From c741449916f8bae8da2d59f7c9106e63b10cf887 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 5 May 2023 16:38:41 -0400 Subject: [PATCH 1/4] Add tamper protection note to Defender CSP --- windows/client-management/mdm/defender-csp.md | 2 ++ ...icy-csp-admx-microsoftdefenderantivirus.md | 30 +++++++++++++++++++ .../mdm/policy-csp-defender.md | 24 +++++++++++++++ 3 files changed, 56 insertions(+) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 7550924275..a036a0332b 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -2212,6 +2212,8 @@ Tamper protection helps protect important security features from unwanted change +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 07eef1894d..0a138841a5 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -115,6 +115,8 @@ Enabling or disabling this policy may lead to unexpected or unsupported behavior +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -244,6 +246,8 @@ Real-time Protection -> Do not enable the "Turn off real-time protection" policy +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -366,6 +370,8 @@ Real-time protection consists of always-on scanning with file and process behavi +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -426,6 +432,8 @@ This policy setting allows you to configure whether Microsoft Defender Antivirus +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -482,6 +490,8 @@ This policy setting allows you specify a list of file types that should be exclu +> [!NOTE] +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. @@ -538,6 +548,8 @@ This policy setting allows you to disable scheduled and real-time scanning for f +> [!NOTE] +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. @@ -594,6 +606,8 @@ This policy setting allows you to disable real-time scanning for any file opened +> [!NOTE] +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. @@ -1577,6 +1591,8 @@ This policy setting allows you to configure behavior monitoring. +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -1637,6 +1653,8 @@ This policy setting allows you to configure scanning for all downloaded files an +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -1697,6 +1715,8 @@ This policy setting allows you to configure monitoring for file and program acti +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -1817,6 +1837,8 @@ This policy setting allows you to configure process scanning when real-time prot +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -2540,6 +2562,8 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus enha +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -3069,6 +3093,8 @@ This policy setting allows you to configure scans for malicious software and unw +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -5551,6 +5577,8 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus noti +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -5609,6 +5637,8 @@ If you enable this setting AM UI won't show reboot notifications. +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 1f26de308e..77b56fa11d 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -46,6 +46,8 @@ This policy setting allows you to configure scans for malicious software and unw +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -113,6 +115,8 @@ This policy setting allows you to configure behavior monitoring. +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -193,6 +197,8 @@ In Windows 10, Basic membership is no longer available, so setting the value to +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -457,6 +463,8 @@ Allows or disallows Windows Defender Intrusion Prevention functionality. +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -510,6 +518,8 @@ This policy setting allows you to configure scanning for all downloaded files an +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -577,6 +587,8 @@ This policy setting allows you to configure monitoring for file and program acti +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -640,6 +652,8 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -769,6 +783,8 @@ Allows or disallows Windows Defender Script Scanning functionality. +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. @@ -1891,6 +1907,8 @@ This policy setting allows you specify a list of file types that should be exclu +> [!NOTE] +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. @@ -1945,6 +1963,8 @@ This policy setting allows you to disable scheduled and real-time scanning for f +> [!NOTE] +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. @@ -1999,6 +2019,8 @@ This policy setting allows you to disable real-time scanning for any file opened +> [!NOTE] +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. @@ -2790,6 +2812,8 @@ Valid remediation action values are: +> [!NOTE] +> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. From 153d716a38947b658b06b610f784777e8e544609 Mon Sep 17 00:00:00 2001 From: yutoadachi <101614356+yut0adachi@users.noreply.github.com> Date: Tue, 9 May 2023 18:54:07 +0900 Subject: [PATCH 2/4] Update hello-hybrid-cert-whfb-provision.md The attached image on this document say "YES" about this step and the correct configuration is also like that. It needs to be corrected because it will cause confusion to readers. --- .../hello-for-business/hello-hybrid-cert-whfb-provision.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 629d9c561e..934a3f70de 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -139,7 +139,7 @@ To configure Windows Hello for Business using an *account protection* policy: 1. Under *Block Windows Hello for Business*, select **Disabled** and multiple policies become available - These policies are optional to configure, but it's recommended to configure *Enable to use a Trusted Platform Module (TPM)* to **Yes** - For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) -1. Under *Enable to certificate for on-premises resources*, select **Disabled** and multiple policies become available +1. Under *Enable to certificate for on-premises resources*, select **YES** 1. Select **Next** 1. Optionally, add *scope tags* > **Next** 1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** @@ -195,4 +195,4 @@ The certificate authority validates the certificate was signed by the registrati [MEM-3]: /mem/intune/configuration/custom-settings-configure [MEM-4]: /windows/client-management/mdm/passportforwork-csp [MEM-5]: /mem/intune/protect/endpoint-security-account-protection-policy -[MEM-6]: /mem/intune/protect/identity-protection-configure \ No newline at end of file +[MEM-6]: /mem/intune/protect/identity-protection-configure From 285f0ae0c2411e12dec42a504787e2b09321495f Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 10 May 2023 10:21:20 -0400 Subject: [PATCH 3/4] Change link --- .../mdm/policy-csp-admx-microsoftdefenderantivirus.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 0a138841a5..5ab458d27a 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -491,7 +491,7 @@ This policy setting allows you specify a list of file types that should be exclu > [!NOTE] -> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions][TAMPER-2] are met. @@ -549,7 +549,7 @@ This policy setting allows you to disable scheduled and real-time scanning for f > [!NOTE] -> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions][TAMPER-2] are met. @@ -607,7 +607,7 @@ This policy setting allows you to disable real-time scanning for any file opened > [!NOTE] -> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions][TAMPER-2] are met. @@ -5732,6 +5732,9 @@ If you enable this setting AM UI won't be available to users. + +[TAMPER-1]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection +[TAMPER-2]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#what-about-exclusions From 59ff3435b68c4b2749763caf3cd2e919441f33d0 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 10 May 2023 10:28:51 -0400 Subject: [PATCH 4/4] Update all links --- windows/client-management/mdm/defender-csp.md | 4 ++- ...icy-csp-admx-microsoftdefenderantivirus.md | 26 +++++++++--------- .../mdm/policy-csp-defender.md | 27 ++++++++++--------- 3 files changed, 31 insertions(+), 26 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 6a1e494ea6..a94f1eed2e 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -2263,7 +2263,7 @@ Tamper protection helps protect important security features from unwanted change > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -3880,6 +3880,8 @@ Node that can be used to perform signature updates for Windows Defender. + +[TAMPER-1]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 5ab458d27a..8e1f7925f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -116,7 +116,7 @@ Enabling or disabling this policy may lead to unexpected or unsupported behavior > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -247,7 +247,7 @@ Real-time Protection -> Do not enable the "Turn off real-time protection" policy > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -371,7 +371,7 @@ Real-time protection consists of always-on scanning with file and process behavi > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -433,7 +433,7 @@ This policy setting allows you to configure whether Microsoft Defender Antivirus > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -1592,7 +1592,7 @@ This policy setting allows you to configure behavior monitoring. > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -1654,7 +1654,7 @@ This policy setting allows you to configure scanning for all downloaded files an > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -1716,7 +1716,7 @@ This policy setting allows you to configure monitoring for file and program acti > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -1838,7 +1838,7 @@ This policy setting allows you to configure process scanning when real-time prot > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -2563,7 +2563,7 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus enha > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -3094,7 +3094,7 @@ This policy setting allows you to configure scans for malicious software and unw > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -5578,7 +5578,7 @@ Use this policy setting to specify if you want Microsoft Defender Antivirus noti > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -5638,7 +5638,7 @@ If you enable this setting AM UI won't show reboot notifications. > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -5732,7 +5732,7 @@ If you enable this setting AM UI won't be available to users. - + [TAMPER-1]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection [TAMPER-2]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#what-about-exclusions diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 87429df941..3e6b64b062 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -47,7 +47,7 @@ This policy setting allows you to configure scans for malicious software and unw > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -116,7 +116,7 @@ This policy setting allows you to configure behavior monitoring. > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -198,7 +198,7 @@ In Windows 10, Basic membership is no longer available, so setting the value to > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -464,7 +464,7 @@ Allows or disallows Windows Defender Intrusion Prevention functionality. > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -519,7 +519,7 @@ This policy setting allows you to configure scanning for all downloaded files an > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -588,7 +588,7 @@ This policy setting allows you to configure monitoring for file and program acti > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -653,7 +653,7 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -784,7 +784,7 @@ Allows or disallows Windows Defender Script Scanning functionality. > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -1908,7 +1908,7 @@ Allows an administrator to specify a list of file type extensions to ignore duri > [!NOTE] -> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions][TAMPER-2] are met. @@ -1964,7 +1964,7 @@ Allows an administrator to specify a list of directory paths to ignore during a > [!NOTE] -> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions][TAMPER-2] are met. @@ -2023,7 +2023,7 @@ Allows an administrator to specify a list of files opened by processes to ignore > [!NOTE] -> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions](https://go.microsoft.com/fwlink/?linkid=2235765) are met. +> To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when [certain conditions][TAMPER-2] are met. @@ -2816,7 +2816,7 @@ Valid remediation action values are: > [!NOTE] -> Changes to this setting are not applied when [tamper protection](https://go.microsoft.com/fwlink/?LinkId=2236030) is enabled. +> Changes to this setting are not applied when [tamper protection][TAMPER-1] is enabled. @@ -2850,6 +2850,9 @@ Valid remediation action values are: + +[TAMPER-1]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection +[TAMPER-2]: /microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#what-about-exclusions