mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 13:17:23 +00:00
Merge branch 'main' into do-landing
This commit is contained in:
Greg Lindsay
GitHub
commit
8afa55db94
@ -48,31 +48,31 @@ The steps to turn on Config Lock using Microsoft Endpoint Manager (Microsoft Int
|
||||
- **Profile type**: Templates
|
||||
- **Template name**: Custom
|
||||
|
||||
:::image type="content" source="images/configlock-mem-createprofile.png" alt-text="create profile":::
|
||||
:::image type="content" source="images/configlock-mem-createprofile.png" alt-text="In Configuration profiles, the Create a profile page is showing, with the Platform set to Windows 10 and later, and a Profile Type of Templates":::
|
||||
|
||||
1. Name your profile.
|
||||
1. When you reach the Configuration Settings step, select “Add” and add the following information:
|
||||
- **OMA-URI**: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock
|
||||
- **Data type**: Integer
|
||||
- **Value**: 1 </br>
|
||||
To turn off Config Lock. Change value to 0.
|
||||
To turn off Config Lock, change the value to 0.
|
||||
|
||||
:::image type="content" source="images/configlock-mem-editrow.png" alt-text="edit row":::
|
||||
:::image type="content" source="images/configlock-mem-editrow.png" alt-text="In the Configuration settings step, the Edit Row page is shown with a Name of Config Lock, a Description of Turn on Config Lock and the OMA-URI set as above, along with a Data type of Integer set to a Value of 1":::
|
||||
|
||||
1. Select the devices to turn on Config Lock. If you're using a test tenant, you can select “+ Add all devices”.
|
||||
1. You'll not need to set any applicability rules for test purposes.
|
||||
1. Review the Configuration and select “Create” if everything is correct.
|
||||
1. After the device syncs with the Microsoft Intune server, you can confirm if the Config Lock was successfully enabled.
|
||||
|
||||
:::image type="content" source="images/configlock-mem-dev.png" alt-text="status":::
|
||||
:::image type="content" source="images/configlock-mem-dev.png" alt-text="The Profile assignment status dashboard when viewing the Config Lock device configuration profile, showing one device has succeeded in having this profile applied":::
|
||||
|
||||
:::image type="content" source="images/configlock-mem-devstatus.png" alt-text="device status":::
|
||||
:::image type="content" source="images/configlock-mem-devstatus.png" alt-text="The Device Status for the Config Lock Device Configuration Profile, showing one device with a Deployment Status as Succeeded and two with Pending":::
|
||||
|
||||
## Disabling
|
||||
## Configuring Secured-Core PC features
|
||||
|
||||
Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune.
|
||||
Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enable/disable) SCPC features (for example Firmware protection) via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune.
|
||||
|
||||
:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="firmware protect":::
|
||||
:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off":::
|
||||
|
||||
## FAQ
|
||||
|
||||
|
||||
@ -121,30 +121,30 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
The following example shows the contents of a sample customizations.xml file.
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizatons>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizatons>
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizations>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizations>
|
||||
```
|
||||
|
||||
5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings.
|
||||
@ -152,48 +152,48 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizatons>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizatons>
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizations>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizations>
|
||||
```
|
||||
|
||||
6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
|
||||
@ -212,56 +212,56 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizatons>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
<Variant>
|
||||
<TargetRefs>
|
||||
<TargetRef Id="Unique target identifier for desktop" />
|
||||
<TargetRef Id="Mobile target" />
|
||||
</TargetRefs>
|
||||
<Settings>
|
||||
<Policies>
|
||||
<AllowBrowser>1</AllowBrowser>
|
||||
<AllowCamera>1</AllowCamera>
|
||||
<AllowBluetooth>1</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>1</Enabled>
|
||||
</HotSpot>
|
||||
</Settings>
|
||||
</Variant>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizatons>
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizations>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
<Variant>
|
||||
<TargetRefs>
|
||||
<TargetRef Id="Unique target identifier for desktop" />
|
||||
<TargetRef Id="Mobile target" />
|
||||
</TargetRefs>
|
||||
<Settings>
|
||||
<Policies>
|
||||
<AllowBrowser>1</AllowBrowser>
|
||||
<AllowCamera>1</AllowCamera>
|
||||
<AllowBluetooth>1</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>1</Enabled>
|
||||
</HotSpot>
|
||||
</Settings>
|
||||
</Variant>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizations>
|
||||
```
|
||||
|
||||
7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step.
|
||||
|
||||
@ -82,6 +82,10 @@ If all else fails, try resetting the Windows Update Agent by running these comma
|
||||
Ren %Systemroot%\SoftwareDistribution\Download Download.bak
|
||||
Ren %Systemroot%\System32\catroot2 catroot2.bak
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The **reset** step below using sc.exe will **overwrite** your existing security ACLs on the BITS and Windows Update service and set them to default. Skip this step unless the other steps to reset Windows Update components have not resolved the issue.
|
||||
|
||||
2. Reset the **BITS service** and the **Windows Update service** to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
``` console
|
||||
sc.exe sdset bits D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
|
||||
|
||||
@ -16,7 +16,7 @@ ms.collection:
|
||||
- M365-identity-device-management
|
||||
- highpri
|
||||
ms.topic: article
|
||||
ms.date: 08/17/2017
|
||||
ms.date: 03/10/2022
|
||||
---
|
||||
|
||||
# Protect derived domain credentials with Windows Defender Credential Guard
|
||||
@ -38,12 +38,8 @@ By enabling Windows Defender Credential Guard, the following features and soluti
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert)
|
||||
- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel)
|
||||
- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert)
|
||||
- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode)
|
||||
- [Protecting network passwords with Windows Defender Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard)
|
||||
- [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382)
|
||||
- [What's New in Kerberos Authentication for Windows Server 2012](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831747(v=ws.11))
|
||||
- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd378897(v=ws.10))
|
||||
- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview)
|
||||
- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview)
|
||||
|
||||
@ -45,11 +45,15 @@ sections:
|
||||
|
||||
- question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager?
|
||||
answer: |
|
||||
Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. In Configuration Manager version 1910 and later, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings).
|
||||
Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings).
|
||||
|
||||
- question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Manager Intune?
|
||||
answer: |
|
||||
Windows Hello for Business deployments using Intune allow for a great deal of flexibility in deployment. For more information, see [Integrate Windows Hello for Business with Microsoft Intune](/mem/intune/protect/windows-hello).
|
||||
|
||||
- question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer?
|
||||
answer: |
|
||||
The maximum number of supported enrollments on a single Windows 10 computer is 10. This limit lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we'll strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available.
|
||||
The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. For devices with more than 10 users, we strongly encourage the use of FIDO2 security keys.
|
||||
|
||||
- question: How can a PIN be more secure than a password?
|
||||
answer: |
|
||||
@ -101,8 +105,8 @@ sections:
|
||||
|
||||
[Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience)
|
||||
|
||||
For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network.
|
||||
|
||||
For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs. Non-destructive PIN reset works without access to the corporate network. Destructive PIN reset requires access to the corporate network. For more details about destructive and non-destructive PIN reset, see [PIN reset](/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset).
|
||||
|
||||
- question: What URLs do I need to allow for a hybrid deployment?
|
||||
answer: |
|
||||
Communicating with Azure Active Directory uses the following URLs:
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Why a PIN is better than a password (Windows)
|
||||
description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password .
|
||||
title: Why a PIN is better than an online password (Windows)
|
||||
description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) an online password .
|
||||
ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212
|
||||
keywords: pin, security, password, hello
|
||||
ms.prod: m365-security
|
||||
@ -19,42 +19,44 @@ ms.localizationpriority: medium
|
||||
ms.date: 10/23/2017
|
||||
---
|
||||
|
||||
# Why a PIN is better than a password
|
||||
# Why a PIN is better than an online password
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password?
|
||||
On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works.
|
||||
Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a local password?
|
||||
On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than an online password, it's how it works. First we need to distinguish between two types of passwords: `local` passwords are validated against the machine's password store, whereas `online` passwords are validated against a server. This article mostly covers the benefits a PIN has over an online password, and also why it can be considered even better than a local password.
|
||||
|
||||
Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password.
|
||||
Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than an online password.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA]
|
||||
|
||||
## PIN is tied to the device
|
||||
|
||||
One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too!
|
||||
One important difference between an online password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your online password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too!
|
||||
|
||||
Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device.
|
||||
|
||||
## PIN is local to the device
|
||||
|
||||
A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server.
|
||||
An online password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server.
|
||||
When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server.
|
||||
However, note that even though local passwords are also local to the device, they are still less secure than a PIN, as described in the next section.
|
||||
|
||||
>[!NOTE]
|
||||
>For details on how Hello uses asymetric key pairs for authentication, see [Windows Hello for Business](hello-overview.md#benefits-of-windows-hello).
|
||||
|
||||
## PIN is backed by hardware
|
||||
|
||||
The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Many modern devices have TPM.
|
||||
The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Many modern devices have TPM. Windows 10, on the other hand, has a defect of not linking local passwords to TPM. This is the reason why PINs are considered more secure than local passwords.
|
||||
|
||||
User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can't be stolen in cases where the identity provider or websites the user accesses have been compromised.
|
||||
|
||||
The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked.
|
||||
|
||||
|
||||
## PIN can be complex
|
||||
|
||||
The Windows Hello for Business PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](hello-manage-in-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits.
|
||||
|
||||
@ -14,7 +14,7 @@ ms.collection:
|
||||
- M365-security-compliance
|
||||
- highpri
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.date: 03/10/2022
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
@ -64,6 +64,7 @@ Microsoft includes instrumentation in Windows 11 and Windows 10 that enable the
|
||||
## Deploy hard drive encryption
|
||||
|
||||
BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 11 and Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker.
|
||||
|
||||
With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 11 and Windows 10.
|
||||
|
||||
## BitLocker Device Encryption
|
||||
@ -130,11 +131,11 @@ For more information about how to configure Network Unlock, see [BitLocker: How
|
||||
|
||||
## Microsoft BitLocker Administration and Monitoring
|
||||
|
||||
Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features:
|
||||
Part of the Microsoft Desktop Optimization Pack, Microsoft BitLocker Administration and Monitoring (MBAM) makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features:
|
||||
|
||||
* Enables administrators to automate the process of encrypting volumes on client computers across the enterprise.
|
||||
* Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself.
|
||||
* Provides centralized reporting and hardware management with Microsoft Microsoft Endpoint Configuration Manager.
|
||||
* Provides centralized reporting and hardware management with Microsoft Endpoint Configuration Manager.
|
||||
* Reduces the workload on the help desk to assist end users with BitLocker recovery requests.
|
||||
* Enables end users to recover encrypted devices independently by using the Self-Service Portal.
|
||||
* Enables security officers to easily audit access to recovery key information.
|
||||
@ -144,4 +145,9 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage
|
||||
* Offers an IT-customizable recovery user experience.
|
||||
* Supports Windows 10.
|
||||
|
||||
For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/) on the MDOP TechCenter.
|
||||
> [!IMPORTANT]
|
||||
> Enterprises could use MBAM to manage client computers with BitLocker that are domain-joined on-premises until mainstream support ended in July 2019, or they could receive extended support until April 2026.
|
||||
|
||||
Going forward, the functionality of MBAM will be incorporated into Configuration Manager. For more details, see [Features in Configuration Manager technical preview version 1909](/mem/configmgr/core/get-started/2019/technical-preview-1909#bkmk_bitlocker).
|
||||
|
||||
Enterprises not using Configuration Manager can use the built-in features of Azure AD and Microsoft Intune in Microsoft Endpoint Manager for administration and monitoring. For more details, see [Monitor device encryption with Intune](/mem/intune/protect/encryption-monitor).
|
||||
|
||||
@ -81,11 +81,7 @@ If you feel you've been a victim of a phishing attack:
|
||||
|
||||
- **Microsoft Office Outlook**: While in the suspicious message, select **Report message** from the ribbon, and then select **Phishing**.
|
||||
|
||||
- **Microsoft**: Create a new, blank email message with the one of the following recipients:
|
||||
- Junk: junk@office365.microsoft.com
|
||||
- Phishing: phish@office365.microsoft.com
|
||||
|
||||
Drag and drop the junk or phishing message into the new message. This will save the junk or phishing message as an attachment in the new message. Don't copy and paste the content of the message or forward the message (we need the original message so we can inspect the message headers). For more information, see [Report messages and files to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft).
|
||||
- **Microsoft 365**: Use the [Submissions portal in Microsoft 365 Defender](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft) to submit the junk or phishing sample to Microsoft for analysis. For more information, see [Report messages and files to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft).
|
||||
|
||||
- **Anti-Phishing Working Group**: phishing-report@us-cert.gov. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions, and law enforcement agencies are involved.
|
||||
|
||||
|
||||
@ -45,9 +45,7 @@ Test Provider | Lab Test Type | Minimum Level / Score
|
||||
AV-Comparatives | Real-World Protection Test </br> https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives
|
||||
AV-Test | Must pass tests for Windows. Certifications for Mac and Linux aren't accepted </br> https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users)
|
||||
ICSA Labs | Endpoint Anti-Malware Detection </br> https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified
|
||||
NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities </br> https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS
|
||||
SKD Labs | Certification Requirements Product: Anti-virus or Antimalware </br> http://www.skdlabs.com/html/english/ </br> http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5% with On Demand, On Access and Total Detection tests
|
||||
SE Labs | Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating </br> https://selabs.uk/en/reports/consumers |Home or Enterprise “A” rating
|
||||
VB 100 | VB100 Certification Test V1.1 </br> https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/ | VB100 Certification
|
||||
West Coast Labs | Checkmark Certified </br> http://www.checkmarkcertified.com/sme/ | “A” Rating on Product Security Performance
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 09/20/2021
|
||||
ms.date: 03/10/2022
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -31,13 +31,13 @@ Application Guard uses both network isolation and application-specific settings.
|
||||
These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container.
|
||||
|
||||
> [!NOTE]
|
||||
> You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy.
|
||||
> You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the **Domains categorized as both work and personal** policy.
|
||||
|
||||
|Policy name|Supported versions|Description|
|
||||
|-----------|------------------|-----------|
|
||||
|Private network ranges for apps | At least Windows Server 2012, Windows 8, or Windows RT| A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
|
||||
|Enterprise resource domains hosted in the cloud| At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. <p>**NOTE**: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|Domains categorized as both work and personal| At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. <p>**NOTE**: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|Enterprise resource domains hosted in the cloud| At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (`|`) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. <p>Note that this list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|Domains categorized as both work and personal| At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. <p>Note that this list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|
||||
## Network isolation settings wildcards
|
||||
|
||||
@ -49,7 +49,7 @@ These settings, located at `Computer Configuration\Administrative Templates\Netw
|
||||
|`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.|
|
||||
|
||||
## Application-specific settings
|
||||
These settings, located at `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard`, can help you to manage your company's implementation of Application Guard.
|
||||
These settings, located at `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard`, can help you to manage your organization's implementation of Application Guard.
|
||||
|
||||
|Name|Supported versions|Description|Options|
|
||||
|-----------|------------------|-----------|-------|
|
||||
@ -63,3 +63,9 @@ These settings, located at `Computer Configuration\Administrative Templates\Wind
|
||||
|Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher<p>Windows 11|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.<p>**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.|
|
||||
|Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher<p>Windows 11|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.<p>**Disabled or not configured.** Certificates are not shared with Microsoft Defender Application Guard.|
|
||||
|Allow auditing events in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher<br><br>Windows 10 Pro, 1809 or higher<p>Windows 11|This policy setting allows you to decide whether auditing events can be collected from Microsoft Defender Application Guard.|**Enabled.** Application Guard inherits auditing policies from your device and logs system events from the Application Guard container to your host.<p>**Disabled or not configured.** event logs aren't collected from your Application Guard container.|
|
||||
|
||||
## Application Guard support dialog settings
|
||||
|
||||
These settings are located at `Administrative Templates\Windows Components\Windows Security\Enterprise Customization`. If an error is encountered, you are presented with a dialog box. By default, this dialog box only contains the error information and a button for you to report it to Microsoft via the feedback hub. However, it is possible to provide additional information in the dialog box.
|
||||
|
||||
[Use Group Policy to enable and customize contact information](/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information#use-group-policy-to-enable-and-customize-contact-information).
|
||||
|
||||
@ -62,11 +62,11 @@ Additional settings that can be included in a custom Passfilt.dll are the use of
|
||||
> [!TIP]
|
||||
> For the latest best practices, see [Password Guidance](https://www.microsoft.com/research/publication/password-guidance).
|
||||
|
||||
Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible.
|
||||
Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 159,238,157,238,528 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible.
|
||||
|
||||
The use of ALT key character combinations may greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements might result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add more complexity to the password.)
|
||||
|
||||
Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements.
|
||||
Short passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and/or meet complexity requirements.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ ms.reviewer: jogeurte
|
||||
ms.author: jogeurte
|
||||
ms.manager: jsuther
|
||||
manager: dansimp
|
||||
ms.date: 11/06/2021
|
||||
ms.date: 03/08/2022
|
||||
ms.technology: windows-sec
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
@ -88,8 +88,8 @@ In addition to the steps outlined above, the binary policy file must also be cop
|
||||
$MountPoint = 'C:\EFI'
|
||||
$EFIDestinationFolder = "$MountPoint\Microsoft\Boot\CiPolicies\Active"
|
||||
$EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0]
|
||||
mkdir $EFIDestinationFolder
|
||||
mountvol $MountPoint $EFIPartition
|
||||
mkdir $EFIDestinationFolder
|
||||
```
|
||||
|
||||
2. Copy the signed policy to the created folder:
|
||||
|
||||
@ -46,7 +46,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
|
||||
<VersionEx>10.0.22530.0</VersionEx>
|
||||
<VersionEx>10.0.25070.0</VersionEx>
|
||||
<PolicyTypeID>{D2BDA982-CCF6-4344-AC5B-0B44427B6816}</PolicyTypeID>
|
||||
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
|
||||
<Rules>
|
||||
@ -64,6 +64,8 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<EKUs />
|
||||
<!--File Rules-->
|
||||
<FileRules>
|
||||
<Allow ID="ID_ALLOW_ALL_1" FriendlyName="" FileName="*" />
|
||||
<Allow ID="ID_ALLOW_ALL_2" FriendlyName="" FileName="*" />
|
||||
<Deny ID="ID_DENY_ASIO_32_SHA1" FriendlyName="ASIO32.sys Hash Sha1" Hash="D569D4BAB86E70EFBCDFDAC9D822139D6F477B7C" />
|
||||
<Deny ID="ID_DENY_ASIO_32_SHA256" FriendlyName="ASIO32.sys Hash Sha256" Hash="80599708CE61EC5D6DCFC5977208A2A0BE2252820A88D9BA260D8CDF5DC7FBE4" />
|
||||
<Deny ID="ID_DENY_ASIO_32_SHA1_PAGE" FriendlyName="ASIO32.sys Hash Page Sha1" Hash="80FA962BDFB76DFCB9E5D13EFC38BB3D392F2E77" />
|
||||
@ -108,6 +110,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Deny ID="ID_DENY_BANDAI_SHA256" FriendlyName="bandai.sys Hash Sha256" Hash="7FD788358585E0B863328475898BB4400ED8D478466D1B7F5CC0252671456CC8" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA1_PAGE" FriendlyName="bandai.sys Hash Page Sha1" Hash="EA360A9F23BB7CF67F08B88E6A185A699F0C5410" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA256_PAGE" FriendlyName="bandai.sys Hash Page Sha256" Hash="BB83738210650E09307CE869ACA9BFA251024D3C47B1006B94FCE2846313F56E" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA1" FriendlyName="BS_RCIO64 73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Sha1" Hash="4BFE9E5A5A25B7CDE6C81EBE31ED4ABEB5147FAF" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA256" FriendlyName="BS_RCIO64 73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Sha256" Hash="0381632CD236CD94FA9E64CCC958516AC50F9437F99092E231A607B1E6BE6CF8" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA1_PAGE" FriendlyName="BS_RCIO64 5651466512138240\73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Page Sha1" Hash="C28B640BECA5E2834D2A373F139869CC309F6631" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA256_PAGE" FriendlyName="BS_RCIO64 5651466512138240\73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Page Sha256" Hash="9378F7DFF94D9409D38FA1A125C52734D6BAEA90913FC3CEE2659FD36AB0DA29" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA1" FriendlyName="capcom.sys Hash Sha1" Hash="1D1CAFC73C97C6BCD2331F8777D90FDCA57125A3" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA256" FriendlyName="capcom.sys Hash Sha256" Hash="FAA08CB609A5B7BE6BFDB61F1E4A5E8ADF2F5A1D2492F262483DF7326934F5D4" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA1_PAGE" FriendlyName="capcom.sys Hash Page Sha1" Hash="69006FBBD1B150FB9404867A5BCDC04FE0FC1BAD" />
|
||||
@ -396,6 +402,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttrib ID="ID_FILEATTRIB_BSMI" FriendlyName="" FileName="BSMI.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.3" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_HWMIO64" FriendlyName="" FileName="BS_HWMIO64_W10.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.0.1806.2200" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_I2CIO" FriendlyName="" FileName="BS_I2cIo.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.1.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_RCIO" FriendlyName="BS_RCIO.sys FileAttribute" FileName="BS_RCIO64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.0.0.1" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NTIOLIB" FriendlyName="" FileName="NTIOLib.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_CPUZ_DRIVER" FriendlyName="" FileName="cpuz.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.4.3" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_ELBY_DRIVER" FriendlyName="" FileName="ElbyCDIO.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="6.0.3.2" />
|
||||
@ -406,6 +413,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttrib ID="ID_FILEATTRIB_LIBNICM_DRIVER" FriendlyName="" FileName="libnicm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_MTCBSV64" FriendlyName="mtcBSv64.sys FileAttribute" FileName="mtcBSv64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="21.2.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NCHGBIOS2X64" FriendlyName="" FileName="NCHGBIOS2x64.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="4.2.4.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NCPL_DRIVER" FriendlyName="" FileName="NCPL.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NICM_DRIVER" FriendlyName="" FileName="NICM.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NSCM_DRIVER" FriendlyName="" FileName="nscm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_PHYSMEM" FriendlyName="Physmem.sys FileAttribute" FileName="physmem.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="65535.65535.65535.65535" />
|
||||
@ -418,6 +426,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttrib ID="ID_FILEATTRIB_SANDRA_DRIVER" FriendlyName="" FileName="sandra.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.12.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_SEGWINDRVX64" FriendlyName="segwindrvx64.sys FileAttribute" FileName="segwindrvx64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="100.0.7.2" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_TREND_MICRO" FriendlyName="TmComm.sys" FileName="TmComm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="8.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VBOX" FriendlyName="VBoxDrv.sys FileAttribute" FileName="VBoxDrv.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VIRAGT" FriendlyName="viragt.sys 32-bit" FileName="viragt.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.80.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VIRAGT64" FriendlyName="viragt64.sys" FileName="viragt64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.11" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VMDRV" FriendlyName="vmdrv.sys FileAttribute" FileName="vmdrv.sys" MinimumFileVersion="10.0.10011.16384" />
|
||||
@ -473,6 +482,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_ATSZIO" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_IQVW64" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCPL_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_TREND_MICRO" />
|
||||
@ -513,6 +523,16 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Signer ID="ID_SIGNER_VBOX" Name="GlobalSign Primary Object Publishing CA">
|
||||
<CertRoot Type="TBS" Value="041750993D7C9E063F02DFE74699598640911AAB" />
|
||||
<CertPublisher Value="innotek GmbH" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VBOX_ORCALE" Name="VeriSign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="Oracle Corporation" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_VBOX" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VBOX_SUN" Name="VeriSign Class 3 Code Signing 2004 CA">
|
||||
<CertRoot Type="TBS" Value="C7FC1727F5B75A6421A1F95C73BBDB23580C48E5" />
|
||||
<CertPublisher Value="Sun Microsystems, Inc." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_VBOX" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_REALTEK" Name="DigiCert EV Code Signing CA">
|
||||
<CertRoot Type="TBS" Value="2D54C16A8F8B69CCDEA48D0603C132F547A5CF75" />
|
||||
@ -544,9 +564,11 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Signer ID="ID_SIGNER_WINDOWS_3RD_PARTY_2014" Name="Microsoft Windows Third Party Component CA 2014">
|
||||
<CertRoot Type="TBS" Value="D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE" />
|
||||
<CertPublisher Value="Microsoft Windows Hardware Compatibility Publisher" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_BS_RCIO" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_CPUZ_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LHA" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCPL_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIO_DRIVER" />
|
||||
@ -600,6 +622,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="Novell, Inc." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCPL_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
</Signer>
|
||||
@ -698,6 +721,12 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_SAASAME" Name="SaaSaMe Ltd.">
|
||||
<CertRoot Type="TBS" Value="A86DE66D8198E4272859881476A6F9936034A482" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_NVIDIA_2011" Name="Leaked 2011 NVIDIA Corporation Verisign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="15C37DBEBE6FCC77108E3D7AD982676D3D5E77F7" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_NVIDIA_2015" Name="Leaked 2015 NVIDIA Corporation Verisign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="F049A238763D4A90B148AB10A500F96EBF1DC436" />
|
||||
</Signer>
|
||||
</Signers>
|
||||
<!--Driver Signing Scenarios-->
|
||||
@ -728,16 +757,20 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<DeniedSigner SignerId="ID_SIGNER_MIMIKATZ_KERNEL_SHA2" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_MIMIKATZ_USER" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NANJING" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NVIDIA_2011" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NVIDIA_2015" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_PHYSMEM" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_REALTEK" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_RWEVERY" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SAASAME" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SAASAME" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SANDRA" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SANDRA_THAWTE" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SPEEDFAN" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SYMANTEC_CLASS_3" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_TRUST_ASIA" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX_ORCALE" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX_SUN" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2004" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2004_BIOSTAR" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2009" />
|
||||
@ -802,6 +835,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA1_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA256_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA1_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA256_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA1_PAGE" />
|
||||
@ -1106,7 +1143,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
</Setting>
|
||||
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
|
||||
<Value>
|
||||
<String>10.0.22530.0</String>
|
||||
<String>10.0.25070.0</String>
|
||||
</Value>
|
||||
</Setting>
|
||||
</Settings>
|
||||
|
||||
@ -29,6 +29,9 @@ Windows Sandbox has the following properties:
|
||||
- **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host.
|
||||
- **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Windows Sandbox enables network connection by default. It can be disabled using the [Windows Sandbox configuration file](/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file#networking).
|
||||
|
||||
The following video provides an overview of Windows Sandbox.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4rFAo]
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user