mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-26 15:53:40 +00:00
Merge branch 'master' into dh-new-alerts
This commit is contained in:
Dani Halfin
@ -87,7 +87,7 @@ The following tables describe baseline protections, plus protections for improve
|
||||
> [!NOTE]
|
||||
> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers.
|
||||
>
|
||||
> If you are an OEM, see [PC OEM requirements for Windows Defender Device Guard and Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
|
||||
> If you are an OEM, see [PC OEM requirements for Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
|
||||
|
||||
### Baseline protections
|
||||
|
||||
@ -98,7 +98,7 @@ The following tables describe baseline protections, plus protections for improve
|
||||
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br>[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only Windows Defender Device Guard is supported in this configuration.</p></blockquote> |Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. </p></blockquote> |Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide.
|
||||
|
||||
@ -29,7 +29,7 @@ By enabling Windows Defender Credential Guard, the following features and soluti
|
||||
|
||||
- **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials.
|
||||
- **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system.
|
||||
- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard and other security strategies and architectures.
|
||||
- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate other security strategies and architectures.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -14,16 +14,12 @@
|
||||
|
||||
## [Plan deployment](microsoft-defender-atp/deployment-strategy.md)
|
||||
|
||||
|
||||
## [Deployment guide]()
|
||||
### [Deployment phases](microsoft-defender-atp/deployment-phases.md)
|
||||
### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md)
|
||||
### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md)
|
||||
### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md)
|
||||
|
||||
|
||||
|
||||
|
||||
## [Security administration]()
|
||||
### [Threat & Vulnerability Management]()
|
||||
#### [Overview of Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
@ -42,7 +38,7 @@
|
||||
#### [Attack surface reduction evaluation](microsoft-defender-atp/evaluate-attack-surface-reduction.md)
|
||||
#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md)
|
||||
#### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md)
|
||||
|
||||
#### [Attack surface reduction rules in Windows 10 Enterprise E3](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3)
|
||||
|
||||
#### [Attack surface reduction controls]()
|
||||
##### [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md)
|
||||
@ -257,8 +253,6 @@
|
||||
|
||||
## [Security operations]()
|
||||
|
||||
|
||||
|
||||
### [Endpoint detection and response]()
|
||||
#### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md)
|
||||
#### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md)
|
||||
@ -266,6 +260,7 @@
|
||||
##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md)
|
||||
##### [Manage incidents](microsoft-defender-atp/manage-incidents.md)
|
||||
##### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md)
|
||||
|
||||
|
||||
#### [Alerts queue]()
|
||||
##### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md)
|
||||
@ -317,10 +312,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
##### [Shadow protection?](windows-defender-antivirus/shadow-protection.md)
|
||||
|
||||
#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md)
|
||||
|
||||
#### [Reporting]()
|
||||
@ -334,10 +325,9 @@
|
||||
##### [Understand custom detections](microsoft-defender-atp/overview-custom-detections.md)
|
||||
##### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### [Behavioral blocking and containment]()
|
||||
#### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md)
|
||||
#### [EDR in block mode](microsoft-defender-atp/edr-in-block-mode.md)
|
||||
|
||||
### [Automated investigation and response]()
|
||||
#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md)
|
||||
@ -424,7 +414,7 @@
|
||||
##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
###### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
###### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
####### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
#### [APIs]()
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
@ -702,7 +692,7 @@
|
||||
|
||||
### [Microsoft Defender SmartScreen](microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md)
|
||||
#### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md)
|
||||
#### [Set up and use Microsft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md)
|
||||
#### [Set up and use Microsoft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md)
|
||||
|
||||
|
||||
### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use attack surface reduction rules in Windows 10 Enterprise E3
|
||||
description: ASR rules can help prevent exploits from using apps and scripts to infect machines with malware
|
||||
description: Attack surface reduction rules can help prevent exploits from using apps and scripts to infect machines with malware
|
||||
keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -20,34 +20,35 @@ ms.custom: asr
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Enterprise E3
|
||||
|
||||
Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. This feature area includes the rules, monitoring, reporting, and analytics necessary for deployment that are included in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), and require the Windows 10 Enterprise E5 license.
|
||||
Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. Attack surface reduction includes the rules, monitoring, reporting, and analytics necessary for deployment, and this is included in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md). These capabilities require the Windows 10 Enterprise E5 license.
|
||||
|
||||
A limited subset of basic attack surface reduction rules can technically be used with Windows 10 Enterprise E3. They can be used without the benefits of reporting, monitoring, and analytics, which provide the ease of deployment and management capabilities necessary for enterprises.
|
||||
A limited subset of basic attack surface reduction rules can be used with Windows 10 Enterprise E3 (without the benefits of reporting, monitoring, and analytics). The table below lists attack surface reduction rules available in Windows E3 and Windows E5.
|
||||
|
||||
|Rule |Windows E3 |Windows E5 |
|
||||
|--|--|--|
|
||||
[Block executable content from email client and webmail](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-executable-content-from-email-client-and-webmail) |Yes |Yes |
|
||||
|[Block all Office applications from creating child processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-all-office-applications-from-creating-child-processes) |Yes |Yes |
|
||||
|[Block Office applications from creating executable content](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-office-applications-from-creating-executable-content) |Yes |Yes |
|
||||
|[Block Office applications from injecting code into other processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-office-applications-from-injecting-code-into-other-processes) |Yes |Yes |
|
||||
|[Block JavaScript or VBScript from launching downloaded executable content](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-javascript-or-vbscript-from-launching-downloaded-executable-content) |Yes |Yes |
|
||||
|[Block execution of potentially obfuscated scripts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-execution-of-potentially-obfuscated-scripts) |Yes |Yes |
|
||||
|[Block Win32 API calls from Office macros](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-win32-api-calls-from-office-macros) |Yes |Yes |
|
||||
|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | |Yes |
|
||||
|[Use advanced protection against ransomware](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#use-advanced-protection-against-ransomware) |Yes |Yes |
|
||||
|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-credential-stealing-from-the-windows-local-security-authority-subsystem) |Yes |Yes |
|
||||
|[Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-process-creations-originating-from-psexec-and-wmi-commands) |Yes |Yes |
|
||||
|[Block untrusted and unsigned processes that run from USB](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-untrusted-and-unsigned-processes-that-run-from-usb) |Yes |Yes |
|
||||
|[Block Office communication applications from creating child processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-office-communication-application-from-creating-child-processes) | |Yes |
|
||||
|[Block Adobe Reader from creating child processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-adobe-reader-from-creating-child-processes) | |Yes |
|
||||
|[Block persistence through WMI event subscription](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-persistence-through-wmi-event-subscription) | |Yes |
|
||||
|
||||
Attack surface reduction rules are supported on Windows Server 2019 as well as Windows 10 clients.
|
||||
|
||||
The limited subset of rules that can be used in Windows 10 Enterprise E3 include:
|
||||
|
||||
- Block executable content from email client and webmail
|
||||
- Block all Office applications from creating child processes
|
||||
- Block Office applications from creating executable content
|
||||
- Block Office applications from injecting code into other processes
|
||||
- Block JavaScript or VBScript from launching downloaded executable content
|
||||
- Block execution of potentially obfuscated scripts
|
||||
- Block Win32 API calls from Office macro
|
||||
- Use advanced protection against ransomware
|
||||
- Block credential stealing from the Windows local security authority subsystem (lsass.exe)
|
||||
- Block process creations originating from PSExec and WMI commands
|
||||
- Block untrusted and unsigned processes that run from USB
|
||||
|
||||
For more information about these rules, see [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md).
|
||||
|
||||
## Related topics
|
||||
|
||||
Topic | Description
|
||||
---|---
|
||||
[Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) | Use a tool to see a number of scenarios that demonstrate how attack surface reduction rules work, and what events would typically be created.
|
||||
[Enable attack surface reduction rules](enable-attack-surface-reduction.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage attack surface reduction rules in your network.
|
||||
[Customize attack surface reduction rules](customize-attack-surface-reduction.md) | Exclude specified files and folders from being evaluated by attack surface reduction rules and customize the notification that appears on a user's machine when a rule blocks an app or file.
|
||||
## Related articles
|
||||
- [Attack surface reduction rules](attack-surface-reduction.md)
|
||||
- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
|
||||
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
- [Customize attack surface reduction rules](customize-attack-surface-reduction.md)
|
||||
|
||||
@ -0,0 +1,49 @@
|
||||
---
|
||||
title: Behavioral blocking and containment
|
||||
description: Learn about behavioral blocking and containment capabilities in Microsoft Defender ATP
|
||||
keywords: Microsoft Defender ATP, EDR in block mode, passive mode blocking
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
manager: dansimp
|
||||
ms.reviewer: shwetaj
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.localizationpriority: medium
|
||||
ms.custom:
|
||||
- next-gen
|
||||
- edr
|
||||
ms.collection:
|
||||
---
|
||||
|
||||
# Behavioral blocking and containment
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
## Behavioral blocking and containment overview
|
||||
|
||||
Not all cyberattacks involve a simple piece of malware that's found and removed. Some attacks, such as fileless attacks, are much more difficult to identify, let alone contain. Microsoft Defender ATP includes behavioral blocking and containment capabilities that can help identify and stop threats with machine learning, pre- and post-breach. In almost real time, when a suspicious behavior or artifact is detected and determined to be malicious, the threat is blocked. Pre-execution models learn about that threat, and prevent it from running on other endpoints.
|
||||
|
||||
## Behavioral blocking and containment capabilities
|
||||
|
||||
Behavioral blocking and containment capabilities include the following:
|
||||
|
||||
- **On-client, policy-driven [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)**. Predefined common attack behaviors are prevented from executing, according to your attack surface reduction rules. When such behaviors attempt to execute, they can be seen in the Microsoft Defender Security Center (https://securitycenter.windows.com) as informational alerts. (Attack surface reduction rules are not enabled by default; you configure your policies in the Microsoft Defender Security Center.)
|
||||
|
||||
- **Client behavioral blocking**. Threats on endpoints are detected through machine learning, and then are blocked and remediated automatically. (Client behavioral blocking is enabled by default.)
|
||||
|
||||
- **Feedback-loop blocking** (also referred to as rapid protection). Threat detections that are assumed to be false negatives are observed through behavioral intelligence. Threats are stopped and prevented from running on other endpoints. (Feedback-loop blocking is enabled by default.)
|
||||
|
||||
- **[Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md)**. Malicious artifacts or behaviors that are observed through post-breach protection are blocked and contained. EDR in block mode works even if Windows Defender Antivirus is not the primary antivirus solution. (EDR in block mode, currently in [limited private preview](edr-in-block-mode.md#can-i-participate-in-the-preview-of-edr-in-block-mode), is not enabled by default; you turn it on in the Microsoft Defender Security Center.)
|
||||
|
||||
As Microsoft continues to improve threat protection features and capabilities, you can expect more to come in the area of behavioral blocking and containment. Visit the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap) to see what's rolling out now and what's in development.
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Configure your attack surface reduction rules](attack-surface-reduction.md)
|
||||
|
||||
- [Enable EDR in block mode](edr-in-block-mode.md)
|
||||
@ -70,8 +70,9 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
|
||||
## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
|
||||
|
||||
>[!NOTE]
|
||||
>Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> [!NOTE]
|
||||
> - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> - You will need to have the "Manage security settings" permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
|
||||
1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an investigation request.
|
||||
|
||||
@ -130,4 +131,3 @@ It is crucial to respond in a timely manner to keep the investigation moving.
|
||||
|
||||
## Related topic
|
||||
- [Microsoft Threat Experts overview](microsoft-threat-experts.md)
|
||||
|
||||
|
||||
@ -46,15 +46,18 @@ Microsoft does not use your data for advertising.
|
||||
## Data protection and encryption
|
||||
The Microsoft Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure.
|
||||
|
||||
|
||||
There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Microsoft Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview).
|
||||
|
||||
In all scenarios, data is encrypted using 256-bit [AES encryption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum.
|
||||
|
||||
|
||||
## Do I have the flexibility to select where to store my data?
|
||||
## Data storage location
|
||||
|
||||
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States, or dedicated Azure Government data centers (soon to be in preview). Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States.
|
||||
Microsoft Defender ATP operates in the Microsoft Azure datacenters in the European Union, the United Kingdom, or in the United States. Customer data collected by the service may be stored in: (a) the geo-location of the tenant as identified during provisioning or, (b) if Microsoft Defender ATP uses another Microsoft online service to process such data, the geolocation as defined by the data storage rules of that other online service.
|
||||
|
||||
Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States.
|
||||
|
||||
Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside.
|
||||
|
||||
## Is my data isolated from other customer data?
|
||||
Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
|
||||
@ -84,12 +87,10 @@ Your data will be kept and will be available to you while the license is under g
|
||||
|
||||
|
||||
## Can Microsoft help us maintain regulatory compliance?
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP is ISO 27001 certified and has a roadmap for obtaining national, regional and industry-specific certifications.
|
||||
|
||||
Microsoft Defender ATP for Government (soon to be in preview) is currently undergoing audit for achieving FedRAMP High accreditation as well as Provisional Authorization (PA) at Impact Levels 4 and 5.
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP has achieved a number of certifications including ISO, SOC, FedRAMP High, and PCI and continues to pursue additional national, regional and industry-specific certifications.
|
||||
|
||||
By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run.
|
||||
|
||||
For more information on the Microsoft Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/trustcenter/compliance/iso-iec-27001).
|
||||
For more information on the Microsoft Defender ATP certification reports, see [Microsoft Trust Center](https://servicetrust.microsoft.com/).
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-datastorage-belowfoldlink)
|
||||
|
||||
@ -0,0 +1,95 @@
|
||||
---
|
||||
title: Endpoint detection and response in block mode
|
||||
description: Learn about endpoint detection and response in block mode
|
||||
keywords: Microsoft Defender ATP, EDR in block mode, passive mode blocking
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
manager: dansimp
|
||||
ms.reviewer: shwetaj
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.localizationpriority: medium
|
||||
ms.custom:
|
||||
- next-gen
|
||||
- edr
|
||||
ms.collection:
|
||||
---
|
||||
|
||||
# Endpoint detection and response (EDR) in block mode
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
## What is EDR in block mode?
|
||||
|
||||
When [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) in block mode is enabled, Microsoft Defender ATP leverages behavioral blocking and containment capabilities by blocking malicious artifacts or behaviors that are observed through post-breach protection. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.
|
||||
|
||||
> [!NOTE]
|
||||
> EDR in block mode is currently in **[limited private preview](#can-i-participate-in-the-preview-of-edr-in-block-mode)**. To get the best protection, make sure to **[deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
||||
|
||||
## What happens when something is detected?
|
||||
|
||||
When EDR in block mode is turned on, and a malicious artifact is detected, blocking and remediation actions are taken. You'll see detection status as **Blocked** or **Remediated** as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#check-activity-details-in-action-center).
|
||||
|
||||
The following image shows an instance of unwanted software that was detected and blocked through EDR in block mode:
|
||||
|
||||
:::image type="content" source="images/edr-in-block-mode.jpg" alt-text="EDR in block mode detected something":::
|
||||
|
||||
|
||||
## Enable EDR in block mode
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Make sure the [requirements](#requirements-for-edr-in-block-mode) are met before turning on EDR in block mode.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
|
||||
2. Choose **Settings** > **Advanced features**.
|
||||
|
||||
3. Turn on **EDR in block mode**.
|
||||
|
||||
> [!NOTE]
|
||||
> EDR in block mode can be turned on only in the Microsoft Defender Security Center. You cannot use registry keys, Intune, or group policies to enable or disable EDR in block mode.
|
||||
|
||||
## Requirements for EDR in block mode
|
||||
|
||||
|Requirement |Details |
|
||||
|---------|---------|
|
||||
|Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). |
|
||||
|Operating system |One of the following versions: <br/>- Windows 10 (all releases) <br/>- Windows Server 2016 or later |
|
||||
|Windows E5 enrollment |Windows E5 is included in the following subscriptions: <br/>- Microsoft 365 E5 <br/>- Microsoft 365 E3 together with the Identity & Threat Protection offering <br/><br/>See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). |
|
||||
|Cloud-delivered protection |Make sure Windows Defender Antivirus is configured such that cloud-delivered protection is enabled. <br/><br/>See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus). |
|
||||
|Windows Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. <br/>In the **AMProductVersion** line, you should see **4.18.2001.10** or above. |
|
||||
|Windows Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. <br/> In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features.
|
||||
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
### Will EDR in block mode have any impact on a user's antivirus protection?
|
||||
|
||||
No. EDR in block mode does not affect third-party antivirus protection running on users' machines. EDR in block mode kicks in if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Windows Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), with the additional steps of blocking and remediating malicious artifacts or behaviors that are detected.
|
||||
|
||||
### Why do I need to keep Windows Defender Antivirus up to date?
|
||||
|
||||
Because Windows Defender Antivirus detects and remediates malicious items, it's important to keep it up to date to leverage the latest machine learning models, behavioral detections, and heuristics for EDR in block mode to be most effective. The [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities works in an integrated manner, and to get best protection value, you should keep Windows Defender Antivirus up to date.
|
||||
|
||||
### Why do we need cloud protection on?
|
||||
|
||||
Cloud protection is needed to turn on the feature on the device. Cloud protection allows [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) to deliver the latest and greatest protection based on our breadth and depth of security intelligence, along with behavioral and machine learning models.
|
||||
|
||||
### Can I participate in the preview of EDR in block mode?
|
||||
|
||||
EDR in block mode is currently in limited private preview. If you would like to participate in this private preview program, send email to `shwjha@microsoft.com`.
|
||||
|
||||
## Related articles
|
||||
|
||||
[Behavioral blocking and containment](behavioral-blocking-containment.md)
|
||||
|
||||
[Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Enable ASR rules individually to protect your organization
|
||||
title: Enable attack surface reduction rules individually to protect your organization
|
||||
description: Enable attack surface reduction (ASR) rules to protect your devices from attacks that use macros, scripts, and common injection techniques.
|
||||
keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, enable, turn on
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 05/13/2019
|
||||
ms.date: 05/05/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -43,16 +43,10 @@ Enterprise-level management such as Intune or Microsoft Endpoint Configuration M
|
||||
|
||||
You can exclude files and folders from being evaluated by most attack surface reduction rules. This means that even if an ASR rule determines the file or folder contains malicious behavior, it will not block the file from running. This could potentially allow unsafe files to run and infect your devices.
|
||||
|
||||
> [!WARNING]
|
||||
> [!IMPORTANT]
|
||||
> Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded.
|
||||
>
|
||||
> If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> File and folder exclusions do not apply to the following ASR rules:
|
||||
>
|
||||
> * Block process creations originating from PSExec and WMI commands
|
||||
> * Block JavaScript or VBScript from launching downloaded executable content
|
||||
|
||||
You can specify individual files or folders (using folder paths or fully qualified resource names), but you can't specify which rules the exclusions apply to. An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted.
|
||||
|
||||
|
||||
@ -17,14 +17,29 @@ audience: ITPro
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Enable network protection
|
||||
# Turning on network protection
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it.
|
||||
You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it.
|
||||
|
||||
## Check if network protection is enabled
|
||||
|
||||
You can see if network protection has been enabled on a local device by using Registry editor.
|
||||
|
||||
1. Select the **Start** button in the task bar and type **regedit** to open Registry editor
|
||||
1. Choose **HKEY_LOCAL_MACHINE** from the side menu
|
||||
1. Navigate through the nested menus to **SOFTWARE** > **Policies** > **Microsoft** **Windows Defender** > **Policy Manager**
|
||||
1. Select **EnableNetworkProtection** to see the current state of network protection on the device
|
||||
|
||||
* 0, or **Off**
|
||||
* 1, or **On**
|
||||
* 2, or **Audit** mode
|
||||
|
||||
## Enable network protection
|
||||
|
||||
You can enable network protection by using any of these methods:
|
||||
|
||||
@ -34,7 +49,7 @@ You can enable network protection by using any of these methods:
|
||||
* [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager)
|
||||
* [Group Policy](#group-policy)
|
||||
|
||||
## PowerShell
|
||||
### PowerShell
|
||||
|
||||
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
@ -51,10 +66,7 @@ Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
|
||||
Use `Disabled` instead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
|
||||
|
||||
|
||||
|
||||
## Intune
|
||||
### Intune
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
@ -65,7 +77,7 @@ Use `Disabled` instead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
## MDM
|
||||
### MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
|
||||
|
||||
@ -78,13 +90,13 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://d
|
||||
1. Review the settings and click **Next** to create the policy.
|
||||
1. After the policy is created, click **Close**.
|
||||
|
||||
## Group Policy
|
||||
### Group Policy
|
||||
|
||||
You can use the following procedure to enable network protection on domain-joined computers or on a standalone computer.
|
||||
|
||||
1. On a standalone computer, click **Start**, type and then click **Edit group policy**.
|
||||
|
||||
-Or-
|
||||
*-Or-*
|
||||
|
||||
On a domain-joined Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
@ -109,7 +121,6 @@ You can confirm network protection is enabled on a local computer by using Regis
|
||||
* 1=On
|
||||
* 2=Audit
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
* [Network protection](network-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: OData queries with Microsoft Defender ATP
|
||||
ms.reviewer:
|
||||
description: OData queries with Microsoft Defender ATP
|
||||
description: Use these examples of Open Data Protocol (OData) queries to help with data access protocols in Microsoft Defender ATP
|
||||
keywords: apis, supported apis, odata, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -35,7 +35,7 @@ Not all properties are filterable.
|
||||
|
||||
### Example 1
|
||||
|
||||
- Get all the machines with the tag 'ExampleTag'
|
||||
Get all the machines with the tag 'ExampleTag'
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=machineTags/any(tag: tag eq 'ExampleTag')
|
||||
@ -76,7 +76,7 @@ Content-type: application/json
|
||||
|
||||
### Example 2
|
||||
|
||||
- Get all the alerts that created after 2018-10-20 00:00:00
|
||||
Get all the alerts that created after 2018-10-20 00:00:00
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/alerts?$filter=alertCreationTime+gt+2018-11-22T00:00:00Z
|
||||
@ -126,7 +126,7 @@ Content-type: application/json
|
||||
|
||||
### Example 3
|
||||
|
||||
- Get all the machines with 'High' 'RiskScore'
|
||||
Get all the machines with 'High' 'RiskScore'
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=riskScore+eq+'High'
|
||||
@ -167,7 +167,7 @@ Content-type: application/json
|
||||
|
||||
### Example 4
|
||||
|
||||
- Get top 100 machines with 'HealthStatus' not equals to 'Active'
|
||||
Get top 100 machines with 'HealthStatus' not equals to 'Active'
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=healthStatus+ne+'Active'&$top=100
|
||||
@ -208,7 +208,7 @@ Content-type: application/json
|
||||
|
||||
### Example 5
|
||||
|
||||
- Get all the machines that last seen after 2018-10-20
|
||||
Get all the machines that last seen after 2018-10-20
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=lastSeen gt 2018-08-01Z
|
||||
@ -249,7 +249,7 @@ Content-type: application/json
|
||||
|
||||
### Example 6
|
||||
|
||||
- Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Microsoft Defender ATP
|
||||
Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Microsoft Defender ATP
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machineactions?$filter=requestor eq 'Analyst@contoso.com' and type eq 'RunAntiVirusScan'
|
||||
@ -283,7 +283,7 @@ Content-type: application/json
|
||||
|
||||
### Example 7
|
||||
|
||||
- Get the count of open alerts for a specific machine:
|
||||
Get the count of open alerts for a specific machine:
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines/123321d0c675eaa415b8e5f383c6388bff446c62/alerts/$count?$filter=status ne 'Resolved'
|
||||
|
||||
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 44 KiB |
|
Before Width: | Height: | Size: 19 KiB After Width: | Height: | Size: 19 KiB |
@ -213,6 +213,8 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
```bash
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
Archive: WindowsDefenderATPOnboardingPackage.zip
|
||||
inflating: MicrosoftDefenderATPOnboardingLinuxServer.py
|
||||
```
|
||||
|
||||
`Archive: WindowsDefenderATPOnboardingPackage.zip`
|
||||
@ -220,7 +222,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
## Client configuration
|
||||
|
||||
1. Copy WindowsDefenderATPOnboarding.py to the target machine.
|
||||
1. Copy MicrosoftDefenderATPOnboardingLinuxServer.py to the target machine.
|
||||
|
||||
Initially the client machine is not associated with an organization. Note that the *orgId* attribute is blank:
|
||||
|
||||
@ -228,10 +230,10 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
mdatp --health orgId
|
||||
```
|
||||
|
||||
2. Run WindowsDefenderATPOnboarding.py, and note that, in order to run this command, you must have `python` installed on the device:
|
||||
2. Run MicrosoftDefenderATPOnboardingLinuxServer.py, and note that, in order to run this command, you must have `python` installed on the device:
|
||||
|
||||
```bash
|
||||
python WindowsDefenderATPOnboarding.py
|
||||
python MicrosoftDefenderATPOnboardingLinuxServer.py
|
||||
```
|
||||
|
||||
3. Verify that the machine is now associated with your organization and reports a valid organization identifier:
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Live response command examples
|
||||
description: Learn about common commands and see examples on how it's used
|
||||
description: Learn to run basic or advanced live response commands for Microsoft Defender Advanced Threat Protection (ATP) and see examples on how it's used
|
||||
keywords: example, command, cli, remote, shell, connection, live, response, real-time, command, script, remediate, hunt, export, log, drop, download, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
|
||||
@ -53,7 +53,7 @@ Download the installation and onboarding packages from Microsoft Defender Securi
|
||||
-rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg
|
||||
$ unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
Archive: WindowsDefenderATPOnboardingPackage.zip
|
||||
inflating: WindowsDefenderATPOnboarding.py
|
||||
inflating: MicrosoftDefenderATPOnboardingMacOs.py
|
||||
```
|
||||
|
||||
## Application installation
|
||||
@ -87,7 +87,7 @@ The installation proceeds.
|
||||
|
||||
## Client configuration
|
||||
|
||||
1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac.
|
||||
1. Copy wdav.pkg and MicrosoftDefenderATPOnboardingMacOs.py to the machine where you deploy Microsoft Defender ATP for Mac.
|
||||
|
||||
The client machine is not associated with orgId. Note that the *orgId* attribute is blank.
|
||||
|
||||
@ -98,7 +98,7 @@ The installation proceeds.
|
||||
2. Run the Python script to install the configuration file:
|
||||
|
||||
```bash
|
||||
$ /usr/bin/python WindowsDefenderATPOnboarding.py
|
||||
$ /usr/bin/python MicrosoftDefenderATPOnboardingMacOs.py
|
||||
Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password)
|
||||
```
|
||||
|
||||
|
||||
@ -41,6 +41,6 @@ You deployed and/or installed the MDATP for macOS package ("Download installatio
|
||||
|
||||
**Solution:**
|
||||
|
||||
Follow the WindowsDefenderATPOnboarding.py instructions documented here:
|
||||
Follow the MicrosoftDefenderATPOnboardingMacOs.py instructions documented here:
|
||||
[Client configuration](mac-install-manually.md#client-configuration)
|
||||
|
||||
|
||||
@ -79,7 +79,8 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
|
||||
3. Select the **Trigerring IOC**.
|
||||
|
||||
4. Specify the action and scope on the alert. <br>
|
||||
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard. You can also specify to suppress the alert on a specific machine group.
|
||||
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue, alert page, and machine timeline and will appear as resolved across Microsoft Defender ATP APIs. <br><br> Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard and will not be streamed across Microsoft Defender ATP APIs.
|
||||
|
||||
|
||||
5. Enter a rule name and a comment.
|
||||
|
||||
|
||||
@ -82,7 +82,7 @@ It's important to understand the following prerequisites prior to creating indic
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked.
|
||||
>There may be up to 2 hours of latency (usually less) between the time the action is taken and the actual file being blocked.
|
||||
|
||||
### Create an indicator for files from the settings page
|
||||
|
||||
@ -131,7 +131,7 @@ It's important to understand the following prerequisites prior to creating indic
|
||||
>- Full URL path blocks can be applied on the domain level and all unencrypted URLs
|
||||
|
||||
>[!NOTE]
|
||||
>There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked.
|
||||
>There may be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked.
|
||||
|
||||
### Create an indicator for IPs, URLs, or domains from the settings page
|
||||
|
||||
|
||||
@ -97,7 +97,7 @@ The package contains the following folders:
|
||||
|:---|:---------|
|
||||
|Autoruns | Contains a set of files that each represent the content of the registry of a known auto start entry point (ASEP) to help identify attacker’s persistency on the machine. </br></br> NOTE: If the registry key is not found, the file will contain the following message: “ERROR: The system was unable to find the specified registry key or value.” |
|
||||
|Installed programs | This .CSV file contains the list of installed programs that can help identify what is currently installed on the machine. For more information, see [Win32_Product class](https://go.microsoft.com/fwlink/?linkid=841509). |
|
||||
|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.</br></br> - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process. </br></br> - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces. </br></br> ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.</br></br> - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections. </br></br> - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. </br></br> - FirewassExecutionLog.txt and pfirewall.log |
|
||||
|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.</br></br> - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process. </br></br> - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces. </br></br> ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.</br></br> - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections. </br></br> - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. </br></br> - FirewallExecutionLog.txt and pfirewall.log |
|
||||
| Prefetch files| Windows Prefetch files are designed to speed up the application startup process. It can be used to track all the files recently used in the system and find traces for applications that might have been deleted but can still be found in the prefetch file list. </br></br> - Prefetch folder – Contains a copy of the prefetch files from `%SystemRoot%\Prefetch`. NOTE: It is suggested to download a prefetch file viewer to view the prefetch files. </br></br> - PrefetchFilesList.txt – Contains the list of all the copied files which can be used to track if there were any copy failures to the prefetch folder. |
|
||||
| Processes| Contains a .CSV file listing the running processes which provides the ability to identify current processes running on the machine. This can be useful when identifying a suspicious process and its state. |
|
||||
| Scheduled tasks| Contains a .CSV file listing the scheduled tasks which can be used to identify routines performed automatically on a chosen machine to look for suspicious code which was set to run automatically. |
|
||||
|
||||
@ -92,7 +92,7 @@ This section describes how an attacker might exploit a feature or its configurat
|
||||
|
||||
### Vulnerability
|
||||
|
||||
Accounts that have the **Deny log on as a batch job** user right could be used to schedule jobs that could consume excessive computer resources and cause a denial-of-service condition.
|
||||
Accounts that have the **Log on as a batch job** user right could be used to schedule jobs that could consume excessive computer resources and cause a denial-of-service condition.
|
||||
|
||||
### Countermeasure
|
||||
|
||||
|
||||
@ -47,7 +47,7 @@ To configure the Group Policy settings described in the following table:
|
||||
|
||||
Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class
|
||||
---|---|---|---
|
||||
See [Email scanning limitations](#ref1)) below | Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning`
|
||||
Email scanning See [Email scanning limitations](#ref1)| Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning`
|
||||
Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | Not available
|
||||
Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan`
|
||||
Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md) will take precedence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning`
|
||||
@ -72,29 +72,19 @@ For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.
|
||||
|
||||
## Email scanning limitations
|
||||
|
||||
We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
|
||||
|
||||
Always-on protection scans emails as they arrive and as they are manipulated, just like normal files in the operating system. This provides the strongest form of protection and is the recommended setting for scanning emails.
|
||||
|
||||
You can also use this Group Policy to enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated:
|
||||
Email scanning enables scanning of email files used by Outlook and other mail clients during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated:
|
||||
|
||||
- DBX
|
||||
- MBX
|
||||
- MIME
|
||||
|
||||
PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) can also be scanned, but Windows Defender cannot remediate threats detected inside PST files. This is another reason why we recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
|
||||
PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) will also be scanned, but Windows Defender cannot remediate threats detected inside PST files.
|
||||
|
||||
If Windows Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat:
|
||||
If Windows Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat manually:
|
||||
|
||||
- Email subject
|
||||
- Attachment name
|
||||
|
||||
>[!WARNING]
|
||||
>There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles:
|
||||
>
|
||||
> - [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1)
|
||||
> - [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2)
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
|
||||
|
||||
@ -60,11 +60,11 @@ All our updates contain:
|
||||
<br/>
|
||||
|
||||
<details>
|
||||
<summary> April-2020 (Platform: 4.18.2004.5 | Engine: 1.1.17000.2)</summary>
|
||||
<summary> April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2)</summary>
|
||||
|
||||
 Security intelligence update version: **TBD**
|
||||
 Released: **April 30, 2020**
|
||||
 Platform: **4.18.2004.5**
|
||||
 Platform: **4.18.2004.6**
|
||||
 Engine: **1.1.17000.2**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
|
||||
@ -1,94 +0,0 @@
|
||||
---
|
||||
title: Shadow protection
|
||||
description: Learn about shadow protection
|
||||
keywords: Windows Defender Antivirus, shadow protection, passive mode
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
manager: dansimp
|
||||
ms.reviewer: shwetaj
|
||||
audience: ITPro
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.localizationpriority: medium
|
||||
ms.custom: next-gen
|
||||
ms.collection:
|
||||
---
|
||||
|
||||
# Shadow protection
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
## What is shadow protection?
|
||||
|
||||
When enabled, shadow protection extends behavioral-based blocking and containment capabilities by blocking malicious artifacts or behaviors observed through post-breach protection. This is the case even if [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) is not your active antivirus protection. Shadow protection is useful if your organization has not fully transitioned to Windows Defender Antivirus and you are presently using a third-party antivirus solution. Shadow protection works behind the scenes by remediating malicious entities identified in post-breach protection that the existing third-party antivirus solution missed.
|
||||
|
||||
> [!NOTE]
|
||||
> Shadow protection is currently in [limited private preview](#can-i-participate-in-the-private-preview-of-shadow-protection).
|
||||
|
||||
To get the best protection, [deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline). And see [Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus).
|
||||
|
||||
## What happens when something is detected?
|
||||
|
||||
When shadow protection is turned on, and a malicious artifact is detected, the detection results in blocking and remediation actions. You'll see detection status as **Blocked** or **Remediated** as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation#review-completed-actions).
|
||||
|
||||
The following images shows an instance of unwanted software that was detected and blocked through shadow protection:
|
||||
|
||||
:::image type="content" source="images/shadow-protection-detection.jpg" alt-text="Malware detected by shadow protection":::
|
||||
|
||||
## Turn on shadow protection
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Make sure the [requirements](#requirements-for-shadow-protection) are met before turning shadow protection on.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
|
||||
2. Choose **Settings** > **Advanced features**.
|
||||
|
||||
:::image type="content" source="images/turn-shadow-protection-on.jpg" alt-text="Turn shadow protection on":::
|
||||
|
||||
3. Turn shadow protection on.
|
||||
|
||||
> [!NOTE]
|
||||
> Shadow protection can be turned on only in the Microsoft Defender Security Center. You cannot use registry keys, Intune, or group policies to turn shadow protection on or off.
|
||||
|
||||
## Requirements for shadow protection
|
||||
|
||||
|Requirement |Details |
|
||||
|---------|---------|
|
||||
|Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). |
|
||||
|Operating system |One of the following: <br/>- Windows 10 (all releases) <br/>- Windows Server 2016 or later |
|
||||
|Windows E5 enrollment |This is included in the following subscriptions: <br/>- Microsoft 365 E5 <br/>- Microsoft 365 E3 together with the Identity & Threat Protection offering <br/>See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide#components) and [Features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). |
|
||||
|Cloud-delivered protection |Make sure Windows Defender Antivirus is configured such that cloud-delivered protection is enabled. <br/>See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus). |
|
||||
|Windows Defender Antivirus antimalware client |To make sure your client is up to date, using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. In the **AMProductVersion** line, you should see **4.18.2001.10** or above. |
|
||||
|Windows Defender Antivirus engine |To make sure your engine is up to date, using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> To get the best protection value, make sure Windows Defender Antivirus is configured to receive regular updates and other essential features, such as behavioral monitoring, IOfficeAV, tamper protection, and more. See [Protect security settings with tamper protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection).
|
||||
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
### Will shadow protection have any impact on a user's antivirus protection?
|
||||
|
||||
No. Shadow protection does not affect third-party antivirus protection running on users' machines. Shadow protection kicks in if the primary antivirus solution misses something, or if there is post-breach detection. Shadow protection works just like Windows Defender Antivirus in passive mode with the additional steps of blocking and remediating malicious items detected.
|
||||
|
||||
### Why do I need to keep Windows Defender Antivirus up to date?
|
||||
|
||||
Because Windows Defender Antivirus detects and remediates malicious items, it’s important to keep it up to date to leverage the latest machine learning models, behavioral detections, and heuristics for best results. The [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities work in an integrated manner, and to get best protection value, you should keep Windows Defender Antivirus up to date.
|
||||
|
||||
### Why do we need cloud protection on?
|
||||
|
||||
Cloud protection is needed to turn on the feature on the device. Cloud protection allows [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) to deliver the latest and greatest protection based on the optics received, along with behavioral and machine learning models.
|
||||
|
||||
### Can I participate in the private preview of shadow protection?
|
||||
|
||||
If you would like to participate in our private preview program, please send email to `shwjha@microsoft.com`.
|
||||
|
||||
## See also
|
||||
|
||||
- [Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus)
|
||||
|
||||
@ -14,7 +14,6 @@ ms.topic: article
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 01/07/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -29,7 +28,7 @@ Windows Defender Antivirus is the next-generation protection component of [Micro
|
||||
|
||||
Although you can use a non-Microsoft antivirus solution with Microsoft Defender ATP, there are advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. Not only is Windows Defender Antivirus an excellent next-generation antivirus solution, but combined with other Microsoft Defender ATP capabilities, such as [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) and [automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations), you get better protection that's coordinated across products and services.
|
||||
|
||||
## 10 reasons to use Windows Defender Antivirus together with Microsoft Defender ATP
|
||||
## 11 reasons to use Windows Defender Antivirus together with Microsoft Defender ATP
|
||||
|
||||
| |Advantage |Why it matters |
|
||||
|--|--|--|
|
||||
@ -39,10 +38,11 @@ Although you can use a non-Microsoft antivirus solution with Microsoft Defender
|
||||
|4|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. [Understand malware & other threats](../intelligence/understanding-malware.md).|
|
||||
|5|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).|
|
||||
|6|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).|
|
||||
|7|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) |
|
||||
|8|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). |
|
||||
|9|File recovery via OneDrive |If you are using Windows Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).|
|
||||
|10|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Windows Defender Antivirus](troubleshoot-windows-defender-antivirus.md). |
|
||||
|7|Attack Surface Reduction |Your organization's security team can reduce your vulnerabilities (attack surfaces), giving attackers fewer ways to perform attacks. Attack surface reduction uses cloud protection for a number of rules. [Reduce attack surfaces with attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction).|
|
||||
|8|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) |
|
||||
|9|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). |
|
||||
|10|File recovery via OneDrive |If you are using Windows Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).|
|
||||
|11|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Windows Defender Antivirus](troubleshoot-windows-defender-antivirus.md). |
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
@ -25,9 +25,9 @@ manager: dansimp
|
||||
## Overview
|
||||
|
||||
Windows Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. But what happens when another antivirus/antimalware solution is used? It depends on whether you're using [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) together with your antivirus protection.
|
||||
- When endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender ATP is not used, Windows Defender Antivirus automatically goes into disabled mode.
|
||||
- If your organization is using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) together with a non-Microsoft antivirus/antimalware solution, then Windows Defender Antivirus automatically goes into passive mode. (Real time protection and threats are not remediated by Windows Defender Antivirus.)
|
||||
- If your organization is using Microsoft Defender ATP together with a non-Microsoft antivirus/antimalware solution, and you have [shadow protection (currently in private preview)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/shadow-protection), then Windows Defender Antivirus runs in the background and blocks/remediates malicious items that are detected, such as during a post-breach attack.
|
||||
- If your organization's endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender ATP is not used, then Windows Defender Antivirus automatically goes into disabled mode.
|
||||
- If your organization is using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) together with a non-Microsoft antivirus/antimalware solution, then Windows Defender Antivirus automatically goes into passive mode. (Real-time protection and threats are not remediated by Windows Defender Antivirus.)
|
||||
- If your organization is using Microsoft Defender ATP together with a non-Microsoft antivirus/antimalware solution, and you have [EDR in block mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/shadow-protection) (currently in private preview) enabled, then Windows Defender Antivirus runs in the background and blocks/remediates malicious items that are detected, such as during a post-breach attack.
|
||||
|
||||
## Antivirus and Microsoft Defender ATP
|
||||
|
||||
@ -69,12 +69,12 @@ The following table summarizes the functionality and features that are available
|
||||
|--|--|--|--|--|--|
|
||||
|Active mode <br/><br/> |Yes |No |Yes |Yes |Yes |
|
||||
|Passive mode |No |No |Yes |No |Yes |
|
||||
|[Shadow protection enabled](shadow-protection.md) |No |No |Yes |Yes |Yes |
|
||||
|[EDR in block mode enabled](shadow-protection.md) |No |No |Yes |Yes |Yes |
|
||||
|Automatic disabled mode |No |Yes |No |No |No |
|
||||
|
||||
- In Active mode, Windows Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Windows Defender Antivirus app on the machine itself).
|
||||
- In Passive mode, Windows Defender Antivirus is not used as the antivirus app, and threats are not remediated by Windows Defender Antivirus. Files are scanned and reports are provided for threat detections which are shared with the Microsoft Defender ATP service.
|
||||
- When [shadow protection (currently in private preview)](shadow-protection.md) is turned on, Windows Defender Antivirus is not used as the primary antivirus solution, but can still detect and remediate malicious items.
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) (currently in private preview) is turned on, Windows Defender Antivirus is not used as the primary antivirus solution, but can still detect and remediate malicious items.
|
||||
- In Automatic disabled mode, Windows Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated.
|
||||
|
||||
## Keep the following points in mind
|
||||
@ -95,4 +95,4 @@ If you uninstall the other product, and choose to use Windows Defender Antivirus
|
||||
|
||||
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
|
||||
- [Windows Defender Antivirus on Windows Server 2016 and 2019](windows-defender-antivirus-on-windows-server-2016.md)
|
||||
- [Shadow protection in next-generation protection](shadow-protection.md)
|
||||
- [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Planning Isolation Groups for the Zones (Windows 10)
|
||||
description: Planning Isolation Groups for the Zones
|
||||
description: Learn about planning isolation groups for the zones in Microsoft Firewall, including information on universal groups and GPOs
|
||||
ms.assetid: be4b662d-c1ce-441e-b462-b140469a5695
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
@ -25,7 +25,8 @@ ms.date: 04/19/2017
|
||||
|
||||
Isolation groups in Active Directory are how you implement the various domain and server isolation zones. A device is assigned to a zone by adding its device account to the group which represents that zone.
|
||||
|
||||
>**Caution:** Do not add devices to your groups yet. If a device is in a group when the GPO is activated then that GPO is applied to the device. If the GPO is one that requires authentication, and the other devices have not yet received their GPOs, the device that uses the new GPO might not be able to communicate with the others.
|
||||
> [!CAUTION]
|
||||
> Do not add devices to your groups yet. If a device is in a group when the GPO is activated then that GPO is applied to the device. If the GPO is one that requires authentication, and the other devices have not yet received their GPOs, the device that uses the new GPO might not be able to communicate with the others.
|
||||
|
||||
Universal groups are the best option to use for GPO assignment because they apply to the whole forest and reduce the number of groups that must be managed. However, if universal groups are unavailable, you can use domain global groups instead.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user