From 87019adff190139268d466f9129f8e063b7c80c7 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Wed, 31 Jan 2018 14:54:33 -0800 Subject: [PATCH] Fixed XML. --- ...bleshoot-exploit-protection-mitigations.md | 217 ++++++++++++++++++ 1 file changed, 217 insertions(+) create mode 100644 windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md diff --git a/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md new file mode 100644 index 0000000000..0435dc738a --- /dev/null +++ b/windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md @@ -0,0 +1,217 @@ +--- +title: Deploy Exploit protection mitigations across your organization +keywords: Exploit protection, mitigations, troubleshoot, import, export, configure, emet, convert, conversion, deploy, install +description: Remove unwanted Exploit protection mitigations. +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: andreabichsel +ms.author: v-anbic +ms.date: 01/31/18 +--- + + + +# Troubleshoot Exploit protection mitigations + + +**Applies to:** + +- Windows 10, version 1709 + + + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Windows Defender Security Center app +- PowerShell + + +When you create a set of Exploit protection mitigations (known as a configuration), you might find that the configuration export and import process does not remove all unwanted mitigations. + +You can manually remove unwanted mitigations in Windows Defender Security Center, or you can use the following process to remove all mitigations and then import a baseline configuration file instead. + +1. Remove all process mitigations with this PowerShell script: + + ```PowerShell + # Check if Admin-Privileges are available + function Test-IsAdmin { + ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") + } + + # Delete ExploitGuard ProcessMitigations for a given key in the registry. If no other settings exist under the specified key, + # the key is deleted as well + function Remove-ProcessMitigations([Object] $Key, [string] $Name) { + Try { + if ($Key.GetValue("MitigationOptions")) { + Write-Host "Removing MitigationOptions for: " $Name + Remove-ItemProperty -Path $Key.PSPath -Name "MitigationOptions" -ErrorAction Stop; + } + if ($Key.GetValue("MitigationAuditOptions")) { + Write-Host "Removing MitigationAuditOptions for: " $Name + Remove-ItemProperty -Path $Key.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop; + } + + # Remove the FilterFullPath value if there is nothing else + if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 1) -and ($Key.GetValue("FilterFullPath"))) { + Remove-ItemProperty -Path $Key.PSPath -Name "FilterFullPath" -ErrorAction Stop; + } + + # If the key is empty now, delete it + if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 0)) { + Write-Host "Removing empty Entry: " $Name + Remove-Item -Path $Key.PSPath -ErrorAction Stop + } + } + Catch { + Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" + } + } + + # Delete all ExploitGuard ProcessMitigations + function Remove-All-ProcessMitigations { + if (!(Test-IsAdmin)) { + throw "ERROR: No Administrator-Privileges detected!"; return + } + + Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" | ForEach-Object { + $MitigationItem = $_; + $MitigationItemName = $MitigationItem.PSChildName + + Try { + Remove-ProcessMitigations $MitigationItem $MitigationItemName + + # "UseFilter" indicate full path filters may be present + if ($MitigationItem.GetValue("UseFilter")) { + Get-ChildItem -Path $MitigationItem.PSPath | ForEach-Object { + $FullPathItem = $_ + if ($FullPathItem.GetValue("FilterFullPath")) { + $Name = $MitigationItemName + "-" + $FullPathItem.GetValue("FilterFullPath") + Write-Host "Removing FullPathEntry: " $Name + Remove-ProcessMitigations $FullPathItem $Name + } + + # If there are no subkeys now, we can delete the "UseFilter" value + if ($MitigationItem.SubKeyCount -eq 0) { + Remove-ItemProperty -Path $MitigationItem.PSPath -Name "UseFilter" -ErrorAction Stop + } + } + } + if (($MitigationItem.SubKeyCount -eq 0) -and ($MitigationItem.ValueCount -eq 0)) { + Write-Host "Removing empty Entry: " $MitigationItemName + Remove-Item -Path $MitigationItem.PSPath -ErrorAction Stop + } + } + Catch { + Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" + } + } + } + + # Delete all ExploitGuard System-wide Mitigations + function Remove-All-SystemMitigations { + + if (!(Test-IsAdmin)) { + throw "ERROR: No Administrator-Privileges detected!"; return + } + + $Kernel = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" + + Try { + if ($Kernel.GetValue("MitigationOptions")) + { Write-Host "Removing System MitigationOptions" + Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationOptions" -ErrorAction Stop; + } + if ($Kernel.GetValue("MitigationAuditOptions")) + { Write-Host "Removing System MitigationAuditOptions" + Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop; + } + } Catch { + Write-Host "ERROR:" $_.Exception.Message "- System" + } + } + + Remove-All-ProcessMitigations + Remove-All-SystemMitigations + ``` + +2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: + + ```XML + + - + + - + + + - + + + - + + + - + + + - + + + - + + + - + + + - + + + - + + + - + + + - + + + - + + + + + + - + + + + - + + + + + + - + + + + ``` + +If you haven’t already, it is a good idea to download and use the [Windows Security Baselines](windows-security-baselines.md) to complete your Exploit protection customization. + +## Related topics + +- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) +- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) +- [Evaluate Exploit protection](evaluate-exploit-protection.md) +- [Enable Exploit protection](enable-exploit-protection.md) +- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md) +- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)