ef139d..d66a7239fa 100644 --- a/windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md @@ -1,10 +1,10 @@ --- title: What's in the dashboard and what it means for my organization's security posture -description: -keywords: -search.product: Windows 10 +description: What's in the Threat & Vulnerability Management dashboard and how it can help SecOps and Security Administrators arrive at informed decisions in addressing cybersecurity threat vulnerabilities and building their organization's security resilience. +keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, risk-based threat & vulnerability management, security configuration, configuration score, exposure score +search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: eADQiWindows 10XVcnh ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease�information](prerelease.md)] +[!include[Prerelease information](prerelease.md)] >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md index 07203db964..bcfc51d9e5 100644 --- a/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 + --- # Release machine from isolation API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Undo isolation of a machine. diff --git a/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md index d6bd15719c..24e1453c32 100644 --- a/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md @@ -14,14 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Remove app restriction API **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[!include[Prereleaseinformation](prerelease.md)] +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Enable execution of any application on the machine. diff --git a/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md index 8c700cf5fd..4f1fe6545e 100644 --- a/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md @@ -14,16 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # Update alert **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - -[!include[Prereleaseinformation](prerelease.md)] Update the properties of an alert entity. ## Permissions diff --git a/windows/security/threat-protection/windows-defender-atp/use-apis.md b/windows/security/threat-protection/windows-defender-atp/use-apis.md index 9104f53a2b..18e77632f4 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-apis.md +++ b/windows/security/threat-protection/windows-defender-atp/use-apis.md @@ -1,5 +1,5 @@ --- -title: Windows Defender ATP Public API +title: Windows Defender ATP APIs description: Use the exposed data and actions using a set of progammatic APIs that are part of the Microsoft Intelligence Security Graph. keywords: apis, api, wdatp, open api, windows defender atp api, public api, alerts, machine, user, domain, ip, file search.product: eADQiWindows 10XVcnh @@ -14,12 +14,12 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 11/28/2018 --- -# Windows Defender ATP Public API +# Windows Defender ATP APIs -**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md index a5bf6b10dc..be38700ccf 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/24/2018 --- # Use the threat intelligence API to create custom alerts diff --git a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md index 07291b3a48..268f112212 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 03/12/2018 --- # Overview of Windows Defender Security Center diff --git a/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md index 12ad0a75b8..6bc2c21435 100644 --- a/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md +++ b/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md @@ -14,10 +14,11 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/08/2017 --- # User resource type +**Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Method|Return Type |Description :---|:---|:--- diff --git a/windows/security/threat-protection/windows-defender-atp/view-incidents-queue.md b/windows/security/threat-protection/windows-defender-atp/view-incidents-queue.md index 5f6903dad8..10af5a5e7c 100644 --- a/windows/security/threat-protection/windows-defender-atp/view-incidents-queue.md +++ b/windows/security/threat-protection/windows-defender-atp/view-incidents-queue.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/08/2018 --- # View and organize the Windows Defender Advanced Threat Protection Incidents queue diff --git a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md index 6d2c512257..450fdcb9a5 100644 --- a/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md @@ -19,21 +19,30 @@ ms.topic: conceptual # What's new in Windows Defender ATP **Applies to:** -- Windows Defender Advanced Threat Protection (Windows Defender ATP) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Here are the new features in the latest release of Windows Defender ATP as well as security features in Windows 10 and Windows Server. ## April 2019 +The following capability is generally available (GA). + +- [Microsoft Threat Experts Targeted Attack Notification capability](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts#targeted-attack-notification)
Microsoft Threat Experts' Targeted Attack Notification alerts are tailored to organizations to provide as much information as can be quickly delivered thus bringing attention to critical threats in their network, including the timeline, scope of breach, and the methods of intrusion. + +- [Microsoft Defender ATP API](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis)
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Windows Defender ATP capabilities. + + ### In preview -The following capability is included in the April 2019 preview release. +The following capabilities are included in the April 2019 preview release. - [Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt)
A new built-in capability that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. +- [Interoperability](https://docs.microsoft.com/windows/security/threat-protection/partner-applications)
Microsoft Defender ATP supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform. + ## March 2019 ### In preview The following capability are included in the March 2019 preview release. -- [Machine health and compliance report](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection)
The machine health and compliance report provides high-level information about the devices in your organization. +- [Machine health and compliance report](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-rotection) The machine health and compliance report provides high-level information about the devices in your organization. ## February 2019 diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md index d85d398e43..3c620a48d0 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 07/01/2018 --- # Windows Defender Security Center diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index e16b905b59..5bfe2c6ba4 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -63,22 +63,22 @@ Event ID | Description The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use System Center Configuration Manager or Microsoft Intune, you do not need the GUIDs: -Rule name | GUID --|- -Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A -Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899 -Block Office applications from injecting code into other processes | 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -Block JavaScript or VBScript from launching downloaded executable content | D3E037E1-3EB8-44C8-A917-57927947596D -Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC -Block Win32 API calls from Office macro | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -Block executable files from running unless they meet a prevalence, age, or trusted list criterion | 01443614-cd74-433a-b99e-2ecdc07bfc25 -Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d35 -Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c -Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 -Block Office communication application from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869 -Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c +Rule name | GUID | File & folder exclusions +-|-|- +Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 | Supported +Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A | Supported +Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899 | Supported +Block Office applications from injecting code into other processes | 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 | Supported +Block JavaScript or VBScript from launching downloaded executable content | D3E037E1-3EB8-44C8-A917-57927947596D | Not supported +Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC | Supported +Block Win32 API calls from Office macro | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B | Supported +Block executable files from running unless they meet a prevalence, age, or trusted list criterion | 01443614-cd74-433a-b99e-2ecdc07bfc25 | Supported +Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d35 | Supported +Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 | Supported +Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c | Not supported +Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 | Supported +Block Office communication application from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869 | Supported +Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c | Supported Each rule description indicates which apps or file types the rule applies to. In general, the rules for Office apps apply to only Word, Excel, PowerPoint, and OneNote, or they apply to Outlook. Except where specified, attack surface reduction rules don't apply to any other Office apps. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md index 5d82fb8254..1c4e998102 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md @@ -27,7 +27,9 @@ You might want to do this when testing how the features will work in your organi While the features will not block or prevent apps, scripts, or files from being modified, the Windows Event Log will record events as if the features were fully enabled. This means you can enable audit mode and then review the event log to see what impact the feature would have had were it enabled. -You can use Windows Defender Advanced Threat Protection to get greater deatils for each event, especially for investigating attack surface reduction rules. Using the Windows Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md). +To find the audited entries, go to **Applications and Services** > **Microsoft** > **Windows** > **Windows Defender** > **Operational**. + +You can use Windows Defender Advanced Threat Protection to get greater details for each event, especially for investigating attack surface reduction rules. Using the Windows Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md). This topic provides links that describe how to enable the audit functionality for each feature and how to view events in the Windows Event Viewer. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md index b772be4c4c..204fad8ca0 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 12/19/2018 +ms.date: 04/26/2019 --- # Customize attack surface reduction rules @@ -35,7 +35,7 @@ This could potentially allow unsafe files to run and infect your devices. >[!WARNING] >Excluding files or folders can severely reduce the protection provided by attack surface reduction rules. Files that would have been blocked by a rule will be allowed to run, and there will be no report or event recorded. > ->If you are encountering problems with rules detecting files that you believe should not be detected, you should [use audit mode first to test the rule](enable-attack-surface-reduction.md#enable-and-audit-attack-surface-reduction-rules). +>If you are encountering problems with rules detecting files that you believe should not be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md). You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the exclusions should only be applied to individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode) and that allow exclusions. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md index c49eae7912..bde9222c86 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -100,6 +100,9 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi >The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. >CFG will be enabled for *miles.exe*. +>[!NOTE] +>If you have found any issues in this article, you can report it directly to a Windows Server/Windows Client partner or use the Microsoft technical support numbers for your country. + ### Configure system-level mitigations with the Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index c5d238cf59..1a68651c4f 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -11,13 +11,30 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic +ms.date: 04/29/2019 --- # Enable attack surface reduction rules [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) help prevent actions and apps that malware often uses to infect computers. You can set attack surface reduction rules for computers running Windows 10 or Windows Server 2019. -To use ASR rules, you need either a Windows 10 Enterprise E3 or E5 license. We recommend an E5 license so you can take advantage of the advanced monitoring and reporting capabilities available in Windows Defender Advanced Threat Protection (Windows Defender ATP). These advanced capabilities aren't available with an E3 license, but you can develop your own monitoring and reporting tools to use in conjuction with ASR rules. +Each ASR rule contains three settings: + +* Not configured: Disable the ASR rule +* Block: Enable the ASR rule +* Audit: Evaluate how the ASR rule would impact your organization if enabled + +To use ASR rules, you need either a Windows 10 Enterprise E3 or E5 license. We recommend an E5 license so you can take advantage of the advanced monitoring and reporting capabilities available in Windows Defender Advanced Threat Protection (Windows Defender ATP). These advanced capabilities aren't available with an E3 license, but you can develop your own monitoring and reporting tools to use in conjunction with ASR rules. + +You can enable attack surface reduction rules by using any of the these methods: + +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) + +Enterprise-level management such as Intune or SCCM is recommended. Enterprise-level management will overwrite any conflicting Group Policy or PowerShell settings on startup. ## Exclude files and folders from ASR rules @@ -26,7 +43,7 @@ You can exclude files and folders from being evaluated by most attack surface re >[!WARNING] >Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded. > ->If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](enable-attack-surface-reduction.md#enable-and-audit-attack-surface-reduction-rules). +>If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md). >[!IMPORTANT] >File and folder exclusions do not apply to the following ASR rules: @@ -36,47 +53,59 @@ You can exclude files and folders from being evaluated by most attack surface re You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules the exclusions apply to. ->[!IMPORTANT] ->The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. - ASR rules support environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). The following procedures for enabling ASR rules include instructions for how to exclude files and folders. -## Enable and audit attack surface reduction rules +## Intune -It's best to use an enterprise-level management platform like Intune or System Center Configuration Manager (SCCM) to configure ASR rules, but you can also use Group Policy, PowerShell, or third-party mobile device management (MDM) CSPs. +1. In Intune, select **Device configuration** > **Profiles**. Choose an existing endpoint protection profile or create a new one. To create a new one, select **Create profile** and enter information for this profile. For **Profile type**, select **Endpoint protection**. If you've chosen an existing profile, select **Properties** and then select **Settings**. ->[!WARNING] ->If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting Group Policy or PowerShell settings on startup. +2. In the **Endpoint protection** pane, select **Windows Defender Exploit Guard**, then select **Attack Surface Reduction**. Select the desired setting for each ASR rule. -For a complete list of ASR rules, see [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md). - -Each ASR rule contains three settings: - -* Not configured: Disable the ASR rule -* Block: Enable the ASR rule -* Audit: Evaluate how the ASR rule would impact your organization if enabled - -For further details on how audit mode works and when to use it, see [Audit Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md). - -### Enable ASR rules in Intune - -1. In Intune, select *Device configuration* > *Profiles*. Choose an existing endpoint protection profile or create a new one. To create a new one, select *Create profile* and enter information for this profile. For *Profile type*, select *Endpoint protection*. If you've chosen an existing profile, select *Properties* and then select *Settings*. - -2. In the *Endpoint protection* pane, select *Windows Defender Exploit Guard*, then select *Attack Surface Reduction*. Select the desired setting for each ASR rule. - -3. Under *Attack Surface Reduction exceptions*, you can enter individual files and folders, or you can select *Import* to import a CSV file that contains files and folders to exclude from ASR rules. Each line in the CSV file should be in the following format: - +3. Under **Attack Surface Reduction exceptions**, you can enter individual files and folders, or you can select **Import** to import a CSV file that contains files and folders to exclude from ASR rules. Each line in the CSV file should be in the following format: + *C:\folder*, *%ProgramFiles%\folder\file*, *C:\path* -4. Select *OK* on the three configuration panes and then select *Create* if you're creating a new endpoint protection file or *Save* if you're editing an existing one. +4. Select **OK** on the three configuration panes and then select **Create** if you're creating a new endpoint protection file or **Save** if you're editing an existing one. -### Enable ASR rules in SCCM +## MDM -For information about enabling ASR rules and setting exclusions in SCCM, see [Create and deploy an Exploit Guard policy](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/create-deploy-exploit-guard-policy). +Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductionrules) configuration service provider (CSP) to individually enable and set the mode for each rule. -### Enable ASR rules with Group Policy +The following is a sample for reference, using [GUID values for ASR rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard#attack-surface-reduction-rules). + +OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules + +Value: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}=2|{3B576869-A4EC-4529-8536-B80A7769E899}=1|{D4F940AB-401B-4EfC-AADC-AD5F3C50688A}=2|{D3E037E1-3EB8-44C8-A917-57927947596D}=1|{5BEB7EFE-FD9A-4556-801D-275E5FFC04CC}=0|{BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550}=1 + +The values to enable, disable, or enable in audit mode are: + +- Disable = 0 +- Block (enable ASR rule) = 1 +- Audit = 2 + +Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. + +Example: + +OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions + +Value: c:\path|e:\path|c:\Whitelisted.exe + +>[!NOTE] +>Be sure to enter OMA-URI values without spaces. + +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +1. Click **Home** > **Create Exploit Guard Policy**. +1. Enter a name and a description, click **Attack Surface Reduction**, and click **Next**. +1. Choose which rules will block or audit actions and click **Next**. +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + +## Group Policy >[!WARNING] >If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting Group Policy settings on startup. @@ -97,7 +126,7 @@ For information about enabling ASR rules and setting exclusions in SCCM, see [Cr 5. To exclude files and folders from ASR rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. -### Enable ASR rules with PowerShell +## PowerShell >[!WARNING] >If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting PowerShell settings on startup. @@ -148,32 +177,6 @@ For information about enabling ASR rules and setting exclusions in SCCM, see [Cr >[!IMPORTANT] >Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. -### Enable ASR rules with MDM CSPs - -Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductionrules) configuration service provider (CSP) to individually enable and set the mode for each rule. - -The following is a sample for reference, using [GUID values for ASR rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard#attack-surface-reduction-rules). - -OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules - -Value: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}=2|{3B576869-A4EC-4529-8536-B80A7769E899}=1|{D4F940AB-401B-4EfC-AADC-AD5F3C50688A}=2|{D3E037E1-3EB8-44C8-A917-57927947596D}=1|{5BEB7EFE-FD9A-4556-801D-275E5FFC04CC}=0|{BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550}=1 - -The values to enable, disable, or enable in audit mode are: - -- Disable = 0 -- Block (enable ASR rule) = 1 -- Audit = 2 - -Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. - -Example: - -OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions - -Value: c:\path|e:\path|c:\Whitelisted.exe - ->[!NOTE] ->Be sure to enter OMA-URI values without spaces. ## Related topics diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md index 4cc8d86d0a..d761ebfc85 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 03/29/2019 +ms.date: 04/29/2019 --- # Enable controlled folder access @@ -20,28 +20,24 @@ ms.date: 03/29/2019 - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Controlled folder access](controlled-folders-exploit-guard.md) helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. +[Controlled folder access](controlled-folders-exploit-guard.md) helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Controlled folder access is included with Windows 10 and Windows Server 2019. You can enable controlled folder access by using any of the these methods: -- Windows Security app -- Intune -- MDM -- Group Policy -- PowerShell cmdlets +- [Windows Security app](#windows-security-app) +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) - Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine. +[Audit mode](evaluate-controlled-folder-access.md) allows you to test how the feature would work (and review events) without impacting the normal use of the machine. ->[!NOTE] ->The Controlled folder access feature will display the state in the Windows Security app under **Virus & threat protection settings**. ->If the feature is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Security app after a restart of the device. ->If the feature is set to **Audit mode** with any of those tools, the Windows Security app will show the state as **Off**. ->See [Use audit mode to evaluate Windows Defender Exploit Guard features](audit-windows-defender-exploit-guard.md) for more details on how audit mode works. ->
->Group Policy settings that disable local administrator list merging will override controlled folder access settings. They also override protected folders and allowed apps set by the local administrator through controlled folder access. These policies include: ->- Windows Defender Antivirus **Configure local administrator merge behavior for lists** ->- System Center Endpoint Protection **Allow users to add exclusions and overrides** ->For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged). +Group Policy settings that disable local administrator list merging will override controlled folder access settings. They also override protected folders and allowed apps set by the local administrator through controlled folder access. These policies include: +- Windows Defender Antivirus **Configure local administrator merge behavior for lists** +- System Center Endpoint Protection **Allow users to add exclusions and overrides** + +For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged). ## Windows Security app @@ -51,6 +47,10 @@ You can enable controlled folder access by using any of the these methods: 3. Set the switch for **Controlled folder access** to **On**. +>[!NOTE] +>If controlled folder access is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Security app after a restart of the device. +>If the feature is set to **Audit mode** with any of those tools, the Windows Security app will show the state as **Off**. + ## Intune 1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. @@ -60,6 +60,8 @@ You can enable controlled folder access by using any of the these methods: 1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. 1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.  + >[!NOTE] + >Wilcard is supported for applications, but not for folders. Subfolders are not protected. 1. Click **OK** to save each open blade and click **Create**. 1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**. @@ -67,6 +69,17 @@ You can enable controlled folder access by using any of the these methods: Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders. +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +1. Click **Home** > **Create Exploit Guard Policy**. +1. Enter a name and a description, click **Controlled folder access**, and click **Next**. +1. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**. + >[!NOTE] + >Wilcard is supported for applications, but not for folders. Subfolders are not protected. +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + ## Group Policy 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md index 86f640ad6f..58cb4ad00c 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 03/29/2019 +ms.date: 04/22/2019 --- # Enable exploit protection @@ -28,11 +28,12 @@ You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Au You can enable each mitigation separately by using any of the these methods: -- Windows Security app -- Intune -- MDM -- Group Policy -- PowerShell cmdlets +- [Windows Security app](#windows-security-app) +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) They are configured by default in Windows 10. @@ -124,6 +125,15 @@ CFG will be enabled for *miles.exe*. Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode. +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +1. Click **Home** > **Create Exploit Guard Policy**. +1. Enter a name and a description, click **Exploit protection**, and click **Next**. +1. Browse to the location of the exploit protection XML file and click **Next**. +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + ## Group Policy 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -231,15 +241,6 @@ Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlu See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. - - - - - - - - - ## Related topics - [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md index b1e858ebcb..8df4d37da6 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 04/01/2019 +ms.date: 04/22/2019 --- # Enable network protection @@ -24,11 +24,11 @@ ms.date: 04/01/2019 You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it. You can enable network protection by using any of the these methods: -- Intune -- MDM -- Group Policy -- PowerShell cmdlets -- Registry +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [System Center Configuration Manager (SCCM)](#sccm) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) ## Intune @@ -45,9 +45,18 @@ You can enable network protection by using any of the these methods: Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode. +## SCCM + +1. In System Center Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +1. Click **Home** > **Create Exploit Guard Policy**. +1. Enter a name and a description, click **Network protection**, and click **Next**. +1. Choose whether to block or audit access to suspicious domains and click **Next**. +1. Review the settings and click **Next** to create the policy. +1. After the policy is created, click **Close**. + ## Group Policy -You can use the following procedure to enable network protection on a standalone computer or for domain-joined computers. +You can use the following procedure to enable network protection on domain-joined computers or on a standalone computer. 1. On a standalone computer, click **Start**, type and then click **Edit group policy**. @@ -93,9 +102,6 @@ Set-MpPreference -EnableNetworkProtection AuditMode Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off. -## - -Network protection can't be turned on using the Windows Security app, but you can enable it by ## Related topics diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 307b13fd20..707aa20197 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -9,8 +9,8 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: andreabichsel -ms.author: v-anbic +author: Justinha +ms.author: justinha ms.date: 04/02/2019 --- @@ -53,8 +53,8 @@ To review apps that would have been blocked, open Event Viewer and filter for Ev | Event ID | Description | |----------|-------------| |5007 | Event when settings are changed | -| 1121 | Event when an attack surface reduction rule fires in audit mode | -| 1122 | Event when an attack surface reduction rule fires in block mode | +| 1121 | Event when an attack surface reduction rule fires in block mode | +| 1122 | Event when an attack surface reduction rule fires in audit mode | ## Customize attack surface reduction rules diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index 667c554a43..958cc3e6d8 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -49,10 +49,11 @@ You can also use Group Policy, Intune, MDM, or System Center Configuration Manag The following controlled folder access events appear in Windows Event Viewer. -Event ID | Description -5007 | Event when settings are changed -1124 | Audited controlled folder access event -1123 | Blocked controlled folder access event +| Event ID | Description | +| --- | --- | +| 5007 | Event when settings are changed | +| 1124 | Audited controlled folder access event | +| 1123 | Blocked controlled folder access event | ## Customize protected folders and apps @@ -63,4 +64,4 @@ See [Protect important folders with controlled folder access](controlled-folders ## Related topics - [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) - [Evaluate Windows Defender ATP](evaluate-windows-defender-exploit-guard.md) -- [Use audit mode](audit-windows-defender-exploit-guard.md) \ No newline at end of file +- [Use audit mode](audit-windows-defender-exploit-guard.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png new file mode 100644 index 0000000000..1253d68613 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png new file mode 100644 index 0000000000..00225ec18c Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png new file mode 100644 index 0000000000..dfb1cb201b Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png new file mode 100644 index 0000000000..2868712541 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png new file mode 100644 index 0000000000..bd2e57d73f Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png new file mode 100644 index 0000000000..d7a896332a Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png new file mode 100644 index 0000000000..1d16250401 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png new file mode 100644 index 0000000000..0655fdad69 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png new file mode 100644 index 0000000000..a9f11a2e95 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png new file mode 100644 index 0000000000..312167da41 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md index 708142ccf5..aac22be513 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md @@ -72,11 +72,11 @@ If you've tested the feature with the demo site and with audit mode, and network When you report a problem with network protection, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. 1. Open an elevated command prompt and change to the Windows Defender directory: - ```console + ``` cd c:\program files\windows defender ``` 2. Run this command to generate the diagnostic logs: - ```console + ``` mpcmdrun -getfiles ``` 3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index a48b1bcd0e..1798631ea3 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -29,7 +29,6 @@ Windows 10 provides IT professionals with advanced protection against modern sec ## Learn more -- [Windows 10 roadmap](https://www.microsoft.com/en-us/WindowsForBusiness/windows-roadmap) - [Windows 10 release information](https://technet.microsoft.com/windows/release-info) - [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history) - [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210)