mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 22:37:22 +00:00
Merge branch 'master' into import-ioc
This commit is contained in:
Joey Caparas
commit
8c47146bcc
@ -16069,6 +16069,11 @@
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/gov",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-antivirus/office-365-windows-defender-antivirus.md",
|
||||
|
||||
@ -32,6 +32,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
|
||||
@ -32,6 +32,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
|
||||
@ -240,7 +240,7 @@
|
||||
#### [Audit](policy-csp-audit.md)
|
||||
#### [Authentication](policy-csp-authentication.md)
|
||||
#### [Autoplay](policy-csp-autoplay.md)
|
||||
#### [Bitlocker](policy-csp-bitlocker.md)
|
||||
#### [BitLocker](policy-csp-bitlocker.md)
|
||||
#### [BITS](policy-csp-bits.md)
|
||||
#### [Bluetooth](policy-csp-bluetooth.md)
|
||||
#### [Browser](policy-csp-browser.md)
|
||||
@ -285,6 +285,7 @@
|
||||
#### [MixedReality](policy-csp-mixedreality.md)
|
||||
#### [MSSecurityGuide](policy-csp-mssecurityguide.md)
|
||||
#### [MSSLegacy](policy-csp-msslegacy.md)
|
||||
#### [Multitasking](policy-csp-multitasking.md)
|
||||
#### [NetworkIsolation](policy-csp-networkisolation.md)
|
||||
#### [Notifications](policy-csp-notifications.md)
|
||||
#### [Power](policy-csp-power.md)
|
||||
|
||||
@ -16,6 +16,12 @@ ms.date: 10/19/2020
|
||||
|
||||
This article lists new and updated articles for the Mobile Device Management (MDM) documentation. Updated articles are those that had content addition, removal, or corrections—minor fixes, such as correction of typos, style, or formatting issues are not listed.
|
||||
|
||||
## November 2020
|
||||
|
||||
|New or updated article | Description|
|
||||
|--- | ---|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy:<br>- [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) |
|
||||
|
||||
## October 2020
|
||||
|
||||
|New or updated article | Description|
|
||||
@ -365,7 +371,7 @@ This article lists new and updated articles for the Mobile Device Management (MD
|
||||
</ul>
|
||||
</td></tr>
|
||||
<tr>
|
||||
<td style="vertical-align:top"><a href="bitlocker-csp.md" data-raw-source="[Bitlocker CSP](bitlocker-csp.md)">Bitlocker CSP</a></td>
|
||||
<td style="vertical-align:top"><a href="bitlocker-csp.md" data-raw-source="[BitLocker CSP](bitlocker-csp.md)">BitLocker CSP</a></td>
|
||||
<td style="vertical-align:top"><p>Added new node AllowStandardUserEncryption in Windows 10, version 1809.</p>
|
||||
</td></tr>
|
||||
<tr>
|
||||
|
||||
@ -26,7 +26,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
|
||||
|New or updated article|Description|
|
||||
|-----|-----|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:<br>- [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled) |
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:<br>- [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)<br>- [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) |
|
||||
| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Updated the description of the following node:<br>- Settings/AllowWindowsDefenderApplicationGuard |
|
||||
|
||||
## What’s new in MDM for Windows 10, version 2004
|
||||
|
||||
@ -5158,6 +5158,14 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### Multitasking policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-multitasking.md#multitasking-browseralttabblowout" id="multitasking-browseralttabblowout">Multitasking/BrowserAltTabBlowout</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### NetworkIsolation policies
|
||||
|
||||
<dl>
|
||||
|
||||
@ -286,7 +286,7 @@ The following list shows the supported values:
|
||||
<!--Description-->
|
||||
Allows users to turn on/off device discovery UX.
|
||||
|
||||
When set to 0 , the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on.
|
||||
When set to 0, the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on.
|
||||
|
||||
Most restricted value is 0.
|
||||
|
||||
@ -416,7 +416,7 @@ The following list shows the supported values:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), then disabling the MDM unenrollment has no effect.
|
||||
Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g., auto-enrolled), then disabling the MDM unenrollment has no effect.
|
||||
|
||||
> [!NOTE]
|
||||
> The MDM server can always remotely delete the account.
|
||||
@ -510,7 +510,7 @@ Allows or disallows all Windows sync settings on the device. For information abo
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 – Sync settings is not allowed.
|
||||
- 0 – Sync settings are not allowed.
|
||||
- 1 (default) – Sync settings allowed.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
@ -569,7 +569,8 @@ Added in Windows 10, version 1703. This policy allows you to prevent Windows fro
|
||||
|
||||
Diagnostic data can include browser, app and feature usage, depending on the "Diagnostic and usage data" setting value.
|
||||
|
||||
> **Note** This setting does not control Cortana cutomized experiences because there are separate policies to configure it.
|
||||
> [!NOTE]
|
||||
> This setting does not control Cortana cutomized experiences because there are separate policies to configure it.
|
||||
|
||||
Most restricted value is 0.
|
||||
|
||||
@ -1156,6 +1157,74 @@ The following list shows the supported values:
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-disablecloudoptimizedcontent"></a>**Experience/DisableCloudOptimizedContent**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting lets you turn off cloud optimized content in all Windows experiences.
|
||||
|
||||
If you enable this policy setting, Windows experiences that use the cloud optimized content client component will present the default fallback content.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows experiences will be able to use cloud optimized content.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Turn off cloud optimized content*
|
||||
- GP name: *DisableCloudOptimizedContent*
|
||||
- GP path: *Windows Components/Cloud Content*
|
||||
- GP ADMX file name: *CloudContent.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Disabled.
|
||||
- 1 – Enabled.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
@ -1573,6 +1642,7 @@ Footnotes:
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
- 9 - Available in Windows 10, version 20H2.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
131
windows/client-management/mdm/policy-csp-multitasking.md
Normal file
131
windows/client-management/mdm/policy-csp-multitasking.md
Normal file
@ -0,0 +1,131 @@
|
||||
---
|
||||
title: Policy CSP - Multitasking
|
||||
description: Policy CSP - Multitasking
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/30/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - Multitasking
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## Multitasking policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#multitasking-browseralttabblowout">Multitasking/BrowserAltTabBlowout</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="multitasking-browseralttabblowout"></a>**Multitasking/BrowserAltTabBlowout**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
> [!Warning]
|
||||
> This policy is currently in preview mode only and will be supported in future releases. It may be used for testing purposes, but should not be used in a production environment at this time.
|
||||
|
||||
This policy controls the inclusion of Edge tabs into Alt+Tab.
|
||||
|
||||
Enabling this policy restricts the number of Edge tabs that are allowed to appear in the Alt+Tab switcher. Alt+Tab can be configured to show all open Edge tabs, only the 5 most recent tabs, only the 3 most recent tabs, or no tabs. Setting the policy to no tabs configures the Alt+Tab switcher to show app windows only, which is the classic Alt+Tab behavior.
|
||||
|
||||
This policy only applies to the Alt+Tab switcher. When the policy is not enabled, the feature respects the user's setting in the Settings app.
|
||||
<!--/Description-->
|
||||
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Configure the inclusion of Edge tabs into Alt-Tab*
|
||||
- GP name: *MultiTaskingAltTabFilter*
|
||||
- GP path: *Windows Components/Multitasking*
|
||||
- GP ADMX file name: *Multitasking.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 1 - Open windows and all tabs in Edge.
|
||||
- 2 - Open windows and 5 most recent tabs in Edge.
|
||||
- 3 - Open windows and 3 most recent tabs in Edge.
|
||||
- 4 - Open windows only.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
- 9 - Available in Windows 10, version 20H2.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -32,6 +32,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
|
||||
@ -35,6 +35,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
|
||||
@ -36,6 +36,7 @@
|
||||
"globalMetadata": {
|
||||
"audience": "ITPro",
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"ms.topic": "article",
|
||||
"feedback_system": "GitHub",
|
||||
|
||||
@ -33,6 +33,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"audience": "ITPro",
|
||||
"ms.topic": "article",
|
||||
|
||||
@ -33,6 +33,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.topic": "article",
|
||||
"manager": "dansimp",
|
||||
"audience": "ITPro",
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 296 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 5.4 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 78 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 5.5 KiB |
@ -29,7 +29,6 @@ ms.date: 04/24/2018
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink)
|
||||
|
||||
|
||||
@ -29,9 +29,11 @@ ms.date: 5/1/2020
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-managealerts-abovefoldlink)
|
||||
|
||||
The new alert page in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) provides full context to the alert, by combining attack signals and alerts related to the selected alert, to construct a detailed alert story.
|
||||
The alert page in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) provides full context to the alert, by combining attack signals and alerts related to the selected alert, to construct a detailed alert story.
|
||||
|
||||
Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location.
|
||||
Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location. Learn more in this overview.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4yiO5]
|
||||
|
||||
## Getting started with an alert
|
||||
|
||||
@ -90,14 +92,6 @@ If you are experiencing a false alert with a line-of-business application, creat
|
||||
> [!TIP]
|
||||
> If you're experiencing any issues not described above, use the 🙂 button to provide feedback or open a support ticket.
|
||||
|
||||
## Transitioning to the new alert page
|
||||
|
||||
When making the move to the new alert page you will notice that we have centralized information from the alert process tree, the incident graph, and the artifact timeline into the [alert story](#investigate-using-the-alert-story), with some information available through the [affected assets](#review-affected-assets) section. Any additional information has been consolidated into the details pane for the relevant entities.
|
||||
|
||||
## Video overview of the new alert page
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4yiO5]
|
||||
|
||||
## Related topics
|
||||
|
||||
- [View and organize the incidents queue](view-incidents-queue.md)
|
||||
|
||||
@ -41,15 +41,6 @@ The card gives you a high-level view of your exposure score trend over time. Any
|
||||
|
||||
## How it works
|
||||
|
||||
Threat and vulnerability management introduces a new exposure score metric, which visually represents how exposed your devices are to imminent threats.
|
||||
|
||||
The exposure score is continuously calculated on each device in the organization. It is influenced by the following factors:
|
||||
|
||||
- Weaknesses, such as vulnerabilities discovered on the device
|
||||
- External and internal threats such as public exploit code and security alerts
|
||||
- Likelihood of the device to get breached given its current security posture
|
||||
- Value of the device to the organization given its role and content
|
||||
|
||||
The exposure score is broken down into the following levels:
|
||||
|
||||
- 0–29: low exposure score
|
||||
@ -58,6 +49,46 @@ The exposure score is broken down into the following levels:
|
||||
|
||||
You can remediate the issues based on prioritized [security recommendations](tvm-security-recommendation.md) to reduce the exposure score. Each software has weaknesses that are transformed into recommendations and prioritized based on risk to the organization.
|
||||
|
||||
## How the score is calculated
|
||||
|
||||
The exposure score is continuously calculated on each device in the organization. It is scored & evaluated based on the following categories:
|
||||
|
||||
- **Threats** - external and internal threats such as public exploit code and security alerts
|
||||
- **Likelihood** - likelihood of the device to get breached given its current security posture
|
||||
- **Value** - value of the device to the organization given its role and content
|
||||
|
||||
**Device exposure score** = (Threats + Likelihood) x Value
|
||||
|
||||
**Organization exposure score** = Avg (All device exposure scores) taking into account organization value multipliers
|
||||
|
||||
### Threats
|
||||
|
||||
Points are added based on whether the device has any vulnerabilities or misconfigurations, determined by the Common Vulnerability Scoring System (CVSS) base score.
|
||||
|
||||
Further points are added based on:
|
||||
|
||||
- Exploits availability and whether the exploit is verified or ranked
|
||||
- A threat campaign is linked to the vulnerability or misconfiguration
|
||||
|
||||
### Likelihood
|
||||
|
||||
Points are added based on whether any of the following factors are true:
|
||||
|
||||
- The device is internet facing
|
||||
- Specific compensating controls are misconfigured
|
||||
- An exploit attempt is linked directly to a threat spotted in the organization
|
||||
|
||||
### Value
|
||||
|
||||
Points are added based on whether any of the following factors are true for a device:
|
||||
|
||||
- Contains high business impact (HBI) data
|
||||
- Marked as a High Value Asset (HVA) or serves as an important server role (e.g. AD, DNS)
|
||||
- Runs a business critical app (BCA)
|
||||
- Used by a marked high value user (HVU) (e.g. domain admin, CEO)
|
||||
|
||||
If a device is valuable to your organization, it should increase the total organization exposure score.
|
||||
|
||||
## Reduce your threat and vulnerability exposure
|
||||
|
||||
Lower your threat and vulnerability exposure by remediating [security recommendations](tvm-security-recommendation.md). Make the most impact to your exposure score by remediating the top security recommendations, which can be viewed in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md).
|
||||
|
||||
@ -28,7 +28,7 @@ ms.topic: conceptual
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
The software inventory in threat and vulnerability management is a list of all the software in your organization with known vulnerabilities. It also includes details such as the name of the vendor, number of weaknesses, threats, and number of exposed devices.
|
||||
The software inventory in threat and vulnerability management is a list of known software in your organization with official [Common Platform Enumerations (CPE)](https://nvd.nist.gov/products/cpe). Software products without an official CPE don’t have vulnerabilities published. It also includes details such as the name of the vendor, number of weaknesses, threats, and number of exposed devices.
|
||||
|
||||
## How it works
|
||||
|
||||
@ -47,12 +47,43 @@ View software on specific devices in the individual devices pages from the [devi
|
||||
|
||||
## Software inventory overview
|
||||
|
||||
The **Software inventory** page opens with a list of software installed in your network, including the vendor name, weaknesses found, threats associated with them, exposed devices, impact to exposure score, and tags. You can filter the list view based on weaknesses found in the software, threats associated with them, and whether the software or software versions have reached end-of-support.
|
||||
|
||||
The **Software inventory** page opens with a list of software installed in your network, including the vendor name, weaknesses found, threats associated with them, exposed devices, impact to exposure score, and tags.
|
||||
|
||||
You can filter the list view based on weaknesses found in the software, threats associated with them, and tags like whether the software has reached end-of-support.
|
||||
|
||||
|
||||
|
||||
Select the software that you want to investigate. A flyout panel will open with a more compact view of the information on the page. You can either dive deeper into the investigation and select **Open software page**, or flag any technical inconsistencies by selecting **Report inaccuracy**.
|
||||
|
||||
|
||||
### Software that isn't supported
|
||||
|
||||
Software that isn't currently supported by threat & vulnerability management is still present in the Software inventory page. Because it is not supported, only limited data will be available. Filter by unsupported software with the "Not available" option in the "Weakness" section.
|
||||
|
||||
|
||||
|
||||
The following indicates that a software is not supported:
|
||||
|
||||
- Weaknesses field shows "Not available"
|
||||
- Exposed devices field shows a dash
|
||||
- Informational text added in side panel and in software page
|
||||
|
||||
Currently, products without a CPE are not shown in the software inventory page, only in the device level software inventory.
|
||||
|
||||
## Software inventory on devices
|
||||
|
||||
From the Microsoft Defender Security Center navigation panel, go to the **[Devices list](machines-view-overview.md)**. Select the name of a device to open the device page (like Computer1), then select the **Software inventory** tab to see a list of all the known software present on the device. Select a specific software entry to open the flyout with more information.
|
||||
|
||||
Software may be visible at the device level even if it is currently not supported by threat and vulnerability management. However, only limited data will be available. You'll know if software is unsupported because it will say "Not available" in the "Weakness" column.
|
||||
|
||||
Software with no CPE can also show up under this device specific software inventory.
|
||||
|
||||
### Software evidence
|
||||
|
||||
See evidence of where we detected a specific software on a device from the registry, disk, or both.You can find it on any device in the device software inventory.
|
||||
|
||||
Select a software name to open the flyout, and look for the section called "Software Evidence."
|
||||
|
||||
|
||||
|
||||
## Software pages
|
||||
|
||||
@ -70,15 +101,6 @@ You can view software pages a few different ways:
|
||||
|
||||
|
||||
|
||||
## Software evidence
|
||||
|
||||
We now show evidence of where we detected a specific software on a device from the registry, disk or both.
|
||||
You can find it on any devices found in the [devices list](machines-view-overview.md) in a section called "Software Evidence."
|
||||
|
||||
From the Microsoft Defender Security Center navigation panel, go to the **Devices list**. Select the name of a device to open the device page (like Computer1) > select the **Software inventory** tab > select the software name to open the flyout and view software evidence.
|
||||
|
||||
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
Report a false positive when you see any vague, inaccurate, or incomplete information. You can also report on security recommendations that have already been remediated.
|
||||
|
||||
@ -91,6 +91,14 @@ If you select a CVE, a flyout panel will open with more information such as the
|
||||
|
||||
|
||||
|
||||
### Software that isn't supported
|
||||
|
||||
CVEs for software that isn't currently supported by threat & vulnerability management is still present in the Weaknesses page. Because the software is not supported, only limited data will be available.
|
||||
|
||||
Exposed device information will not be available for CVEs with unsupported software. Filter by unsupported software by selecting the "Not available" option in the "Exposed devices" section.
|
||||
|
||||
|
||||
|
||||
## View Common Vulnerabilities and Exposures (CVE) entries in other places
|
||||
|
||||
### Top vulnerable software in the dashboard
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Delete an AppLocker rule (Windows 10)
|
||||
description: This topic for IT professionals describes the steps to delete an AppLocker rule.
|
||||
description: This article for IT professionals describes the steps to delete an AppLocker rule.
|
||||
ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
@ -14,7 +14,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 08/02/2018
|
||||
ms.date: 11/09/2020
|
||||
---
|
||||
|
||||
# Delete an AppLocker rule
|
||||
@ -23,7 +23,7 @@ ms.date: 08/02/2018
|
||||
- Windows 10
|
||||
- Windows Server
|
||||
|
||||
This topic for IT professionals describes the steps to delete an AppLocker rule.
|
||||
This article for IT professionals describes the steps to delete an AppLocker rule.
|
||||
|
||||
As older apps are retired and new apps are deployed in your organization, it will be necessary to modify the application control policies. If an app becomes unsupported by the IT department or is no longer allowed due to the organization's security policy, then deleting the rule or rules associated with that app will prevent the app from running.
|
||||
|
||||
@ -34,17 +34,19 @@ AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins
|
||||
|
||||
These steps apply only for locally managed devices. If the device has AppLocker policies applied by using MDM or a GPO, the local policy will not override those settings.
|
||||
|
||||
**To delete a rule in an AppLocker policy**
|
||||
## To delete a rule in an AppLocker policy
|
||||
|
||||
1. Open the AppLocker console.
|
||||
2. Click the appropriate rule collection for which you want to delete the rule.
|
||||
3. In the details pane, right-click the rule to delete, click **Delete**, and then click **Yes**.
|
||||
|
||||
>**Note:** When using Group Policy, for the rule deletion to take effect on computers within the domain, the GPO must be distributed or refreshed.
|
||||
> [!Note]
|
||||
> - When using Group Policy, the Group Policy Object must be distributed or refreshed for rule deletion to take effect on devices.
|
||||
> - Application Identity service needs to be running for deleting Applocker rules. If you disable Applocker and delete Applocker rules, make sure to stop the Application Identity service after deleting Applocker rules. If the Application Identity service is stopped before deleting Applocker rules, and if Applocker blocks apps that are disabled, delete all of the files at `C:\Windows\System32\AppLocker`.
|
||||
|
||||
When this procedure is performed on the local device, the AppLocker policy takes effect immediately.
|
||||
When the following procedure is performed on the local device, the AppLocker policy takes effect immediately.
|
||||
|
||||
**To clear AppLocker policies on a single system or remote systems**
|
||||
## To clear AppLocker policies on a single system or remote systems
|
||||
Use the Set-AppLockerPolicy cmdlet with the -XMLPolicy parameter, using an .XML file that contains the following contents:
|
||||
|
||||
<AppLockerPolicy Version="1">
|
||||
@ -55,7 +57,7 @@ Use the Set-AppLockerPolicy cmdlet with the -XMLPolicy parameter, using an .XML
|
||||
<RuleCollection Type="Appx" EnforcementMode="NotConfigured" />
|
||||
</AppLockerPolicy>
|
||||
|
||||
To use the Set-AppLockerPolicy cmdlet, first import the Applocker modules:
|
||||
To use the Set-AppLockerPolicy cmdlet, first import the AppLocker modules:
|
||||
|
||||
PS C:\Users\Administrator> import-module AppLocker
|
||||
|
||||
|
||||
@ -32,6 +32,7 @@
|
||||
"externalReference": [],
|
||||
"globalMetadata": {
|
||||
"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
|
||||
"uhfHeaderId": "MSDocsHeader-M365-IT",
|
||||
"ms.technology": "windows",
|
||||
"ms.topic": "article",
|
||||
"audience": "ITPro",
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user