mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 05:37:22 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into vs-wip-junerelease
This commit is contained in:
LizRoss
commit
86c7cfecb4
@ -157,6 +157,193 @@ For more information, see [Manage settings in the Store for Business](manage-set
|
||||
|
||||
Microsoft Store for Business and Education is currently available in these markets.
|
||||
|
||||
<!--- <table>
|
||||
<tr>
|
||||
<th align="center" colspan="4">Support for free and paid apps</th>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td>
|
||||
<ul>
|
||||
<li>Algeria</li>
|
||||
<li>Angola</li>
|
||||
<li>Argentina</li>
|
||||
<li>Australia</li>
|
||||
<li>Austria</li>
|
||||
<li>Bahamas</li>
|
||||
<li>Bahrain</li>
|
||||
<li>Bangladesh</li>
|
||||
<li>Barbados</li>
|
||||
<li>Belgium</li>
|
||||
<li>Belize</li>
|
||||
<li>Bermuda</li>
|
||||
<li>Bhutan</li>
|
||||
<li>Bolivia</li>
|
||||
<li>Botswana</li>
|
||||
<li>Brunei Darussalam</li>
|
||||
<li>Bulgaria</li>
|
||||
<li>Cambodia</li>
|
||||
<li>Cameroon</li>
|
||||
<li>Canada</li>
|
||||
<li>Republic of Cabo Verde</li>
|
||||
<li>Cayman Islands</li>
|
||||
<li>Chile</li>
|
||||
<li>Colombia</li>
|
||||
<li>Costa Rica</li>
|
||||
<li>Côte D'ivoire</li>
|
||||
<li>Croatia</li>
|
||||
<li>Curçao</li>
|
||||
<li>Cyprus</li>
|
||||
</ul>
|
||||
</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>Czech Republic</li>
|
||||
<li>Denmark</li>
|
||||
<li>Dominican Republic</li>
|
||||
<li>Ecuador</li>
|
||||
<li>Egypt</li>
|
||||
<li>El Salvador</li>
|
||||
<li>Estonia</li>
|
||||
<li>Faroe Islands</li>
|
||||
<li>Fiji</li>
|
||||
<li>Finland</li>
|
||||
<li>France</li>
|
||||
<li>Germany</li>
|
||||
<li>Ghana</li>
|
||||
<li>Greece</li>
|
||||
<li>Guadeloupe</li>
|
||||
<li>Guatemala</li>
|
||||
<li>Honduras</li>
|
||||
<li>Hong Kong SAR</li>
|
||||
<li>Hungary</li>
|
||||
<li>Iceland</li>
|
||||
<li>Indonesia</li>
|
||||
<li>Iraq</li>
|
||||
<li>Ireland</li>
|
||||
<li>Israel</li>
|
||||
<li>Italy</li>
|
||||
<li>Jamaica</li>
|
||||
<li>Japan</li>
|
||||
<li>Jordan</li>
|
||||
<li>Kenya</li>
|
||||
</ul>
|
||||
</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>Kuwait</li>
|
||||
<li>Latvia</li>
|
||||
<li>Lebanon</li>
|
||||
<li>Libya</li>
|
||||
<li>Liechtenstein</li>
|
||||
<li>Lithuania</li>
|
||||
<li>Luxembourg</li>
|
||||
<li>Malaysia</li>
|
||||
<li>Malta</li>
|
||||
<li>Mauritius</li>
|
||||
<li>Mexico</li>
|
||||
<li>Mongolia</li>
|
||||
<li>Montenegro</li>
|
||||
<li>Morocco</li>
|
||||
<li>Mozambique</li>
|
||||
<li>Namibia</li>
|
||||
<li>Netherlands</li>
|
||||
<li>New Zealand</li>
|
||||
<li>Nicaragua</li>
|
||||
<li>Nigeria</li>
|
||||
<li>Norway</li>
|
||||
<li>Oman</li>
|
||||
<li>Pakistan</li>
|
||||
<li>Palestinian Authority</li>
|
||||
<li>Panama</li>
|
||||
<li>Paraguay</li>
|
||||
<li>Peru</li>
|
||||
<li>Philippines</li>
|
||||
<li>Poland</li>
|
||||
</ul>
|
||||
</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>Portugal</li>
|
||||
<li>Puerto Rico</li>
|
||||
<li>Qatar</li>
|
||||
<li>Romania</li>
|
||||
<li>Rwanda</li>
|
||||
<li>Saint Kitts and Nevis</li>
|
||||
<li>Saudi Arabia</li>
|
||||
<li>Senegal</li>
|
||||
<li>Serbia</li>
|
||||
<li>Singapore</li>
|
||||
<li>Slovakia</li>
|
||||
<li>Slovenia</li>
|
||||
<li>South Africa</li>
|
||||
<li>Spain</li>
|
||||
<li>Sweden</li>
|
||||
<li>Switzerland</li>
|
||||
<li>Tanzania</li>
|
||||
<li>Thailand</li>
|
||||
<li>Trinidad and Tobago</li>
|
||||
<li>Tunisia</li>
|
||||
<li>Turkey</li>
|
||||
<li>Uganda</li>
|
||||
<li>United Arab Emirates</li>
|
||||
<li>United Kingdom</li>
|
||||
<li>United States</li>
|
||||
</ul>
|
||||
</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>Uruguay</li>
|
||||
<li>Viet Nam</li>
|
||||
<li>Virgin Islands, U.S.</li>
|
||||
<li>Zambia</li>
|
||||
<li>Zimbabwe<br> </li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th align="center">Support for free apps only</th>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td>
|
||||
<ul>
|
||||
<li>Russia</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th align="center">Support for free apps and Minecraft: Education Edition</th>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td>
|
||||
<ul>
|
||||
<li>Albania</li>
|
||||
<li>Armenia</li>
|
||||
<li>Azerbaijan</li>
|
||||
<li>Belarus</li>
|
||||
<li>Bosnia</li>
|
||||
<li>Brazil</li>
|
||||
<li>Georgia</li>
|
||||
<li>India</li>
|
||||
<li>Kazakhstan</li>
|
||||
<li>Korea</li>
|
||||
<li>Kyrgyzstan</li>
|
||||
<li>Moldova</li>
|
||||
<li>Taiwan</li>
|
||||
<li>Tajikistan</li>
|
||||
<li>Turkmenistan</li>
|
||||
<li>Ukraine</li>
|
||||
<li>Uzbekistan</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table> -->
|
||||
### Support for free and paid apps
|
||||
<table>
|
||||
<tr>
|
||||
<th align="center" colspan="4">Support for free and paid apps</th>
|
||||
@ -294,6 +481,7 @@ Microsoft Store for Business and Education is currently available in these marke
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
### Support for free apps
|
||||
<table>
|
||||
<tr>
|
||||
<th align="center">Support for free apps only</th>
|
||||
@ -304,12 +492,33 @@ Microsoft Store for Business and Education is currently available in these marke
|
||||
<li>Brazil</li>
|
||||
<li>India</li>
|
||||
<li>Russia</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
### Support for free apps and Minecraft: Education Edition
|
||||
<table>
|
||||
<tr>
|
||||
<th align="center">Support for free apps and Minecraft: Education Edition</th>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td>
|
||||
<ul>
|
||||
<li>Taiwan</li>
|
||||
<li>Ukraine</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
**Microsoft Store for Business customers**
|
||||
- Admins can acquire free apps from **Microsoft Store for Business**.
|
||||
|
||||
**Microsoft Store for Education customers**
|
||||
- Admins can acquire free apps from **Microsoft Store for Education**.
|
||||
- Admins can use an invoice to acquire **Minecraft: Education Edition**. For more information, see [Invoice payment option](https://docs.microsoft.com/education/windows/school-get-minecraft#invoices).
|
||||
- Teachers can acquire free apps, but not **Minecraft: Education Edition**.
|
||||
|
||||
## Privacy notice
|
||||
|
||||
|
||||
@ -189,9 +189,12 @@ Sign-in to the reference computer using domain administrator equivalent credenti
|
||||
8. Right-click the **Registry** node and click **New**.
|
||||
9. In the **New Registry Properties** dialog box, select **Update** from the **Action** list. Select **HKEY_LOCAL_MACHINE** from the **Hive** list.
|
||||
10. For the **Key Path**, click **…** to launch the **Registry Item Browser**. Navigate to the following registry key and select the **PinRules** registry value name:
|
||||
|
||||
HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType0\CertDllCreateCertificateChainEngine\Config
|
||||
|
||||
Click **Select** to close the **Registry Item Browser**.
|
||||
11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REGBINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box.
|
||||
|
||||
11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box.
|
||||
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 82 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 68 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 8.7 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
@ -10,7 +10,7 @@ author: greg-lindsay
|
||||
|
||||
# Get started with Update Compliance
|
||||
|
||||
This topic explains the steps necessary to configure your environment for Windows Analytics: Update Compliance.
|
||||
This topic explains the steps necessary to configure your environment for Windows Analytics: Update Compliance.
|
||||
|
||||
Steps are provided in sections that follow the recommended setup process:
|
||||
1. Ensure that [prerequisites](#update-compliance-prerequisites) are met.
|
||||
@ -19,22 +19,25 @@ Steps are provided in sections that follow the recommended setup process:
|
||||
|
||||
## Update Compliance Prerequisites
|
||||
|
||||
Update Compliance has the following requirements:
|
||||
1. Update Compliance is currently only compatible with Windows 10 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
|
||||
2. The solution requires that Windows 10 telemetry is enabled on all devices that are intended to be displayed in the solution. These devices must have at least the [basic level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) enabled. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
|
||||
Update Compliance has the following requirements:
|
||||
1. Update Compliance is currently only compatible with Windows 10 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
|
||||
2. The solution requires that Windows 10 telemetry is enabled on all devices that are intended to be displayed in the solution. These devices must have at least the [basic level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) enabled. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
|
||||
3. The telemetry of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for different aspects of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on telemetry endpoints and summarizes the use of each endpoint:
|
||||
|
||||
<TABLE BORDER=1>
|
||||
<TR><TD BGCOLOR="#cceeff">Service<TD BGCOLOR="#cceeff">Endpoint
|
||||
<TR><TD>Connected User Experience and Telemetry component<TD>v10.vortex-win.data.microsoft.com
|
||||
<BR>settings-win.data.microsoft.com
|
||||
<TR><TD>Windows Error Reporting <TD>watson.telemetry.microsoft.com
|
||||
<TR><TD>Online Crash Analysis <TD>oca.telemetry.microsoft.com
|
||||
</TABLE>
|
||||
<TABLE BORDER=1>
|
||||
<TR><TD BGCOLOR="#cceeff">Service<TD BGCOLOR="#cceeff">Endpoint
|
||||
<TR><TD>Connected User Experience and Telemetry component<TD>v10.vortex-win.data.microsoft.com
|
||||
<BR>settings-win.data.microsoft.com
|
||||
<TR><TD>Windows Error Reporting <TD>watson.telemetry.microsoft.com
|
||||
<TR><TD>Online Crash Analysis <TD>oca.telemetry.microsoft.com
|
||||
</TABLE>
|
||||
|
||||
4. To use Windows Defender Antivirus Assessment, devices must be protected by Windows Defender AV (and not a 3rd party AV program), and must have enabled [cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). See the [Windows Defender Antivirus in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) content library for more information on enabling, configuring, and validating Windows Defender AV.
|
||||
|
||||
|
||||
## Add Update Compliance to Microsoft Operations Management Suite
|
||||
|
||||
Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
|
||||
Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
|
||||
|
||||
If you are already using OMS, you’ll find Update Compliance in the Solutions Gallery. Select the **Update Compliance** tile in the gallery and then click **Add** on the solution's details page. Update Compliance is now visible in your workspace.
|
||||
|
||||
@ -52,7 +55,7 @@ If you are not yet using OMS, use the following steps to subscribe to OMS Update
|
||||
<A HREF="images/uc-03.png"><img src="images/uc-03a.png"></A>
|
||||
<TABLE>
|
||||
|
||||
3. Create a new OMS workspace.
|
||||
3. Create a new OMS workspace.
|
||||
|
||||
<P><TABLE BORDER=1><TR><TD>
|
||||
<A HREF="images/uc-04.png"><img src="images/uc-04a.png"></A>
|
||||
@ -76,7 +79,7 @@ If you are not yet using OMS, use the following steps to subscribe to OMS Update
|
||||
<A HREF="images/uc-07.png"><img src="images/uc-07a.png"></A>
|
||||
<TABLE>
|
||||
|
||||
7. Select the **Update Compliance** tile in the gallery and then select **Add** on the solution’s details page. You might need to scroll to find **Update Compliance**. The solution is now visible on your workspace.
|
||||
7. Select the **Update Compliance** tile in the gallery and then select **Add** on the solution’s details page. You might need to scroll to find **Update Compliance**. The solution is now visible on your workspace.
|
||||
|
||||
<P><TABLE BORDER=1><TR><TD>
|
||||
<A HREF="images/uc-08.png"><img src="images/uc-08a.png"></A>
|
||||
@ -100,7 +103,7 @@ After you are subscribed to OMS Update Compliance and your devices have a Commer
|
||||
|
||||
## Deploy your Commercial ID to your Windows 10 devices
|
||||
|
||||
In order for your devices to show up in Windows Analytics: Update Compliance, they must be configured with your organization’s Commercial ID. This is so that Microsoft knows that a given device is a member of your organization and to feed that device’s data back to you. There are two primary methods for widespread deployment of your Commercial ID: Group Policy and Mobile Device Management (MDM).
|
||||
In order for your devices to show up in Windows Analytics: Update Compliance, they must be configured with your organization’s Commercial ID. This is so that Microsoft knows that a given device is a member of your organization and to feed that device’s data back to you. There are two primary methods for widespread deployment of your Commercial ID: Group Policy and Mobile Device Management (MDM).
|
||||
|
||||
- Using Group Policy<BR><BR>
|
||||
Deploying your Commercial ID using Group Policy can be accomplished by configuring domain Group Policy Objects with the Group Policy Management Editor, or by configuring local Group Policy using the Local Group Policy Editor.
|
||||
@ -114,4 +117,4 @@ In order for your devices to show up in Windows Analytics: Update Compliance, th
|
||||
|
||||
## Related topics
|
||||
|
||||
[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)
|
||||
[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)
|
||||
|
||||
@ -31,7 +31,8 @@ Update Compliance has the following primary blades:
|
||||
3. [Latest and Previous Security Update Status](#latest-and-previous-security-update-status)
|
||||
4. [Overall Feature Update Status](#overall-feature-update-status)
|
||||
5. [CB, CBB, LTSB Deployment Status](#cb-cbb-ltsb-deployment-status)
|
||||
6. [List of Queries](#list-of-queries)
|
||||
6. [Windows Defender Antivirus Assessment](#wdav-assessment)
|
||||
7. [List of Queries](#list-of-queries)
|
||||
|
||||
|
||||
## OS Update Overview
|
||||
@ -41,6 +42,7 @@ The first blade of OMS Update Compliance is the General **OS Update Overview** b
|
||||
|
||||
|
||||
|
||||
|
||||
This blade is divided into three sections:
|
||||
- Device Summary:
|
||||
- Needs Attention Summary
|
||||
@ -139,6 +141,133 @@ The Overall Feature Update Status blade focuses around whether or not your devic
|
||||
|
||||
Devices are evaluated by OS Version (e.g., 1607) and the count of how many are Current, Not Current, and have Update Failures is displayed. Clicking on any of these counts will allow you to view all those devices, as well as select the **Update Deployment Status** perspective, described below.
|
||||
|
||||
<a id="wdav-assessment"></a>
|
||||
## Windows Defender Antivirus Assessment
|
||||
|
||||
You'll notice some new tiles in the Overview blade which provide a summary of Windows Defender AV-related issues, highlighted in the following screenshot.
|
||||
|
||||
|
||||
|
||||
The **AV Signature** chart shows the number of devices that either have up-to-date [protection updates (also known as signatures or definitions)](/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus), while the **Windows Defender AV Status** tile indicates the percentage of all assessed devices that are not updated and do not have real-time protection enabled. The Windows Defender Antivirus Assessment section provides more information that lets you investigate potential issues.
|
||||
|
||||
If you're using [Windows Defender Antivirus in Windows 10](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) to protect devices in your organization and have enabled [cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus), you can use this section to review the overall status of key protection features, including the number of devices that have [always-on real-time protection](/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) and up-to-date definitions.
|
||||
|
||||
There are two blades in the Windows Defender AV Assessment section:
|
||||
|
||||
- Protection status
|
||||
- Threats status
|
||||
|
||||
|
||||
|
||||
The **Protection Status** blade shows three key measurements:
|
||||
|
||||
1. How many devices have old or current signatures (also known as protection updates or definitions)
|
||||
2. How many devices have the core Windows Defender AV always-on scanning feature enabled, called real-time protection
|
||||
|
||||
|
||||
|
||||
|
||||
See the [Manage Windows Defender AV updates and apply baselines](/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus) topic for an overview on how updates work, and further information on applying updates.
|
||||
|
||||
The **Threats Status** blade shows the following measurements:
|
||||
|
||||
1. How many devices that have threats that have been remediated (removed or quarantined on the device)
|
||||
2. How many devices that have threats where remediation was not successful (this may indicate a manual reboot or clean is required)
|
||||
|
||||
|
||||
|
||||
|
||||
Devices can be in multiple states at once, as one device may have multiple threats, some of which may or may not be remediated.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The data reported in Update Compliance can be delayed by up to 24 hours.
|
||||
|
||||
See the [Customize, initiate, and review the results of Windows Defender AV scans and remediation](/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus) topic for more information on how to perform scans and other manual remediation tasks.
|
||||
|
||||
As with other blades in Update Compliance, clicking on a specific measurement or item will open the associated query that you can use to investigate individual devices and issues, as described below.
|
||||
|
||||
|
||||
### Investigate individual devices and threats
|
||||
|
||||
|
||||
Click on any of the status measurements to be taken to a pre-built log query that shows the impacted devices for that status.
|
||||
|
||||
|
||||
|
||||
You can also find a pre-built query on the main Update Compliance screen, under the **Queries** blade, that lists devices that have not been assessed for Windows Defender AV.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
You can further filter queries by clicking any of the measurement labels for each incident, changing the values in the query filter pane, and then clicking **Apply**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Click **+Add** at the bottom of the filter pane to open a list of filters you can apply.
|
||||
|
||||
|
||||
|
||||
|
||||
You can also click the **. . .** button next to each label to instantly filter by that label or value.
|
||||
|
||||
|
||||
|
||||
You can create your own queries by using a query string in the following format:
|
||||
|
||||
```
|
||||
Type:<Group type> <Label>="<Value>"
|
||||
```
|
||||
|
||||
You can use the following `<Group type>` options to scope your query:
|
||||
- `Type:WDAVStatus` to query information related to signature and real-time protection status
|
||||
- `Type:WDAVThreat` to query information about threat remediation and specific threats
|
||||
|
||||
|
||||
The `<Label>`, and `<Value>` fields are listed in the following table. All labels and values are case sensitive and must be entered as written below (including spaces).
|
||||
|
||||
|
||||
For queries that use `Type:WDAVStatus`, you can use the following labels and values.
|
||||
|
||||
Label | Value
|
||||
---|---
|
||||
`Computer`|\<computer name>
|
||||
`ComputerID`|\<computer ID>
|
||||
`OSName`|\<Operating system name>
|
||||
`UpdateStatus`|`Not assessed` <br />`Signature up-to-date` <br />`Signature out-of-date`
|
||||
`DetailedStatus`|`Unknown` <br />`Non-Microsoft AV` <br />`No AV` <br />`AV expired` <br />`Disabled by GP` <br />`Disabled by LP` <br />`Recently disappeared`
|
||||
`ProtectionState`|`Real-time protection is off `<br />`Real-time protection is on`
|
||||
`MoreInformation`| \<free text string>
|
||||
`LastScan`| \<date and time of the last scan>
|
||||
|
||||
|
||||
|
||||
For queries that use `Type:WDAVThreat`, you can use the following labels and values.
|
||||
|
||||
Label | Value
|
||||
---|---
|
||||
`Computer`|\<computer name>
|
||||
`ComputerID`|\<computer ID>
|
||||
`ThreatName`|\<detected threat name>
|
||||
`ThreatStatus`|`Remediation failed`<br/>`Remediated`
|
||||
`ThreatAction`|`Remediation pending reboot`
|
||||
`ThreatError`|`Disk full`<br/>`Network issue`<br/>`Operation aborted`
|
||||
`MoreInformation`|\<free text string>
|
||||
`LastScan`|\<date and time of the last scan>
|
||||
|
||||
|
||||
You can add multiple label-value pairs in the same query to refine and filter the results.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## CB, CBB, LTSB Deployment Status
|
||||
|
||||
|
||||
@ -84,6 +84,6 @@ Topic | Description
|
||||
---|---
|
||||
[Deploy and enable Windows Defender Antivirus protection](deploy-windows-defender-antivirus.md) | While the client is installed as a core part of Windows 10, and traditional deployment does not apply, you will still need to enable the client on your endpoints with System Center Configuration Manager, Microsoft Intune, or Group Policy Objects.
|
||||
[Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) | There are two parts to updating Windows Defender Antivirus: updating the client on endpoints (product updates), and updating definitions (protection updates). You can update definitions in a number of ways, using System Center Configuration Manager, Group Policy, PowerShell, and WMI.
|
||||
[Monitor and report on Windows Defender Antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use System Center Configuration Manager, a third-party SIEM product (by consuming Windows event logs), or Microsoft Intune to monitor protection status and create reports about endpoint protection
|
||||
[Monitor and report on Windows Defender Antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use System Center Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, a third-party SIEM product (by consuming Windows event logs), or Microsoft Intune to monitor protection status and create reports about endpoint protection
|
||||
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ You can also apply [Windows security baselines](https://technet.microsoft.com/en
|
||||
|
||||
Windows Defender AV uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as "definitions" or "signature updates".
|
||||
|
||||
The cloud-delivered protection is “always-on” and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection.
|
||||
The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection.
|
||||
|
||||
|
||||
## Product updates
|
||||
|
||||
@ -28,6 +28,9 @@ There are a number of ways you can review protection status and alerts, dependin
|
||||
|
||||
You can use System Center Configuration Manager to [monitor Windows Defender AV protection](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-configure-alerts), or you can also monitor protection using the [Microsoft Intune console](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#monitor-endpoint-protection).
|
||||
|
||||
Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Windows Defender AV issues, including protection updates and real-time protection settings.
|
||||
|
||||
|
||||
If you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client events](https://msdn.microsoft.com/en-us/library/windows/desktop/aa964766(v=vs.85).aspx).
|
||||
|
||||
Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](https://technet.microsoft.com/library/mt431757.aspx), also see the [Security audting](/windows/device-security/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-windows-defender-antivirus.md).
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user