mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-22 18:27:23 +00:00
Merge branch 'master' into tvm-exceptions-for-rbac
This commit is contained in:
Beth Levin
commit
92f675ba6f
@ -857,12 +857,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-exploit-guard",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
@ -1210,11 +1210,6 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access",
|
||||
@ -1435,16 +1430,6 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection",
|
||||
@ -1795,6 +1780,21 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score",
|
||||
@ -1805,11 +1805,26 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/configuration-score.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/partner-applications.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/partner-applications",
|
||||
@ -1834,6 +1849,11 @@
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md",
|
||||
@ -1980,16 +2000,6 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection",
|
||||
|
||||
@ -1,229 +1,80 @@
|
||||
### YamlMime:YamlDocument
|
||||
### YamlMime:Landing
|
||||
|
||||
documentType: LandingData
|
||||
|
||||
title: Microsoft Edge Legacy group policies
|
||||
title: Microsoft Edge Legacy group policies # < 60 chars
|
||||
summary: Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. # < 160 chars
|
||||
|
||||
metadata:
|
||||
|
||||
title: Microsoft Edge Legacy group policies
|
||||
|
||||
description: Learn how to configure group policies in Microsoft Edge Legacy on Windows 10.
|
||||
|
||||
text: Some of the features in Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. (To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).)
|
||||
|
||||
title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars.
|
||||
description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars.
|
||||
keywords: Microsoft Edge Legacy, Windows 10, Windows 10 Mobile
|
||||
|
||||
ms.localizationpriority: medium
|
||||
|
||||
ms.prod: edge
|
||||
author: shortpatti
|
||||
|
||||
ms.author: pashort
|
||||
|
||||
ms.date: 10/02/2018
|
||||
|
||||
ms.topic: article
|
||||
|
||||
ms.topic: landing-page
|
||||
ms.devlang: na
|
||||
|
||||
sections:
|
||||
|
||||
- title:
|
||||
|
||||
- items:
|
||||
|
||||
- type: markdown
|
||||
|
||||
text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences.
|
||||
|
||||
- items:
|
||||
|
||||
- type: list
|
||||
|
||||
style: cards
|
||||
|
||||
className: cardsE
|
||||
|
||||
columns: 3
|
||||
|
||||
items:
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/address-bar-settings-gp
|
||||
|
||||
html: <p>Learn how you can configure Microsoft Edge to show search suggestions in the address bar.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_http.svg
|
||||
|
||||
title: Address bar
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/adobe-settings-gp
|
||||
|
||||
html: <p>Learn how you can configure Microsoft Edge to load Adobe Flash content automatically.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_setup.svg
|
||||
|
||||
title: Adobe Flash
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/books-library-management-gp
|
||||
|
||||
html: <p>Learn how you can set up and use the books library, such as using a shared books folder for students and teachers.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_library.svg
|
||||
|
||||
title: Books Library
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/browser-settings-management-gp
|
||||
|
||||
html: <p>Learn how you can customize the browser settings, such as printing and saving browsing history, plus more.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_management.svg
|
||||
|
||||
title: Browser experience
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/developer-settings-gp
|
||||
|
||||
html: <p>Learn how to configure Microsoft Edge for development and testing.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_config-tools.svg
|
||||
|
||||
title: Developer tools
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/extensions-management-gp
|
||||
|
||||
html: <p>Learn how you can configure Microsoft Edge to either prevent or allow users to install and run unverified extensions.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_extensions.svg
|
||||
|
||||
title: Extensions
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/favorites-management-gp
|
||||
|
||||
html: <p>Learn how you can provision a standard favorites list as well as keep the favorites lists in sync between IE11 and Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_link.svg
|
||||
|
||||
title: Favorites
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/home-button-gp
|
||||
|
||||
html: <p>Learn how you can customize the home button or hide it.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_setup.svg
|
||||
|
||||
title: Home button
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp
|
||||
|
||||
html: <p>Learn how you use Microsoft Edge and Internet Explorer together for a full browsing experience.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_management.svg
|
||||
|
||||
title: Interoperability and enterprise guidance
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy
|
||||
|
||||
html: <p>Learn how Microsoft Edge kiosk mode works with assigned access to let IT administrators create a tailored browsing experience designed for kiosk devices.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_categorize.svg
|
||||
|
||||
title: Kiosk mode deployment in Microsoft Edge
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/new-tab-page-settings-gp
|
||||
|
||||
html: <p>Learn how to configure the New Tab page in Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_setup.svg
|
||||
|
||||
title: New Tab page
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/prelaunch-preload-gp
|
||||
|
||||
html: <p>Learn how pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_setup.svg
|
||||
|
||||
title: Prelaunch Microsoft Edge and preload tabs
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/search-engine-customization-gp
|
||||
|
||||
html: <p>Learn how you can set the default search engine and configure additional ones.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_search.svg
|
||||
|
||||
title: Search engine customization
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp
|
||||
|
||||
html: <p>Learn how you can keep your environment and users safe from attacks.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_security-management.svg
|
||||
|
||||
title: Security and privacy
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/start-pages-gp
|
||||
|
||||
html: <p>Learn how to configure the Start pages in Microsoft Edge.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_setup.svg
|
||||
|
||||
title: Start page
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/sync-browser-settings-gp
|
||||
|
||||
html: <p>Learn how to you can prevent the "browser" group from syncing and prevent users from turning on the Sync your Settings toggle.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_sync.svg
|
||||
|
||||
title: Sync browser
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/telemetry-management-gp
|
||||
|
||||
html: <p>Learn how you can configure Microsoft Edge to collect certain data.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_data-collection.svg
|
||||
|
||||
title: Telemetry and data collection
|
||||
|
||||
- href: https://docs.microsoft.com/microsoft-edge/deploy/available-policies
|
||||
|
||||
html: <p>View all available group policies for Microsoft Edge on Windows 10.</p>
|
||||
|
||||
image:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_policy.svg
|
||||
|
||||
title: All group policies
|
||||
ms.date: 08/28/2020 #Required; mm/dd/yyyy format.
|
||||
|
||||
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
|
||||
|
||||
landingContent:
|
||||
# Cards and links should be based on top customer tasks or top subjects
|
||||
# Start card title with a verb
|
||||
# Card (optional)
|
||||
- title: What's new
|
||||
linkLists:
|
||||
- linkListType: whats-new
|
||||
links:
|
||||
- text: Documentation for Microsoft Edge version 77 or later
|
||||
url: https://docs.microsoft.com/DeployEdge/
|
||||
- text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021
|
||||
url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666
|
||||
|
||||
# Card (optional)
|
||||
- title: Group policies configure guidance part 1
|
||||
linkLists:
|
||||
- linkListType: reference
|
||||
links:
|
||||
- text: All group policies
|
||||
url: /microsoft-edge/deploy/available-policies
|
||||
- text: Address bar
|
||||
url: /microsoft-edge/deploy/group-policies/address-bar-settings-gp
|
||||
- text: Adobe Flash
|
||||
url: /microsoft-edge/deploy/group-policies/adobe-settings-gp
|
||||
- text: Books Library
|
||||
url: /microsoft-edge/deploy/group-policies/books-library-management-gp
|
||||
- text: Browser experience
|
||||
url: /microsoft-edge/deploy/group-policies/browser-settings-management-gp
|
||||
- text: Developer tools
|
||||
url: /microsoft-edge/deploy/group-policies/developer-settings-gp
|
||||
- text: Extensions
|
||||
url: /microsoft-edge/deploy/group-policies/extensions-management-gp
|
||||
- text: Favorites
|
||||
url: /microsoft-edge/deploy/group-policies/favorites-management-gp
|
||||
- text: Home button
|
||||
url: /microsoft-edge/deploy/group-policies/home-button-gp
|
||||
|
||||
# Card (optional)
|
||||
- title: Group policies configure guidance part 2
|
||||
linkLists:
|
||||
- linkListType: reference
|
||||
links:
|
||||
- text: Interoperability and enterprise mode
|
||||
url: /microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp
|
||||
- text: New Tab page
|
||||
url: /microsoft-edge/deploy/group-policies/new-tab-page-settings-gp
|
||||
- text: Kiosk mode deployment in Microsoft Edge
|
||||
url: /microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy
|
||||
- text: Prelaunch Microsoft Edge and preload tabs
|
||||
url: /microsoft-edge/deploy/group-policies/prelaunch-preload-gp
|
||||
- text: Search engine customization
|
||||
url: /microsoft-edge/deploy/group-policies/search-engine-customization-gp
|
||||
- text: Security and privacy
|
||||
url: /microsoft-edge/deploy/group-policies/security-privacy-management-gp
|
||||
- text: Start page
|
||||
url: /microsoft-edge/deploy/group-policies/start-pages-gp
|
||||
- text: Sync browser
|
||||
url: /microsoft-edge/deploy/group-policies/sync-browser-settings-gp
|
||||
- text: Telemetry and data collection
|
||||
url: /microsoft-edge/deploy/group-policies/telemetry-management-gp
|
||||
|
||||
|
||||
@ -1,60 +1,144 @@
|
||||
### YamlMime:YamlDocument
|
||||
### YamlMime:Landing
|
||||
|
||||
title: Microsoft Edge Legacy # < 60 chars
|
||||
summary: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # < 160 chars
|
||||
|
||||
documentType: LandingData
|
||||
title: Microsoft Edge
|
||||
metadata:
|
||||
title: Microsoft Edge
|
||||
description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization.
|
||||
title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars.
|
||||
description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars.
|
||||
keywords: Microsoft Edge, issues, fixes, announcements, Windows Server, advisories
|
||||
ms.prod: edge
|
||||
ms.localizationpriority: medium
|
||||
author: lizap
|
||||
ms.author: elizapo
|
||||
manager: dougkim
|
||||
ms.topic: article
|
||||
ms.topic: landing-page
|
||||
ms.devlang: na
|
||||
ms.date: 08/19/2020 #Required; mm/dd/yyyy format.
|
||||
|
||||
sections:
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Find the tools and resources you need to help deploy and use Microsoft Edge in your organization.
|
||||
"
|
||||
- title: What's new
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Find out the latest and greatest news on Microsoft Edge.<br>
|
||||
<table><tr><td><img src='images/new1.png' width='192' height='192'><br>**The latest in Microsoft Edge**<br>See what's new for users and developers in the next update to Microsoft Edge - now available with the Windows 10 April 2018 update!<br><a href='https://blogs.windows.com/msedgedev/2018/04/30/edgehtml-17-april-2018-update/#C7jCBdbPSG6bCXHr.97'>Find out more</a></td><td><img src='images/new2.png' width='192' height='192'><br>**Evaluate the impact**<br>Review the latest Forrester Total Economic Impact (TEI) report to learn about the impact Microsoft Edge can have in your organization.<br><a href='microsoft-edge-forrester'>Download the reports</a></td></tr><tr><td><img src='images/new3.png' width='192' height='192'><br>**Microsoft Edge for iOS and Android**<br>Microsoft Edge brings familiar features across your PC and phone, which allows browsing to go with you, no matter what device you use.<br><a href='https://blogs.windows.com/windowsexperience/2017/11/30/microsoft-edge-now-available-for-ios-and-android'>Learn more</a></td><td><img src='images/new4.png' width='192' height='192'><br>**Application Guard**<br>Microsoft Edge with Windows Defender Application Guard is the most secure browser on Windows 10 Enterprise.<br><a href='https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview'>Learn more</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Compatibility
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Even if you still have legacy apps in your organization, you can default to the secure, modern experience of Microsoft Edge and provide a consistent level of compatibility with existing legacy applications.<br>
|
||||
<table><tr><td><img src='images/compat1.png' width='192' height='192'><br>**Test your site on Microsoft Edge**<br>Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more.<br><a href='https://developer.microsoft.com/microsoft-edge/tools/remote/'>Test your site on Microsoft Edge for free on BrowserStack</a><br><a href='https://sonarwhal.com/'>Use sonarwhal to improve your website.</a></td><td><img src='images/compat2.png' width='192' height='192'><br>**Improve compatibility with Enterprise Mode**<br>With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11.<br><a href='https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility'>Use Enterprise mode to improve compatibility</a><br><a href='https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list'>Turn on Enterprise Mode and use a site list</a><br><a href='https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal'>Enterprise Site List Portal</a><br><a href='https://blogs.technet.microsoft.com/home_is_where_i_lay_my_head/2017/04/25/the-ultimate-browser-strategy-on-windows-10/'>Ultimate browser strategy on Windows 10</a></td><td><img src='images/compat3.png' width='192' height='192'><br>**Web Application Compatibility Lab Kit**<br>The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge.<br><a href='web-app-compat-toolkit'>Find out more</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Security
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Microsoft Edge uses Windows Hello and Windows Defender SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.<br>
|
||||
<table><tr><td><img src='images/security1.png' width='192' height='192'><br>**NSS Labs web browser security reports**<br>See the results of two global tests measuring how effective browsers are at protecting against socially engineered malware and phishing attacks.<br><a href='https://www.microsoft.com/download/details.aspx?id=54773'>Download the reports</a></td><td><img src='images/security2.png' width='192' height='192'><br>**Microsoft Edge sandbox**<br>See how Microsoft Edge has significantly reduced the attack surface of the sandbox by configuring the app container to further reduce its privilege.<br><a href='https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/'>Find out more</a></td><td><img src='images/security3.png' width='192' height='192'><br>**Windows Defender SmartScreen**<br>Manage your organization's computer settings with Group Policy and MDM settings to display a warning page to employees or block a site entirely.<br><a href='https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview'>Read the docs</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Deployment and end user readiness
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
Find resources and learn about features to help you deploy Microsoft Edge in your organization to get your users up and running quickly.<br>
|
||||
<table><tr><td><img src='images/deploy-land.png' width='192' height='192'><br>**Deployment**<br>Find resources, learn about features, and get answers to commonly asked questions to help you deploy Microsoft Edge in your organization.<br><a href='https://docs.microsoft.com/microsoft-edge/deploy/'>Microsoft Edge deployment guide</a><br><a href='https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-faq'>Microsoft Edge FAQ</a><br><a href='https://docs.microsoft.com/microsoft-edge/deploy/hardware-and-software-requirements'>System requirements and language support</a><br><a href='https://docs.microsoft.com/microsoft-edge/deploy/available-policies'>Group Policy and MDM settings in Microsoft Edge</a><br><a href='https://www.microsoft.com/itpro/microsoft-edge/web-app-compat-toolkit'>Download the Web Application Compatibility Lab Kit</a><br><a href='edge-technical-demos.md'>Microsoft Edge training and demonstrations</a></td><td><img src='images/enduser-land.png' width='192' height='192'><br>**End user readiness**<br>Help your users get started on Microsoft Edge quickly and learn about features like tab management, instant access to Office files, and more.<br><a href='https://go.microsoft.com/fwlink/?linkid=825648'>Quick Start: Microsoft Edge (PDF, .98 MB)</a><br><a href='https://go.microsoft.com/fwlink/?linkid=825661'>Find it faster with Microsoft Edge (PDF, 605 KB)</a><br><a href='https://go.microsoft.com/fwlink/?linkid=825653'>Use Microsoft Edge to collaborate (PDF, 468 KB)</a><br><a href='https://microsoftedgetips.microsoft.com/en-us/2/39'>Import bookmarks</a><br><a href='https://microsoftedgetips.microsoft.com/en-us/2/18'>Password management</a><br><a href='https://myignite.microsoft.com/sessions/56630?source=sessions'>Microsoft Edge tips and tricks (video, 20:26)</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
- title: Stay informed
|
||||
- items:
|
||||
- type: markdown
|
||||
text: "
|
||||
<table><tr><td><img src='images/wipinsider.png' width='192' height='192'><br>**Sign up for the Windows IT Pro Insider**<br>Get the latest tools, tips, and expert guidance on deployment, management, security, and more.<br><a href='https://aka.ms/windows-it-pro-insider'>Learn more</a></td><td><img src='images/edgeblog.png' width='192' height='192'><br>**Microsoft Edge Dev blog**<br>Keep up with the latest browser trends, security tips, and news for IT professionals.<br><a href='https://blogs.windows.com/msedgedev'>Read the blog</a></td><td><img src='images/twitter.png' width='192' height='192'><br>**Microsoft Edge Dev on Twitter**<br>Get the latest news and updates from the Microsoft Web Platform team.<br><a href='https://twitter.com/MSEdgeDev'>Visit Twitter</a></td></tr>
|
||||
</table>
|
||||
"
|
||||
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
|
||||
|
||||
landingContent:
|
||||
# Cards and links should be based on top customer tasks or top subjects
|
||||
# Start card title with a verb
|
||||
# Card (optional)
|
||||
- title: What's new
|
||||
linkLists:
|
||||
- linkListType: whats-new
|
||||
links:
|
||||
- text: Documentation for Microsoft Edge version 77 or later
|
||||
url: https://docs.microsoft.com/DeployEdge/
|
||||
- text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021
|
||||
url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666
|
||||
- text: The latest in Microsoft Edge
|
||||
url: https://blogs.windows.com/msedgedev/2018/04/30/edgehtml-17-april-2018-update/#C7jCBdbPSG6bCXHr.97
|
||||
- text: Microsoft Edge for iOS and Android
|
||||
url: https://blogs.windows.com/windowsexperience/2017/11/30/microsoft-edge-now-available-for-ios-and-android
|
||||
- text: Application Guard
|
||||
url: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview
|
||||
- linkListType: download
|
||||
links:
|
||||
- text: Evaluate the impact
|
||||
url: /microsoft-edge/deploy/microsoft-edge-forrester
|
||||
|
||||
# Card (optional)
|
||||
- title: Test your site on Microsoft Edge
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Test your site on Microsoft Edge for free on BrowserStack
|
||||
url: https://developer.microsoft.com/microsoft-edge/tools/remote/
|
||||
- text: Use sonarwhal to improve your website
|
||||
url: https://sonarwhal.com/
|
||||
|
||||
# Card (optional)
|
||||
- title: Improve compatibility with Enterprise Mode
|
||||
linkLists:
|
||||
- linkListType: how-to-guide
|
||||
links:
|
||||
- text: Use Enterprise mode to improve compatibility
|
||||
url: /microsoft-edge/deploy/emie-to-improve-compatibility
|
||||
- text: Turn on Enterprise Mode and use a site list
|
||||
url: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list
|
||||
- text: Enterprise Site List Portal
|
||||
url: https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal
|
||||
|
||||
# Card (optional)
|
||||
- title: Web Application Compatibility Lab Kit
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Overview
|
||||
url: /microsoft-edge/deploy/emie-to-improve-compatibility
|
||||
|
||||
# Card (optional)
|
||||
- title: Security
|
||||
linkLists:
|
||||
- linkListType: download
|
||||
links:
|
||||
- text: NSS Labs web browser security reports
|
||||
url: https://www.microsoft.com/download/details.aspx?id=54773
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Microsoft Edge sandbox
|
||||
url: https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/
|
||||
- text: Windows Defender SmartScreen
|
||||
url: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview
|
||||
|
||||
# Card (optional)
|
||||
- title: Deployment
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Microsoft Edge deployment guide
|
||||
url: /microsoft-edge/deploy/
|
||||
- text: Microsoft Edge FAQ
|
||||
url: /microsoft-edge/deploy/microsoft-edge-faq
|
||||
- text: System requirements and language support
|
||||
url: /microsoft-edge/deploy/hardware-and-software-requirements
|
||||
- text: Group Policy and MDM settings in Microsoft Edge
|
||||
url: /microsoft-edge/deploy/available-policies
|
||||
- text: Microsoft Edge training and demonstrations
|
||||
url: /microsoft-edge/deploy/edge-technical-demos
|
||||
- linkListType: download
|
||||
links:
|
||||
- text: Web Application Compatibility Lab Kit
|
||||
url: https://www.microsoft.com/itpro/microsoft-edge/web-app-compat-toolkit
|
||||
|
||||
# Card (optional)
|
||||
- title: End user readiness
|
||||
linkLists:
|
||||
- linkListType: video
|
||||
links:
|
||||
- text: Microsoft Edge tips and tricks (video, 20:26)
|
||||
url: https://myignite.microsoft.com/sessions/56630?source=sessions
|
||||
- linkListType: download
|
||||
links:
|
||||
- text: Quick Start - Microsoft Edge (PDF, .98 MB)
|
||||
url: https://go.microsoft.com/fwlink/?linkid=825648
|
||||
- text: Find it faster with Microsoft Edge (PDF, 605 KB)
|
||||
url: https://go.microsoft.com/fwlink/?linkid=825661
|
||||
- text: Use Microsoft Edge to collaborate (PDF, 468 KB)
|
||||
url: https://go.microsoft.com/fwlink/?linkid=825653
|
||||
- text: Group Policy and MDM settings in Microsoft Edge
|
||||
url: /microsoft-edge/deploy/available-policies
|
||||
- text: Microsoft Edge training and demonstrations
|
||||
url: /microsoft-edge/deploy/edge-technical-demos
|
||||
- linkListType: how-to-guide
|
||||
links:
|
||||
- text: Import bookmarks
|
||||
url: https://microsoftedgetips.microsoft.com/2/39
|
||||
- text: Password management
|
||||
url: https://microsoftedgetips.microsoft.com/2/18
|
||||
|
||||
# Card (optional)
|
||||
- title: Stay informed
|
||||
linkLists:
|
||||
- linkListType: overview
|
||||
links:
|
||||
- text: Sign up for the Windows IT Pro Insider
|
||||
url: https://aka.ms/windows-it-pro-insider
|
||||
- text: Microsoft Edge Dev blog
|
||||
url: https://blogs.windows.com/msedgedev
|
||||
- text: Microsoft Edge Dev on Twitter
|
||||
url: https://twitter.com/MSEdgeDev
|
||||
|
||||
@ -9,7 +9,7 @@ ms.pagetype: edu
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.date: 09/25/2019
|
||||
ms.date: 08/31/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -18,6 +18,11 @@ manager: dansimp
|
||||
Learn what’s new with the Set up School PCs app each week. Find out about new app features and functionality, see updated screenshots, and find information about past releases.
|
||||
|
||||
|
||||
## Week of August 24, 2020
|
||||
|
||||
### Longer device names supported in app
|
||||
You can now give devices running Windows 10, version 2004 and later a name that's up to 53 characters long.
|
||||
|
||||
## Week of September 23, 2019
|
||||
|
||||
### Easier way to deploy Office 365 to your classroom devices
|
||||
|
||||
@ -145,8 +145,8 @@ To set up a test account through Windows Configuration Designer, follow these st
|
||||
- username@tenant.com
|
||||
|
||||
4. Under **Runtime settings**, go to **TakeATest** and configure the following settings:
|
||||
1. In **LaunchURI**, enter the assessment URL.
|
||||
2. In **TesterAccount**, enter the test account you entered in step 3.
|
||||
- In **LaunchURI**, enter the assessment URL.
|
||||
- In **TesterAccount**, enter the test account you entered in step 3.
|
||||
|
||||
3. Follow the steps to [build a package](https://technet.microsoft.com/itpro/windows/configure/provisioning-create-package#build-package).
|
||||
|
||||
@ -166,9 +166,9 @@ This sample PowerShell script configures the tester account and the assessment U
|
||||
- Use your tester account for **-UserName**
|
||||
|
||||
>[!NOTE]
|
||||
>The account that you specify for the tester account must already exist on the device.
|
||||
>The account that you specify for the tester account must already exist on the device. For steps to create the tester account, see [Set up a dedicated test account](https://docs.microsoft.com/education/windows/take-a-test-single-pc#set-up-a-dedicated-test-account).
|
||||
|
||||
```
|
||||
```powershell
|
||||
$obj = get-wmiobject -namespace root/cimv2/mdm/dmmap -class MDM_SecureAssessment -filter "InstanceID='SecureAssessment' AND ParentID='./Vendor/MSFT'";
|
||||
$obj.LaunchURI='https://www.foo.com';
|
||||
$obj.TesterAccount='TestAccount';
|
||||
@ -232,7 +232,7 @@ One of the ways you can present content in a locked down manner is by embedding
|
||||
|
||||
1. Embed a link or create a desktop shortcut with:
|
||||
|
||||
```
|
||||
```http
|
||||
ms-edu-secureassessment:<URL>#enforceLockdown
|
||||
```
|
||||
|
||||
|
||||
@ -17,6 +17,23 @@ ms.date: 10/17/2017
|
||||
|
||||
# Add unsigned app to code integrity policy
|
||||
|
||||
> [!IMPORTANT]
|
||||
> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) will be available for consumption starting mid-September 2020, and you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service between September and December 2020.
|
||||
>
|
||||
> Following are the major changes we are making to the service:
|
||||
> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets will be available as a NuGet download.
|
||||
> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it).
|
||||
> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files.
|
||||
>
|
||||
> The following functionality will be available via these PowerShell cmdlets:
|
||||
> - Get a CI policy
|
||||
> - Sign a CI policy
|
||||
> - Sign a catalog
|
||||
> - Download root cert
|
||||
> - Download history of your signing operations
|
||||
>
|
||||
> We will share detailed instructions and NuGet location before mid-September 2020. For any questions, please contact us at DGSSMigration@microsoft.com for more information on migration.
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
|
||||
@ -17,6 +17,23 @@ ms.date: 10/17/2017
|
||||
|
||||
# Device Guard signing
|
||||
|
||||
> [!IMPORTANT]
|
||||
> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) will be available for consumption starting mid-September 2020, and you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service between September and December 2020.
|
||||
>
|
||||
> Following are the major changes we are making to the service:
|
||||
> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets will be available as a NuGet download.
|
||||
> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it).
|
||||
> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files.
|
||||
>
|
||||
> The following functionality will be available via these PowerShell cmdlets:
|
||||
> - Get a CI policy
|
||||
> - Sign a CI policy
|
||||
> - Sign a catalog
|
||||
> - Download root cert
|
||||
> - Download history of your signing operations
|
||||
>
|
||||
> We will share detailed instructions and NuGet location before mid-September 2020. For any questions, please contact us at DGSSMigration@microsoft.com for more information on migration.
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
|
||||
@ -64,7 +64,7 @@ If your organization restricts computers on your network from connecting to the
|
||||
starting with Windows 10, version 1607)
|
||||
|
||||
Store for Business requires Microsoft Windows HTTP Services (WinHTTP) to install, or update apps.
|
||||
For more information about how to configure WinHTTP proxy settings to devices, see [Use Group Policy to apply WinHTTP proxy settings to Windows clients](https://support.microsoft.com/en-us/help/4494447/use-group-policy-to-apply-winhttp-proxy-settings-to-clients).
|
||||
For more information about how to configure WinHTTP proxy settings to devices, see [Use Group Policy to apply WinHTTP proxy settings to Windows clients](https://support.microsoft.com/help/4494447/use-group-policy-to-apply-winhttp-proxy-settings-to-clients).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -17,6 +17,24 @@ ms.date: 10/17/2017
|
||||
|
||||
# Sign code integrity policy with Device Guard signing
|
||||
|
||||
> [!IMPORTANT]
|
||||
> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) will be available for consumption starting mid-September 2020, and you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service between September and December 2020.
|
||||
>
|
||||
> Following are the major changes we are making to the service:
|
||||
> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets will be available as a NuGet download.
|
||||
> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it).
|
||||
> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files.
|
||||
>
|
||||
> The following functionality will be available via these PowerShell cmdlets:
|
||||
> - Get a CI policy
|
||||
> - Sign a CI policy
|
||||
> - Sign a catalog
|
||||
> - Download root cert
|
||||
> - Download history of your signing operations
|
||||
>
|
||||
> We will share detailed instructions and NuGet location before mid-September 2020. For any questions, please contact us at DGSSMigration@microsoft.com for more information on migration.
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
@ -38,11 +38,10 @@ Organizations that use Windows Server Update Services (WSUS) must take action to
|
||||
> [!NOTE]
|
||||
> You must download the FOD .cab file that matches your operating system version.
|
||||
|
||||
1. Use `Add-Package` to add Windows Mixed Reality FOD to the image.
|
||||
1. Use `Dism` to add Windows Mixed Reality FOD to the image.
|
||||
|
||||
```powershell
|
||||
Add-Package
|
||||
Dism /Online /add-package /packagepath:(path)
|
||||
Dism /Online /Add-Package /PackagePath:(path)
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -220,6 +220,9 @@ If Windows cannot load the system registry hive into memory, you must restore th
|
||||
|
||||
If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start).
|
||||
|
||||
## Kernel Phase
|
||||
|
||||
If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These include, but are not limited to, the following:
|
||||
@ -392,3 +395,6 @@ If the dump file shows an error that is related to a driver (for example, window
|
||||
3. Navigate to C:\Windows\System32\Config\.
|
||||
4. Rename the all five hives by appending ".old" to the name.
|
||||
5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start).
|
||||
|
||||
@ -21,11 +21,15 @@ The following diagram shows the DMClient CSP in tree format.
|
||||
|
||||
|
||||
|
||||
|
||||
<a href="" id="msft"></a>**./Vendor/MSFT**
|
||||
All the nodes in this CSP are supported in the device context, except for the **ExchangeID** node, which is supported in the user context. For the device context, use the **./Device/Vendor/MSFT** path and for the user context, use the **./User/Vendor/MSFT** path.
|
||||
|
||||
<a href="" id="dmclient"></a>**DMClient**
|
||||
Root node for the CSP.
|
||||
|
||||
<a href="" id="updatemanagementserviceaddress"></a>**UpdateManagementServiceAddress**
|
||||
For provisioning packages only. Specifies the list of servers (semicolon delimited). The first server in the semicolon delimited list is the server that will be used to instantiate MDM sessions. The list can be a permutation or a subset of the existing server list. You cannot add new servers to the list using this node.
|
||||
For provisioning packages only. Specifies the list of servers (semicolon delimited). The first server in the semicolon-delimited list is the server that will be used to instantiate MDM sessions. The list can be a permutation or a subset of the existing server list. You cannot add new servers to the list using this node.
|
||||
|
||||
<a href="" id="hwdevid"></a>**HWDevID**
|
||||
Added in Windows 10, version 1703. Returns the hardware device ID.
|
||||
@ -221,7 +225,7 @@ Added in Windows 10, version 1607. Returns the hardware device ID.
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="provider-providerid-commercialid"></a>**Provider/*ProviderID*/CommercialID**
|
||||
Added in Windows 10, version 1607. Configures the identifier used to uniquely associate this diagnostic data of this device as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data with your organization..
|
||||
Added in Windows 10, version 1607. Configures the identifier used to uniquely associate this diagnostic data of this device as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data with your organization.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete.
|
||||
|
||||
@ -265,7 +269,7 @@ Supported operations are Add, Delete, Get, and Replace. Value type is integer.
|
||||
|
||||
<a href="" id="provider-providerid-aadsenddevicetoken"></a>**Provider/*ProviderID*/AADSendDeviceToken**
|
||||
|
||||
Device. Added in Windows 10 version 1803. For Azure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained.
|
||||
Device. Added in Windows 10 version 1803. For Azure AD backed enrollments, this will cause the client to send a Device Token if the User Token cannot be obtained.
|
||||
|
||||
Supported operations are Add, Delete, Get, and Replace. Value type is bool.
|
||||
|
||||
|
||||
@ -170,11 +170,16 @@ Requirements:
|
||||
|
||||
1. Download:
|
||||
|
||||
- 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880)
|
||||
- 1803 --> [Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880)
|
||||
|
||||
- 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576)
|
||||
- 1809 --> [Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576)
|
||||
|
||||
- 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495&WT.mc_id=rss_alldownloads_all)
|
||||
- 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495)
|
||||
|
||||
- 1909 --> [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](
|
||||
https://www.microsoft.com/download/confirmation.aspx?id=1005915)
|
||||
|
||||
- 2004 --> [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445)
|
||||
|
||||
2. Install the package on the Domain Controller.
|
||||
|
||||
@ -185,6 +190,10 @@ Requirements:
|
||||
- 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2**
|
||||
|
||||
- 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3**
|
||||
|
||||
- 1909 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2019 Update (1909)**
|
||||
|
||||
- 2004 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2020 Update (2004)**
|
||||
|
||||
4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**.
|
||||
|
||||
|
||||
@ -72,23 +72,23 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -155,23 +155,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -236,23 +236,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -317,23 +317,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -399,23 +399,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -477,23 +477,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -555,23 +555,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -634,23 +634,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -712,23 +712,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -793,23 +793,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -874,23 +874,23 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@ -79,19 +79,19 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -156,19 +156,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -227,19 +227,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -302,19 +302,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -378,19 +378,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -456,19 +456,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -523,19 +523,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -597,19 +597,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -670,19 +670,19 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup></sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@ -45,11 +45,11 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -57,7 +57,7 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@ -108,11 +108,11 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -120,7 +120,7 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -176,11 +176,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -188,7 +188,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -253,11 +253,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -265,7 +265,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -322,11 +322,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -334,7 +334,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -409,11 +409,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -421,7 +421,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -478,11 +478,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -490,7 +490,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -547,11 +547,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -559,7 +559,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -618,11 +618,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -630,7 +630,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -691,11 +691,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -703,7 +703,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -766,11 +766,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -778,7 +778,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -840,11 +840,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -852,7 +852,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -916,11 +916,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -928,7 +928,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -985,11 +985,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -997,7 +997,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1058,11 +1058,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1070,7 +1070,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1134,11 +1134,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1146,7 +1146,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1205,11 +1205,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1217,7 +1217,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1281,11 +1281,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1293,7 +1293,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1350,11 +1350,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1362,7 +1362,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1422,11 +1422,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1434,7 +1434,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1497,11 +1497,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1509,7 +1509,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1568,11 +1568,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1580,7 +1580,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1655,11 +1655,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -1667,7 +1667,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@ -49,11 +49,11 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -61,7 +61,7 @@ manager: dansimp
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -122,11 +122,11 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
@ -134,7 +134,7 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@ -2313,6 +2313,9 @@ ADMX Info:
|
||||
|
||||
Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer.
|
||||
|
||||
> [!NOTE]
|
||||
> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. For more information about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus).
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
@ -131,4 +131,4 @@ This section contains advanced troubleshooting topics and links to help you reso
|
||||
|
||||
## Other Resources
|
||||
|
||||
### [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-support-solutions)
|
||||
- [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-troubleshooting)
|
||||
|
||||
@ -27,7 +27,7 @@ The following features and functionalities have been removed from the installed
|
||||
|
||||
|Feature | Details and mitigation | Removed in version |
|
||||
| ----------- | --------------------- | ------ |
|
||||
| Connect app | The [Connect app](https://docs.microsoft.com/windows-hardware/design/device-experiences/wireless-projection-understanding) for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 |
|
||||
| Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 |
|
||||
| Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13th, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 |
|
||||
| Cortana | Cortana has been updated and enhanced in the Windows 10 May 2020 Update. With [these changes](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-2004#cortana), some previously available consumer skills such as music, connected home, and other non-Microsoft skills are no longer available. | 2004 |
|
||||
| Windows To Go | Windows To Go was announced as deprecated in Windows 10, version 1903 and is removed in this release. | 2004 |
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 253 KiB |
@ -17,13 +17,14 @@ ms.topic: article
|
||||
|
||||
# Manually Configuring Devices for Update Compliance
|
||||
|
||||
There are a number of requirements to consider when manually configuring Update Compliance. These can potentially change with newer versions of Windows 10. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required.
|
||||
There are a number of requirements to consider when manually configuring devices for Update Compliance. These can potentially change with newer versions of Windows 10. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required.
|
||||
|
||||
The requirements are separated into different categories:
|
||||
|
||||
1. Ensuring the [**required policies**](#required-policies) for Update Compliance are correctly configured.
|
||||
2. Devices in every network topography needs to send data to the [**required endpoints**](#required-endpoints) for Update Compliance, for example both devices in main and satellite offices, which may have different network configurations.
|
||||
3. Ensure [**Required Windows services**](#required-services) are running or are scheduled to run. It is recommended all Microsoft and Windows services are set to their out-of-box defaults to ensure proper functionality.
|
||||
4. [**Run a full Census sync**](#run-a-full-census-sync) on new devices to ensure that all necessary data points are collected.
|
||||
|
||||
## Required policies
|
||||
|
||||
@ -75,3 +76,14 @@ To enable data sharing between devices, your network, and Microsoft's Diagnostic
|
||||
## Required services
|
||||
|
||||
Many Windows and Microsoft services are required to ensure that not only the device can function, but Update Compliance can see device data. It is recommended that you allow all default services from the out-of-box experience to remain running. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) checks whether the majority of these services are running or are allowed to run automatically.
|
||||
|
||||
|
||||
## Run a full Census sync
|
||||
|
||||
Census is a service that runs on a regular schedule on Windows devices. A number of key device attributes, like what operating system edition is installed on the device, are included in the Census payload. However, to save network load and system resources, data that tends to be more static (like edition) is sent approximately once per week rather than on every daily run. Because of this, these attributes can take longer to appear in Update Compliance unless you start a full Census sync. The Update Compliance Configuration Script does this.
|
||||
|
||||
A full Census sync adds a new registry value to Census's path. When this registry value is added, Census's configuration is overridden to force a full sync. For Census to work normally, this registry value should be enabled, Census should be started manually, and then the registry value should be disabled. Follow these steps:
|
||||
|
||||
1. For every device you are manually configuring for Update Compliance, add or modify the registry key located at **HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Census** to include a new **DWORD value** named **FullSync** and set to **1**.
|
||||
2. Run Devicecensus.exe with administrator privileges on every device. Devicecensus.exe is in the System32 folder. No additional run parameters are required.
|
||||
3. After Devicecensus.exe has run, the **FullSync** registry value can be removed or set to **0**.
|
||||
|
||||
@ -35,13 +35,21 @@ Refer to the following list for what each state means:
|
||||
* Devices that have failed the given feature update installation are counted as **Update failed**.
|
||||
* If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category.
|
||||
|
||||
## Compatibility holds
|
||||
## Safeguard holds
|
||||
|
||||
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *compatibility hold* is generated to delay the device's upgrade and safeguard the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all compatibility holds on the Windows 10 release information page for any given release.
|
||||
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows 10 release information page for any given release.
|
||||
|
||||
### Opting out of compatibility hold
|
||||
## Queries for safeguard holds
|
||||
|
||||
Microsoft will release a device from a compatibility hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired.
|
||||
Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build.
|
||||
|
||||
|
||||
|
||||
Update Compliance reporting will display the Safeguard IDs for known issues affecting a device in the **DeploymentErrorCode** column. Safeguard IDs for publicly discussed known issues are also included in the Windows Release Health dashboard, where you can easily find information related to publicly available safeguards.
|
||||
|
||||
### Opting out of safeguard hold
|
||||
|
||||
Microsoft will release a device from a safeguard hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired.
|
||||
To opt out, set the registry key as follows:
|
||||
|
||||
- Registry Key Path :: **Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion**
|
||||
@ -50,6 +58,5 @@ To opt out, set the registry key as follows:
|
||||
- Type :: **REG_DWORD**
|
||||
- Value :: **0**
|
||||
|
||||
|
||||
Setting this registry key to **0** will force the device to opt out from *all* compatibility holds. Any other value, or deleting the key, will resume compatibility protection on the device.
|
||||
Setting this registry key to **0** will force the device to opt out from *all* safeguard holds. Any other value, or deleting the key, will resume compatibility protection on the device.
|
||||
|
||||
|
||||
@ -17,11 +17,6 @@ ms.topic: article
|
||||
|
||||
# Monitor Windows Updates with Update Compliance
|
||||
|
||||
> [!IMPORTANT]
|
||||
> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. Two planned feature removals for Update Compliance – Microsoft Defender Antivirus reporting and Perspectives – are now scheduled to be removed beginning Monday, May 11, 2020.
|
||||
> * The retirement of Microsoft Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to for threats with [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) and [Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection).
|
||||
> * The Perspectives feature of Update Compliance will be retired Monday, May 11, 2020. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
|
||||
|
||||
## Introduction
|
||||
|
||||
Update Compliance enables organizations to:
|
||||
|
||||
@ -26,7 +26,7 @@ WaaSDeploymentStatus records track a specific update's installation progress on
|
||||
|**DeploymentError** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Disk Error` |A readable string describing the error, if any. If empty, there is either no string matching the error or there is no error. |
|
||||
|**DeploymentErrorCode** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`8003001E` |Microsoft internal error code for the error, if any. If empty, there is either no error or there is *no error code*, meaning that the issue raised does not correspond to an error, but some inferred issue. |
|
||||
|**DeploymentStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Failed` |The high level status of installing this update on this device. Possible values are:<br><li> **Update completed**: Device has completed the update installation.<li> **In Progress**: Device is in one of the various stages of installing an update, detailed in `DetailedStatus`.<li> **Deferred**: A device's deferral policy is preventing the update from being offered by Windows Update.<li> **Cancelled**: The update was cancelled.<li> **Blocked**: There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update.<li> **Unknown**: Update Compliance generated WaaSDeploymentStatus records for devices as soon as it detects an update newer than the one installed on the device. Devices that have not sent any deployment data for that update will have the status `Unknown`.<li> **Update paused**: Devices are paused via Windows Update for Business Pause policies, preventing the update from being offered by Windows Update. <li> **Failed**: Device encountered a failure in the update process, preventing it from installing the update. This may result in an automatic retry in the case of Windows Update, unless the `DeploymentError` indicates the issue requires action before the update can continue.|
|
||||
|**DetailedStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Reboot required` |A detailed status for the installation of this update on this device. Possible values are:<br><li> **Update deferred**: When a device's Windows Update for Business policy dictates the update is deferred.<li> **Update paused**: The device's Windows Update for Business policy dictates the update is paused from being offered.<li> **Update offered**: The device has been offered the update, but has not begun downloading it.<li> **Pre-Download tasks passed**: The device has finished all necessary tasks prior to downloading the update.<li> **Compatibility hold**: The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds).<li> **Download started**: The update has begun downloading on the device.<li> **Download Succeeded**: The update has successfully completed downloading. <li> **Pre-Install Tasks Passed**: Tasks that must be completed prior to installing the update have been completed.<li> **Install Started**: Installation of the update has begun.<li> **Reboot Required**: The device has finished installing the update, and a reboot is required before the update can be completed.<li> **Reboot Pending**: The device has a scheduled reboot to apply the update.<li> **Reboot Initiated**: The scheduled reboot has been initiated.<li> **Commit**: Changes are being committed post-reboot. This is another step of the installation process.<li> **Update Completed**: The update has successfully installed.|
|
||||
|**DetailedStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Reboot required` |A detailed status for the installation of this update on this device. Possible values are:<br><li> **Update deferred**: When a device's Windows Update for Business policy dictates the update is deferred.<li> **Update paused**: The device's Windows Update for Business policy dictates the update is paused from being offered.<li> **Update offered**: The device has been offered the update, but has not begun downloading it.<li> **Pre-Download tasks passed**: The device has finished all necessary tasks prior to downloading the update.<li> **Compatibility hold**: The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#safeguard-holds).<li> **Download started**: The update has begun downloading on the device.<li> **Download Succeeded**: The update has successfully completed downloading. <li> **Pre-Install Tasks Passed**: Tasks that must be completed prior to installing the update have been completed.<li> **Install Started**: Installation of the update has begun.<li> **Reboot Required**: The device has finished installing the update, and a reboot is required before the update can be completed.<li> **Reboot Pending**: The device has a scheduled reboot to apply the update.<li> **Reboot Initiated**: The scheduled reboot has been initiated.<li> **Commit**: Changes are being committed post-reboot. This is another step of the installation process.<li> **Update Completed**: The update has successfully installed.|
|
||||
|**ExpectedInstallDate** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/28/2020, 1:00:01.318 PM`|Rather than the expected date this update will be installed, this should be interpreted as the minimum date Windows Update will make the update available for the device. This takes into account Deferrals. |
|
||||
|**LastScan** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/22/2020, 1:00:01.318 PM`|The last point in time that this device sent Update Session data. |
|
||||
|**OriginBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.719` |The build originally installed on the device when this Update Session began. |
|
||||
|
||||
@ -119,8 +119,13 @@ A compliance deadline policy (released in June 2019) enables you to set separate
|
||||
|
||||
This policy enables you to specify the number of days from an update's publication date that it must be installed on the device. The policy also includes a configurable grace period that specifies the number of days from when the update is installed on the device until the device is forced to restart. This is extremely beneficial in a vacation scenario as it allows, for example, users who have been away to have a bit of time before being forced to restart their devices when they return from vacation.
|
||||
|
||||
#### Update Baseline
|
||||
The large number of different policies offered for Windows 10 can be overwhelming. Update Baseline provides a clear list of recommended Windows update policy settings for IT administrators who want the best user experience while also meeting their update compliance goals. The Update Baseline for Windows 10 includes policy settings recommendations covering deadline configuration, restart behavior, power policies, and more.
|
||||
|
||||
The Update Baseline toolkit makes it easy by providing a single command for IT Admins to apply the Update Baseline to devices. You can get the Update Baseline toolkit from the [Download Center](https://www.microsoft.com/download/details.aspx?id=101056).
|
||||
|
||||
>[!NOTE]
|
||||
>The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices when.
|
||||
|
||||
<!--
|
||||
|
||||
|
||||
@ -52,9 +52,12 @@ Drivers are automatically enabled because they are beneficial to device systems.
|
||||
#### I want to receive pre-release versions of the next feature update
|
||||
|
||||
1. Ensure that you are enrolled in the Windows Insider Program for Business. This is a completely free program available to commercial customers to aid them in their validation of feature updates before they are released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates.
|
||||
2. For any of test devices you want to install pre-release builds, use [Update/ManagePreviewBuilds](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**.
|
||||
3. Use [Update/BranchReadinessLevel](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using pre-release builds for validation.
|
||||
4. Additionally, you can defer pre-release feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you are testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests.
|
||||
|
||||
1. For any of test devices you want to install pre-release builds, use [Update/ManagePreviewBuilds](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**.
|
||||
|
||||
1. Use [Update/BranchReadinessLevel](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using pre-release builds for validation.
|
||||
|
||||
1. Additionally, you can defer pre-release feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you are testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests.
|
||||
|
||||
#### I want to manage which released feature update my devices receive
|
||||
|
||||
@ -102,7 +105,7 @@ Now all devices are paused from updating for 35 days. When the pause is removed,
|
||||
|
||||
#### I want to stay on a specific version
|
||||
|
||||
If you need a device to stay on a version beyond the point when deferrals on the next version would elapse or if you need to skip a version (for example, update fall release to fall release) use the **Select the target Feature Update version** setting instead of using the Update/TargetReleaseVersion (or DeployFeatureUpdates in Windows 10, version 1803 and later) setting for feature update deferrals. When you use this policy, specify the version that you want your device(s) to use. If you don't update this before the device reaches end of service, the device will automatically be updated once it is 60 days past end of service for its edition.
|
||||
If you need a device to stay on a version beyond the point when deferrals on the next version would elapse or if you need to skip a version (for example, update fall release to fall release) use the [Update/TargetReleaseVersion](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-targetreleaseversion) (or Deploy Feature Updates Preview in Intune) instead of using feature update deferrals. When you use this policy, specify the version that you want your device(s) to move to or stay on (for example, "1909"). You can find version information at the [Windows 10 Release Information Page](https://docs.microsoft.com/windows/release-information/).
|
||||
|
||||
### Manage how users experience updates
|
||||
|
||||
@ -138,7 +141,7 @@ We recommend that you use set specific deadlines for feature and quality updates
|
||||
- [Update/ConfigureDeadlineGracePeriod](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-configuredeadlinegraceperiod)
|
||||
- [Update/ConfigureDeadlineNoAutoReboot](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot)
|
||||
|
||||
These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point the device will automatically schedule a restart regardles of active hours.
|
||||
These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point the device will automatically schedule a restart regardless of active hours.
|
||||
|
||||
These notifications are what the user sees depending on the settings you choose:
|
||||
|
||||
@ -172,8 +175,8 @@ There are additional settings that affect the notifications.
|
||||
|
||||
We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you have set. If you do have further needs that are not met by the default notification settings, you can use the [Update/UpdateNotificationLevel](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values:
|
||||
|
||||
**0** (default) – Use the default Windows Update notifications
|
||||
**1** – Turn off all notifications, excluding restart warnings
|
||||
**0** (default) – Use the default Windows Update notifications<br/>
|
||||
**1** – Turn off all notifications, excluding restart warnings<br/>
|
||||
**2** – Turn off all notifications, including restart warnings
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -115,7 +115,8 @@ If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_M
|
||||
You may choose to apply a rule to permit HTTP RANGE requests for the following URLs:
|
||||
|
||||
*.download.windowsupdate.com
|
||||
*.dl.delivery.mp.microsoft.com
|
||||
*.dl.delivery.mp.microsoft.com
|
||||
*.delivery.mp.microsoft.com
|
||||
*.emdl.ws.microsoft.com
|
||||
|
||||
If you cannot permit RANGE requests, keep in mind that this means you are downloading more content than needed in updates (as delta patching will not work).
|
||||
@ -166,6 +167,10 @@ Check that your device can access these Windows Update endpoints:
|
||||
- `http://*.download.windowsupdate.com`
|
||||
- `http://wustat.windows.com`
|
||||
- `http://ntservicepack.microsoft.com`
|
||||
- `https://*.prod.do.dsp.mp.microsoft.com`
|
||||
- `http://*.dl.delivery.mp.microsoft.com`
|
||||
- `https://*.delivery.mp.microsoft.com`
|
||||
- `https://tsfe.trafficshaping.dsp.mp.microsoft.com`
|
||||
|
||||
Allow these endpoints for future use.
|
||||
|
||||
|
||||
@ -64,11 +64,9 @@ This section explains the syntax and usage of the **ScanState** command-line opt
|
||||
|
||||
The **ScanState** command's syntax is:
|
||||
|
||||
scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\]
|
||||
> scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\]
|
||||
|
||||
For example:
|
||||
|
||||
To create a Config.xml file in the current directory, use:
|
||||
For example, to create a Config.xml file in the current directory, use:
|
||||
|
||||
`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13`
|
||||
|
||||
@ -313,8 +311,8 @@ USMT provides the following options to specify what files you want to migrate.
|
||||
|
||||
USMT provides several options that you can use to analyze problems that occur during migration.
|
||||
|
||||
**Note**
|
||||
The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option.
|
||||
> [!NOTE]
|
||||
> The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option.
|
||||
|
||||
|
||||
|
||||
@ -617,13 +615,12 @@ You can use the following options to migrate encrypted files. In all cases, by d
|
||||
|
||||
For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md).
|
||||
|
||||
**Note**
|
||||
EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files
|
||||
> [!NOTE]
|
||||
> EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files
|
||||
|
||||
|
||||
|
||||
**Caution**
|
||||
Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration.
|
||||
> [!CAUTION]
|
||||
> Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration.
|
||||
|
||||
|
||||
|
||||
@ -720,7 +717,7 @@ The following table indicates which command-line options are not compatible with
|
||||
<td align="left"><p>/<strong>nocompress</strong></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>X</p></td>
|
||||
<td align="left"><p></p></td>
|
||||
<td align="left"><p>N/A</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
@ -853,9 +850,8 @@ The following table indicates which command-line options are not compatible with
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
**Note**
|
||||
You must specify either the /**key** or /**keyfile** option with the /**encrypt** option.
|
||||
> [!NOTE]
|
||||
> You must specify either the /**key** or /**keyfile** option with the /**encrypt** option.
|
||||
|
||||
|
||||
|
||||
@ -864,11 +860,3 @@ You must specify either the /**key** or /**keyfile** option with the /**encrypt*
|
||||
|
||||
[XML Elements Library](usmt-xml-elements-library.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -49,7 +49,7 @@ To enable KMS functionality, a KMS key is installed on a KMS host; then, the hos
|
||||
|
||||
To activate , use the slmgr.vbs command. Open an elevated command prompt and run one of the following commands:
|
||||
- To install the KMS key, type `slmgr.vbs /ipk <KmsKey>`.
|
||||
- To activate online, type `slmgr.vbs/ato`.
|
||||
- To activate online, type `slmgr.vbs /ato`.
|
||||
- To activate by telephone , follow these steps:
|
||||
1. Run `slmgr.vbs /dti` and confirm the installation ID.
|
||||
2. Call [Microsoft Licensing Activation Centers worldwide telephone numbers](https://www.microsoft.com/licensing/existing-customer/activation-centers) and follow the voice prompts to enter the installation ID that you obtained in step 1 on your telephone.
|
||||
|
||||
@ -64,10 +64,10 @@ A final set of changes includes two new policies that can help you fine-tune dia
|
||||
|
||||
- The **Limit dump collection** policy is a new policy that can be used to limit the types of [crash dumps](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) that can be sent back to Microsoft. If this policy is enabled, Windows Error Reporting will send only kernel mini dumps and user mode triage dumps.
|
||||
- Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection**
|
||||
- MDM policy: System/ LimitDiagnosticLogCollection
|
||||
- MDM policy: System/LimitDumpCollection
|
||||
- The **Limit diagnostic log collection** policy is another new policy that limits the number of diagnostic logs that are sent back to Microsoft. If this policy is enabled, diagnostic logs are not sent back to Microsoft.
|
||||
- Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection**
|
||||
- MDM policy: System/LimitDumpCollection
|
||||
- MDM policy: System/LimitDiagnosticLogCollection
|
||||
|
||||
>[!Important]
|
||||
>All of the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier.
|
||||
|
||||
@ -107,7 +107,7 @@ The following table lists management options for each setting, beginning with Wi
|
||||
| [25. Windows Spotlight](#bkmk-spotlight) |  |  |  |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  |  |
|
||||
| [27. Apps for websites](#bkmk-apps-for-websites) | |  |  |
|
||||
| [28. Windows Update Delivery Optimization](#bkmk-updates) |  |  |  |
|
||||
| [28. Delivery Optimization](#bkmk-updates) |  |  |  |
|
||||
| [29. Windows Update](#bkmk-wu) | |  |  |
|
||||
|
||||
|
||||
@ -217,7 +217,7 @@ See the following table for a summary of the management settings for Windows Ser
|
||||
| [25. Windows Spotlight](#bkmk-spotlight) |  |  |  |
|
||||
| [26. Microsoft Store](#bkmk-windowsstore) | |  |  |
|
||||
| [27. Apps for websites](#bkmk-apps-for-websites) | |  | |
|
||||
| [28. Windows Update Delivery Optimization](#bkmk-updates) |  |  |  |
|
||||
| [28. Delivery Optimization](#bkmk-updates) |  |  |  |
|
||||
| [29. Windows Update](#bkmk-wu) | |  |  |
|
||||
|
||||
## How to configure each setting
|
||||
@ -415,7 +415,7 @@ To turn off Insider Preview builds for Windows 10:
|
||||
|
||||
### <a href="" id="bkmk-ie"></a>8. Internet Explorer
|
||||
> [!NOTE]
|
||||
>When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/en-us/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings:
|
||||
>When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings:
|
||||
|
||||
| Policy | Description |
|
||||
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||
@ -1560,7 +1560,7 @@ To turn off Messaging cloud sync:
|
||||
You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](https://technet.microsoft.com/library/cc722030.aspx).
|
||||
|
||||
>[!NOTE]
|
||||
>If you disable Teredo, some XBOX gaming features and Windows Update Delivery Optimization will not work.
|
||||
>If you disable Teredo, some XBOX gaming features and Delivery Optimization (with Group or Internet peering) will not work.
|
||||
|
||||
- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**.
|
||||
|
||||
@ -1664,7 +1664,7 @@ You can turn off **Enhanced Notifications** as follows:
|
||||
|
||||
### <a href="" id="bkmk-defender-smartscreen"></a>24.1 Windows Defender SmartScreen
|
||||
|
||||
To disable Windows Defender Smartscreen:
|
||||
To disable Windows Defender SmartScreen:
|
||||
|
||||
In Group Policy, configure:
|
||||
|
||||
@ -1809,19 +1809,19 @@ You can turn off apps for websites, preventing customers who visit websites that
|
||||
|
||||
- Create a new REG_DWORD registry setting named **EnableAppUriHandlers** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**.
|
||||
|
||||
### <a href="" id="bkmk-updates"></a>28. Windows Update Delivery Optimization
|
||||
### <a href="" id="bkmk-updates"></a>28. Delivery Optimization
|
||||
|
||||
Windows Update Delivery Optimization lets you get Windows updates and Microsoft Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet.
|
||||
Delivery Optimization is the downloader of Windows updates, Microsoft Store apps, Office and other content from Microsoft. Delivery Optimization can also download from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization Peer-to-Peer option turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet.
|
||||
|
||||
By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network.
|
||||
By default, PCs running Windows 10 will only use Delivery Optimization to get and receive updates for PCs and apps on your local network.
|
||||
|
||||
Use the UI, Group Policy, or Registry Keys to set up Delivery Optimization.
|
||||
|
||||
In Windows 10 version 1607 and above you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Bypass** (99), as described below.
|
||||
In Windows 10 version 1607 and above you can stop network traffic related to Delivery Optimization Cloud Service by setting **Download Mode** to **Simple Mode** (99), as described below.
|
||||
|
||||
### <a href="" id="bkmk-wudo-ui"></a>28.1 Settings > Update & security
|
||||
|
||||
You can set up Delivery Optimization from the **Settings** UI.
|
||||
You can set up Delivery Optimization Peer-to-Peer from the **Settings** UI.
|
||||
|
||||
- Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**.
|
||||
|
||||
@ -1837,9 +1837,12 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con
|
||||
| Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size. <br /> The default value is 20, which represents 20% of the disk.|
|
||||
| Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity. <br /> The default value is 0, which means unlimited possible bandwidth.|
|
||||
|
||||
|
||||
For a comprehensive list of Delivery Optimization Policies, see [Delivery Optimization Reference](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference).
|
||||
|
||||
### <a href="" id="bkmk-wudo-mdm"></a>28.3 Delivery Optimization
|
||||
|
||||
- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Bypass"** to prevent traffic.
|
||||
- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Simple Mode (99)"** to prevent traffic between peers as well as traffic back to the Delivery Optimization Cloud Service.
|
||||
|
||||
-or-
|
||||
|
||||
@ -1848,6 +1851,9 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con
|
||||
|
||||
For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684).
|
||||
|
||||
For IT Professionals, information about Delivery Optimization is available here: [Delivery Optimization for Windows 10 updates]
|
||||
(https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization).
|
||||
|
||||
### <a href="" id="bkmk-wu"></a>29. Windows Update
|
||||
|
||||
You can turn off Windows Update by setting the following registry entries:
|
||||
|
||||
@ -138,6 +138,7 @@ The following methodology was used to derive these network endpoints:
|
||||
|||HTTP \ HTTPS|g.live.com/1rewlive5skydrive/*|
|
||||
|||HTTP|msagfx.live.com|
|
||||
|||HTTPS|oneclient.sfx.ms|
|
||||
|||HTTP| windows.policies.live.net|
|
||||
|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
|
||||
|||HTTPS|cy2.settings.data.microsoft.com.akadns.net|
|
||||
|||HTTPS|settings.data.microsoft.com|
|
||||
@ -167,6 +168,7 @@ The following methodology was used to derive these network endpoints:
|
||||
|||HTTP|*.windowsupdate.com|
|
||||
||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com|
|
||||
|||HTTPS|*.update.microsoft.com|
|
||||
||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com|
|
||||
||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com|
|
||||
|
||||
## Other Windows 10 editions
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -40,7 +40,7 @@ Transparency is an important part of the data collection process in Windows 10.
|
||||
|
||||
### 1.1 Device set up experience and support for layered transparency
|
||||
|
||||
When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used, and how to manage the setting after the device setup is complete. When connected to the network during this portion of setup, the user can also review the privacy statement. A brief overview of the set up experience for privacy settings is described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97).
|
||||
When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used, and how to manage the setting after the device setup is complete. When connected to the network during this portion of setup, the user can also review the privacy statement. A brief overview of the set up experience for privacy settings is described in [Windows Insiders get first look at new privacy screen settings layout coming to Windows 10](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97), a blog entry on Windows Blogs.
|
||||
|
||||
The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information.
|
||||
|
||||
@ -168,7 +168,7 @@ If a user signs in to a Windows experience or app on their device with their Mic
|
||||
|
||||
## 4. Cross-border data transfers
|
||||
|
||||
Microsoft complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States.
|
||||
Microsoft complies with applicable law regarding the collection, use, and retention of personal information, including its transfer across borders
|
||||
|
||||
Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) provides details on how we store and process personal data.
|
||||
|
||||
|
||||
@ -121,6 +121,8 @@ The following methodology was used to derive the network endpoints:
|
||||
| `www.bing.com`* | HTTP | Used for updates for Cortana, apps, and Live Tiles
|
||||
| `www.msftconnecttest.com` | HTTP | Network Connection (NCSI)
|
||||
| `www.office.com` | HTTPS | Microsoft Office
|
||||
| adl.windows.com | HTTP | Used for compatibility database updates for Windows
|
||||
| windows.policies.live.net | HTTP | OneDrive
|
||||
|
||||
|
||||
## Windows 10 Pro
|
||||
|
||||
@ -93,6 +93,8 @@ The following methodology was used to derive the network endpoints:
|
||||
|www.bing.com|HTTPS/TLS v1.2|Cortana and Live Tiles
|
||||
|www.msftconnecttest.com|HTTP|Network Connection Status Indicator (NCSI)
|
||||
|wdcp.microsoft.com|HTTPS|Used for Windows Defender when Cloud-based Protection is enabled
|
||||
|activity.windows.com|TLSV1.2|Used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows
|
||||
|adl.windows.com|HTTP|Used for compatibility database updates for Windows
|
||||
|
||||
## Windows 10 Pro
|
||||
|
||||
@ -155,6 +157,8 @@ The following methodology was used to derive the network endpoints:
|
||||
|storage.live.com|HTTP/TLS v1.2|OneDrive
|
||||
|skydrivesync.policies.live.net|TLS v1.2|OneDrive
|
||||
|windows.policies.live.net|HTTP|OneDrive
|
||||
|activity.windows.com|TLSV1.2|Used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows
|
||||
|adl.windows.com|HTTP|Used for compatibility database updates for Windows
|
||||
|
||||
## Windows 10 Education
|
||||
|
||||
@ -203,3 +207,4 @@ The following methodology was used to derive the network endpoints:
|
||||
|outlook.office365.com|HTTP|Microsoft Office
|
||||
|www.bing.com|TLS v1.2|Used for updates for Cortana, apps, and Live Tiles
|
||||
|www.msftconnecttest.com|HTTP|Network Connection (NCSI)
|
||||
|adl.windows.com|HTTP|Used for compatibility database updates for Windows
|
||||
|
||||
@ -21,7 +21,8 @@ ms.custom:
|
||||
# Manage Windows Defender Credential Guard
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 <=1903 Enterprise and Education SKUs
|
||||
- Windows 10 >=1909
|
||||
- Windows Server 2016
|
||||
- Windows Server 2019
|
||||
|
||||
|
||||
@ -44,11 +44,12 @@ Windows Hello for Business uses asymmetric keys as user credentials (rather than
|
||||
|
||||
Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials.
|
||||
|
||||
1. Open an elevated command prompt.
|
||||
2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO.
|
||||
3. To update the schema, type ```adprep /forestprep```.
|
||||
4. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema.
|
||||
5. Close the Command Prompt and sign-out.
|
||||
1. Mount the ISO file (or insert the DVD) containing the Windows Server 2016 or later installation media.
|
||||
2. Open an elevated command prompt.
|
||||
3. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO.
|
||||
4. To update the schema, type ```adprep /forestprep```.
|
||||
5. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema.
|
||||
6. Close the Command Prompt and sign-out.
|
||||
|
||||
## Create the KeyCredential Admins Security Global Group
|
||||
|
||||
|
||||
@ -77,9 +77,7 @@ Communicating with Azure Active Directory uses the following URLs:
|
||||
- login.windows.net
|
||||
|
||||
If your environment uses Microsoft Intune, you need these additional URLs:
|
||||
- enrollment.manage-beta.microsoft.com
|
||||
- enrollment.manage.microsoft.com
|
||||
- portal.manage-beta.microsoft.com
|
||||
- portal.manage.microsoft.com
|
||||
|
||||
## What is the difference between non-destructive and destructive PIN reset?
|
||||
|
||||
@ -49,7 +49,7 @@ In this task you will
|
||||
|
||||
### Configure Active Directory to support Domain Administrator enrollment
|
||||
|
||||
The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy.
|
||||
The designed Windows Hello for Business configuration gives the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy.
|
||||
|
||||
Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute.
|
||||
|
||||
|
||||
@ -301,35 +301,32 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted
|
||||
|
||||
Sign-in a workstation with access equivalent to a _domain user_.
|
||||
|
||||
1. Sign-in to the [Azure Portal](https://portal.azure.com/).
|
||||
2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**.
|
||||
3. Click **device enrollment**.
|
||||
4. Click **Windows enrollment**
|
||||
5. Under **Windows enrollment**, click **Windows Hello for Business**.
|
||||
|
||||
6. Under **Priority**, click **Default**.
|
||||
7. Under **All users and all devices**, click **Settings**.
|
||||
8. Select **Enabled** from the **Configure Windows Hello for Business** list.
|
||||
9. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software based keys.
|
||||
10. Type the desired **Minimum PIN length** and **Maximum PIN length**.
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/).
|
||||
2. Select **Devices**.
|
||||
3. Choose **Enroll devices**.
|
||||
4. Select **Windows enrollment**.
|
||||
5. Under **Windows enrollment**, select **Windows Hello for Business**.
|
||||
|
||||
6. Select **Enabled** from the **Configure Windows Hello for Business** list.
|
||||
7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys.
|
||||
8. Enter the desired **Minimum PIN length** and **Maximum PIN length**.
|
||||
> [!IMPORTANT]
|
||||
> The default minimum PIN length for Windows Hello for Business on Windows 10 is 6. Microsoft Intune defaults the minimum PIN length to 4, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to 6.
|
||||
> The default minimum PIN length for Windows Hello for Business on Windows 10 is six. Microsoft Intune defaults the minimum PIN length to four, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to six.
|
||||
|
||||
|
||||
|
||||
11. Select the appropriate configuration for the following settings.
|
||||
9. Select the appropriate configuration for the following settings:
|
||||
* **Lowercase letters in PIN**
|
||||
* **Uppercase letters in PIN**
|
||||
* **Special characters in PIN**
|
||||
* **PIN expiration (days)**
|
||||
* **Remember PIN history**
|
||||
|
||||
> [!NOTE]
|
||||
> The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature.
|
||||
|
||||
12. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**.
|
||||
13. Select **No** to **Allow phone sign-in**. This feature has been deprecated.
|
||||
14. Click **Save**
|
||||
15. Sign-out of the Azure portal.
|
||||
10. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**.
|
||||
11. Select **No** to **Allow phone sign-in**. This feature has been deprecated.
|
||||
12. Choose **Save**.
|
||||
13. Sign out of the Microsoft Endpoint Manager admin center.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> For more details about the actual experience after everything has been configured, please see [Windows Hello for Business and Authentication](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication).
|
||||
|
||||
@ -71,7 +71,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
> 2. Right click "Scope Descriptions" and select "Add Scope Description".
|
||||
> 3. Under name type "ugs" and Click Apply > OK.
|
||||
> 4. Launch Powershell as Administrator.
|
||||
> 5. Execute the command "Get-AdfsApplicationPermission". Look for the ScopeNames :{openid, aza} that has the ClientRoleIdentifier Make a note of the ObjectIdentifier.
|
||||
> 5. Execute the command "Get-AdfsApplicationPermission". Look for the ScopeNames :{openid, aza} that has the ClientRoleIdentifier is equal to 38aa3b87-a06d-4817-b275-7a316988d93b and make a note of the ObjectIdentifier.
|
||||
> 6. Execute the command "Set-AdfsApplicationPermission -TargetIdentifier <ObjectIdentifier from step 5> -AddScope 'ugs'.
|
||||
> 7. Restart the ADFS service.
|
||||
> 8. On the client: Restart the client. User should be prompted to provision WHFB.
|
||||
|
||||
@ -27,7 +27,7 @@ ms.reviewer:
|
||||
## Provisioning
|
||||
The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**.
|
||||
|
||||
|
||||
|
||||
|
||||
The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Hybrid Windows Hello for Business key trust Settings
|
||||
description: Configuring Windows Hello for Business settings in hybrid key trust deployment.
|
||||
description: Begin the process of configuring your hybrid key trust environment for Windows Hello for Business. Start with your Active Directory configuration.
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Hello for Business Overview (Windows 10)
|
||||
ms.reviewer: An overview of Windows Hello for Business
|
||||
description: An overview of Windows Hello for Business
|
||||
description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices in Windows 10.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Planning a Windows Hello for Business Deployment
|
||||
description: A guide to planning a Windows Hello for Business deployment
|
||||
description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure.
|
||||
keywords: identity, PIN, biometric, Hello, passport
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Hello for Business Videos
|
||||
description: Windows Hello for Business Videos
|
||||
description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10.
|
||||
keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Passwordless Strategy
|
||||
description: Reducing Password Usage Surface
|
||||
description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10.
|
||||
keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10)
|
||||
description: Explains how to secure VPN connections for Diffie Hellman Group 2
|
||||
description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN authentication options (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN auto-triggered profile options (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about the types of auto-trigger rules for VPNs in Windows 10, which start a VPN when it is needed to access a resource.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
@ -61,13 +61,15 @@ When the trigger occurs, VPN tries to connect. If an error occurs or any user in
|
||||
|
||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers.
|
||||
|
||||
Preserving user Always On preference
|
||||
## Preserving user Always On preference
|
||||
|
||||
Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList.
|
||||
Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference.
|
||||
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
|
||||
Value: AutoTriggerDisabledProfilesList
|
||||
Type: REG_MULTI_SZ
|
||||
Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**.
|
||||
|
||||
Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference.
|
||||
|
||||
**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config<br/>
|
||||
**Value:** AutoTriggerDisabledProfilesList<br/>
|
||||
**Type:** REG_MULTI_SZ
|
||||
|
||||
|
||||
## Trusted network detection
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows 10 VPN technical guide (Windows 10)
|
||||
description: Use this guide to configure VPN deployment for Windows 10.
|
||||
description: Learn about decisions to make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN name resolution (Windows 10)
|
||||
description: tbd
|
||||
description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN routing decisions (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN security features (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -21,6 +21,7 @@ ms.custom: bitlocker
|
||||
# BitLocker basic deployment
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.
|
||||
@ -31,8 +32,9 @@ BitLocker provides full volume encryption (FVE) for operating system volumes, as
|
||||
|
||||
In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes.
|
||||
|
||||
> **Note:** For more info about using this tool, see [Bdehdcfg](https://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference.
|
||||
|
||||
> [!NOTE]
|
||||
> For more info about using this tool, see [Bdehdcfg](/windows-server/administration/windows-commands/bdehdcfg) in the Command-Line Reference.
|
||||
|
||||
BitLocker encryption can be done using the following methods:
|
||||
|
||||
- BitLocker control panel
|
||||
@ -48,52 +50,16 @@ To start encryption for a volume, select **Turn on BitLocker** for the appropria
|
||||
### Operating system volume
|
||||
|
||||
Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets the BitLocker system requirements for encrypting an operating system volume. By default, the system requirements are:
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Requirement</th>
|
||||
<th align="left">Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Hardware configuration</p></td>
|
||||
<td align="left"><p>The computer must meet the minimum requirements for the supported Windows versions.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Operating system</p></td>
|
||||
<td align="left"><p>BitLocker is an optional feature which can be installed by Server Manager on Windows Server 2012 and later.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Hardware TPM</p></td>
|
||||
<td align="left"><p>TPM version 1.2 or 2.0</p>
|
||||
<p>A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>BIOS configuration</p></td>
|
||||
<td align="left"><ul>
|
||||
<li><p>A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.</p></li>
|
||||
<li><p>The boot order must be set to start first from the hard disk, and not the USB or CD drives.</p></li>
|
||||
<li><p>The firmware must be able to read from a USB flash drive during startup.</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>File system</p></td>
|
||||
<td align="left"><p>For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive.</p>
|
||||
<p>For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive.</p>
|
||||
<p>For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Hardware encrypted drive prerequisites (optional)</p></td>
|
||||
<td align="left"><p>To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Requirement|Description|
|
||||
|--- |--- |
|
||||
|Hardware configuration|The computer must meet the minimum requirements for the supported Windows versions.|
|
||||
|Operating system|BitLocker is an optional feature which can be installed by Server Manager on Windows Server 2012 and later.|
|
||||
|Hardware TPM|TPM version 1.2 or 2.0. <p> A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.|
|
||||
|BIOS configuration|<li> A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.</li> <li> The boot order must be set to start first from the hard disk, and not the USB or CD drives.</li> <li> The firmware must be able to read from a USB flash drive during startup.</li>|
|
||||
|File system|For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive. <br/> For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive. <br/> For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.|
|
||||
|Hardware encrypted drive prerequisites (optional)|To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.|
|
||||
|
||||
Upon passing the initial configuration, users are required to enter a password for the volume. If the volume does not pass the initial configuration for BitLocker, the user is presented with an error dialog describing the appropriate actions to be taken.
|
||||
Once a strong password has been created for the volume, a recovery key will be generated. The BitLocker Drive Encryption Wizard will prompt for a location to save this key. A BitLocker recovery key is a special key that you can create when you turn on BitLocker Drive Encryption for the first time on each drive that you encrypt. You can use the recovery key to gain access to your computer if the drive that Windows is installed on (the operating system drive) is encrypted using BitLocker Drive Encryption and BitLocker detects a condition that prevents it from unlocking the drive when the computer is starting up. A recovery key can also be used to gain access to your files and folders on a removable data drive (such as an external hard drive or USB flash drive) that is encrypted using BitLocker To Go, if for some reason you forget the password or your computer cannot access the drive.
|
||||
|
||||
@ -106,8 +72,9 @@ When the recovery key has been properly stored, the BitLocker Drive Encryption W
|
||||
|
||||
It is recommended that drives with little to no data utilize the **used disk space only** encryption option and that drives with data or an operating system utilize the **encrypt entire drive** option.
|
||||
|
||||
> **Note:** Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools.
|
||||
|
||||
> [!NOTE]
|
||||
> Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools.
|
||||
|
||||
Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. It is recommended to run this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows.
|
||||
|
||||
After completing the system check (if selected), the BitLocker Drive Encryption Wizard will restart the computer to begin encryption. Upon reboot, users are required to enter the password chosen to boot into the operating system volume. Users can check encryption status by checking the system notification area or the BitLocker control panel.
|
||||
@ -143,52 +110,20 @@ The following table shows the compatibility matrix for systems that have been Bi
|
||||
|
||||
Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Encryption Type</p></td>
|
||||
<td align="left"><p>Windows 10 and Windows 8.1</p></td>
|
||||
<td align="left"><p>Windows 8</p></td>
|
||||
<td align="left"><p>Windows 7</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Fully encrypted on Windows 8</p></td>
|
||||
<td align="left"><p>Presents as fully encrypted</p></td>
|
||||
<td align="left"><p>N/A</p></td>
|
||||
<td align="left"><p>Presented as fully encrypted</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Used Disk Space Only encrypted on Windows 8</p></td>
|
||||
<td align="left"><p>Presents as encrypt on write</p></td>
|
||||
<td align="left"><p>N/A</p></td>
|
||||
<td align="left"><p>Presented as fully encrypted</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Fully encrypted volume from Windows 7</p></td>
|
||||
<td align="left"><p>Presents as fully encrypted</p></td>
|
||||
<td align="left"><p>Presented as fully encrypted</p></td>
|
||||
<td align="left"><p>N/A</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Partially encrypted volume from Windows 7</p></td>
|
||||
<td align="left"><p>Windows 10 and Windows 8.1 will complete encryption regardless of policy</p></td>
|
||||
<td align="left"><p>Windows 8 will complete encryption regardless of policy</p></td>
|
||||
<td align="left"><p>N/A</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|||||
|
||||
|--- |--- |--- |--- |
|
||||
|Encryption Type|Windows 10 and Windows 8.1|Windows 8|Windows 7|
|
||||
|Fully encrypted on Windows 8|Presents as fully encrypted|N/A|Presented as fully encrypted|
|
||||
|Used Disk Space Only encrypted on Windows 8|Presents as encrypt on write|N/A|Presented as fully encrypted|
|
||||
|Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A|
|
||||
|Partially encrypted volume from Windows 7|Windows 10 and Windows 8.1 will complete encryption regardless of policy|Windows 8 will complete encryption regardless of policy|N/A|
|
||||
|
||||
## <a href="" id="bkmk-dep3"></a>Encrypting volumes using the manage-bde command line interface
|
||||
|
||||
Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx).
|
||||
Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
|
||||
|
||||
Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected.
|
||||
|
||||
Command line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes.
|
||||
|
||||
### Operating system volume
|
||||
@ -246,6 +181,7 @@ manage-bde -on C:
|
||||
## <a href="" id="bkmk-dep4"></a>Encrypting volumes using the BitLocker Windows PowerShell cmdlets
|
||||
|
||||
Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
@ -253,11 +189,11 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Name</b></p></td>
|
||||
<td align="left"><p><b>Parameters</b></p></td>
|
||||
<td align="left"><p><strong>Name</strong></p></td>
|
||||
<td align="left"><p><strong>Parameters</strong></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><b>Add-BitLockerKeyProtector</b></p></td>
|
||||
<td align="left"><p><strong>Add-BitLockerKeyProtector</strong></p></td>
|
||||
<td align="left"><p>-ADAccountOrGroup</p>
|
||||
<p>-ADAccountOrGroupProtector</p>
|
||||
<p>-Confirm</p>
|
||||
@ -279,26 +215,26 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Backup-BitLockerKeyProtector</b></p></td>
|
||||
<td align="left"><p><strong>Backup-BitLockerKeyProtector</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-KeyProtectorId</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><b>Disable-BitLocker</b></p></td>
|
||||
<td align="left"><p><strong>Disable-BitLocker</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Disable-BitLockerAutoUnlock</b></p></td>
|
||||
<td align="left"><p><strong>Disable-BitLockerAutoUnlock</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><b>Enable-BitLocker</b></p></td>
|
||||
<td align="left"><p><strong>Enable-BitLocker</strong></p></td>
|
||||
<td align="left"><p>-AdAccountOrGroup</p>
|
||||
<p>-AdAccountOrGroupProtector</p>
|
||||
<p>-Confirm</p>
|
||||
@ -323,44 +259,44 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Enable-BitLockerAutoUnlock</b></p></td>
|
||||
<td align="left"><p><strong>Enable-BitLockerAutoUnlock</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><b>Get-BitLockerVolume</b></p></td>
|
||||
<td align="left"><p><strong>Get-BitLockerVolume</strong></p></td>
|
||||
<td align="left"><p>-MountPoint</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Lock-BitLocker</b></p></td>
|
||||
<td align="left"><p><strong>Lock-BitLocker</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-ForceDismount</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><b>Remove-BitLockerKeyProtector</b></p></td>
|
||||
<td align="left"><p><strong>Remove-BitLockerKeyProtector</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-KeyProtectorId</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Resume-BitLocker</b></p></td>
|
||||
<td align="left"><p><strong>Resume-BitLocker</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><b>Suspend-BitLocker</b></p></td>
|
||||
<td align="left"><p><strong>Suspend-BitLocker</strong></p></td>
|
||||
<td align="left"><p>-Confirm</p>
|
||||
<p>-MountPoint</p>
|
||||
<p>-RebootCount</p>
|
||||
<p>-WhatIf</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><b>Unlock-BitLocker</b></p></td>
|
||||
<td align="left"><p><strong>Unlock-BitLocker</strong></p></td>
|
||||
<td align="left"><p>-AdAccountOrGroup</p>
|
||||
<p>-Confirm</p>
|
||||
<p>-MountPoint</p>
|
||||
@ -372,28 +308,38 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets.
|
||||
A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the <code>Get-BitLocker</code> volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information.
|
||||
Occasionally, all protectors may not be shown when using <b>Get-BitLockerVolume</b> due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors.
|
||||
|
||||
> **Note:** In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID.
|
||||
|
||||
`Get-BitLockerVolume C: | fl`
|
||||
Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets.
|
||||
|
||||
A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLocker` volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information.
|
||||
|
||||
Occasionally, all protectors may not be shown when using **Get-BitLockerVolume** due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors.
|
||||
|
||||
> [!NOTE]
|
||||
> In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID.
|
||||
|
||||
```powershell
|
||||
Get-BitLockerVolume C: | fl
|
||||
```
|
||||
|
||||
If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed.
|
||||
A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below:
|
||||
|
||||
```powershell
|
||||
$vol = Get-BitLockerVolume
|
||||
$keyprotectors = $vol.KeyProtector
|
||||
```
|
||||
|
||||
Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector.
|
||||
Using this information, we can then remove the key protector for a specific volume using the command:
|
||||
|
||||
```powershell
|
||||
Remove-BitLockerKeyProtector <volume>: -KeyProtectorID "{GUID}"
|
||||
```
|
||||
> **Note:** The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command.
|
||||
|
||||
### Operating system volume
|
||||
|
||||
Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell.
|
||||
@ -402,11 +348,13 @@ To enable BitLocker with just the TPM protector. This can be done using the comm
|
||||
```powershell
|
||||
Enable-BitLocker C:
|
||||
```
|
||||
|
||||
The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot.
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath <path> -SkipHardwareTest
|
||||
```
|
||||
|
||||
### Data volume
|
||||
|
||||
Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins.
|
||||
@ -416,33 +364,40 @@ $pw = Read-Host -AsSecureString
|
||||
<user inputs password>
|
||||
Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw
|
||||
```
|
||||
|
||||
### Using a SID based protector in Windows PowerShell
|
||||
|
||||
The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover and be unlocked to any member computer of the cluster.
|
||||
|
||||
>**Warning:** The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes.
|
||||
|
||||
> [!WARNING]
|
||||
> The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes.
|
||||
|
||||
To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G.
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator
|
||||
```
|
||||
|
||||
For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command:
|
||||
|
||||
```powershell
|
||||
get-aduser -filter {samaccountname -eq "administrator"}
|
||||
Get-ADUser -filter {samaccountname -eq "administrator"}
|
||||
```
|
||||
> **Note:** Use of this command requires the RSAT-AD-PowerShell feature.
|
||||
>
|
||||
|
||||
> [!NOTE]
|
||||
> Use of this command requires the RSAT-AD-PowerShell feature.
|
||||
>
|
||||
> **Tip:** In addition to the Windows PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features.
|
||||
|
||||
|
||||
In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command:
|
||||
|
||||
```powershell
|
||||
Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "<SID>"
|
||||
```
|
||||
> **Note:** Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes.
|
||||
|
||||
## <a href="" id="bkmk-dep5"></a> Checking BitLocker status
|
||||
|
||||
To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section.
|
||||
@ -457,7 +412,7 @@ Checking BitLocker status with the control panel is the most common method used
|
||||
| **Off**| BitLocker is not enabled for the volume |
|
||||
| **Suspended** | BitLocker is suspended and not actively protecting the volume |
|
||||
| **Waiting for Activation**| BitLocker is enabled with a clear protector key and requires further action to be fully protected|
|
||||
|
||||
|
||||
If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on the volume. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status.
|
||||
Using the control panel, administrators can choose **Turn on BitLocker** to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume (or password if no TPM exists), or a password or smart card protector to a data volume.
|
||||
The drive security window displays prior to changing the volume status. Selecting **Activate BitLocker** will complete the encryption process.
|
||||
@ -473,8 +428,10 @@ To check the status of a volume using manage-bde, use the following command:
|
||||
```powershell
|
||||
manage-bde -status <volume>
|
||||
```
|
||||
> **Note:** If no volume letter is associated with the -status command, all volumes on the computer display their status.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> If no volume letter is associated with the -status command, all volumes on the computer display their status.
|
||||
|
||||
### Checking BitLocker status with Windows PowerShell
|
||||
|
||||
Windows PowerShell commands offer another way to query BitLocker status for volumes. Like manage-bde, Windows PowerShell includes the advantage of being able to check the status of a volume on a remote computer.
|
||||
@ -484,6 +441,7 @@ Using the Get-BitLockerVolume cmdlet, each volume on the system will display its
|
||||
```powershell
|
||||
Get-BitLockerVolume <volume> -Verbose | fl
|
||||
```
|
||||
|
||||
This command will display information about the encryption method, volume type, key protectors, etc.
|
||||
|
||||
### Provisioning BitLocker during operating system deployment
|
||||
@ -510,11 +468,13 @@ Decrypting volumes using manage-bde is very straightforward. Decryption with man
|
||||
```powershell
|
||||
manage-bde -off C:
|
||||
```
|
||||
|
||||
This command disables protectors while it decrypts the volume and removes all protectors when decryption is complete. If a user wishes to check the status of the decryption, they can use the following command:
|
||||
|
||||
```powershell
|
||||
manage-bde -status C:
|
||||
```
|
||||
|
||||
### Decrypting volumes using the BitLocker Windows PowerShell cmdlets
|
||||
|
||||
Decryption with Windows PowerShell cmdlets is straightforward, similar to manage-bde. The additional advantage Windows PowerShell offers is the ability to decrypt multiple drives in one pass. In the example below, the user has three encrypted volumes, which they wish to decrypt.
|
||||
@ -524,16 +484,16 @@ Using the Disable-BitLocker command, they can remove all protectors and encrypti
|
||||
```powershell
|
||||
Disable-BitLocker
|
||||
```
|
||||
|
||||
If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is:
|
||||
|
||||
```powershell
|
||||
Disable-BitLocker -MountPoint E:,F:,G:
|
||||
```
|
||||
|
||||
## See also
|
||||
|
||||
- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)
|
||||
- [BitLocker recovery guide](bitlocker-recovery-guide-plan.md)
|
||||
- [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md)
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -95,7 +95,7 @@ The server side configuration to enable Network Unlock also requires provisionin
|
||||
|
||||
The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012.
|
||||
|
||||
### <a href="" id="bkmk-installwdsrole"/>Install the WDS Server role
|
||||
### <a href="" id="bkmk-installwdsrole"><a/>Install the WDS Server role
|
||||
|
||||
The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager.
|
||||
|
||||
@ -107,7 +107,7 @@ Install-WindowsFeature WDS-Deployment
|
||||
|
||||
You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard.
|
||||
|
||||
### <a href="" id="bkmk-confirmwdsrunning"/>Confirm the WDS Service is running
|
||||
### <a href="" id="bkmk-confirmwdsrunning"><a/>Confirm the WDS Service is running
|
||||
|
||||
To confirm the WDS service is running, use the Services Management Console or Windows PowerShell. To confirm the service is running in Services Management Console, open the console using **services.msc** and check the status of the Windows Deployment Services service.
|
||||
|
||||
@ -116,7 +116,7 @@ To confirm the service is running using Windows PowerShell, use the following co
|
||||
```powershell
|
||||
Get-Service WDSServer
|
||||
```
|
||||
### <a href="" id="bkmk-installnufeature"/>Install the Network Unlock feature
|
||||
### <a href="" id="bkmk-installnufeature"><a/>Install the Network Unlock feature
|
||||
|
||||
To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Server Manager, select the **BitLocker Network Unlock** feature in the Server Manager console.
|
||||
|
||||
@ -125,7 +125,7 @@ To install the feature using Windows PowerShell, use the following command:
|
||||
```powershell
|
||||
Install-WindowsFeature BitLocker-NetworkUnlock
|
||||
```
|
||||
### <a href="" id="bkmk-createcerttmpl"/>Create the certificate template for Network Unlock
|
||||
### <a href="" id="bkmk-createcerttmpl"><a/>Create the certificate template for Network Unlock
|
||||
|
||||
A properly configured Active Directory Services Certification Authority can use this certificate template to create and issue Network Unlock certificates.
|
||||
|
||||
@ -155,7 +155,7 @@ To add the Network Unlock template to the Certification Authority, open the Cert
|
||||
|
||||
After adding the Network Unlock template to the Certification Authority, this certificate can be used to configure BitLocker Network Unlock.
|
||||
|
||||
### <a href="" id="bkmk-createcert"/>Create the Network Unlock certificate
|
||||
### <a href="" id="bkmk-createcert"><a/>Create the Network Unlock certificate
|
||||
|
||||
Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate.
|
||||
|
||||
@ -218,7 +218,7 @@ Certreq example:
|
||||
|
||||
3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name:
|
||||
|
||||
``` syntax
|
||||
```cmd
|
||||
certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer
|
||||
```
|
||||
|
||||
@ -226,7 +226,7 @@ Certreq example:
|
||||
5. Launch Certificates - Local Machine by running **certlm.msc**.
|
||||
6. Create a .pfx file by opening the **Certificates – Local Computer\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file.
|
||||
|
||||
### <a href="" id="bkmk-deploycert"/>Deploy the private key and certificate to the WDS server
|
||||
### <a href="" id="bkmk-deploycert"><a/>Deploy the private key and certificate to the WDS server
|
||||
|
||||
With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following:
|
||||
|
||||
@ -281,6 +281,7 @@ SUBNET2=10.185.252.200/28
|
||||
SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet
|
||||
SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP.
|
||||
```
|
||||
|
||||
Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate.
|
||||
|
||||
> [!NOTE]
|
||||
@ -288,8 +289,9 @@ Following the \[SUBNETS\] section, there can be sections for each Network Unlock
|
||||
|
||||
Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section.
|
||||
Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon.
|
||||
|
||||
```ini
|
||||
[2158a767e1c14e88e27a4c0aee111d2de2eafe60]
|
||||
[2158a767e1c14e88e27a4c0aee111d2de2eafe60]
|
||||
;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on.
|
||||
;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out.
|
||||
SUBNET1
|
||||
@ -299,14 +301,14 @@ SUBNET3
|
||||
|
||||
To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED".
|
||||
|
||||
## <a href="" id="bkmk-turnoffnetworkunlock"/>Turning off Network Unlock
|
||||
## <a href="" id="bkmk-turnoffnetworkunlock"><a/>Turning off Network Unlock
|
||||
|
||||
To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain.
|
||||
|
||||
> [!NOTE]
|
||||
> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server.
|
||||
|
||||
## <a href="" id="bkmk-updatecerts"/>Update Network Unlock certificates
|
||||
## <a href="" id="bkmk-updatecerts"><a/>Update Network Unlock certificates
|
||||
|
||||
To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller.
|
||||
|
||||
@ -336,7 +338,7 @@ Files to gather when troubleshooting BitLocker Network Unlock include:
|
||||
|
||||
1. Start an elevated command prompt and run the following command:
|
||||
|
||||
``` syntax
|
||||
```cmd
|
||||
wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true
|
||||
```
|
||||
2. Open Event Viewer on the WDS server.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Management Recommendations for Enterprises (Windows 10)
|
||||
description: This topic explains recommendations for managing BitLocker.
|
||||
description: Refer to relevant documentation, products, and services to learn about managing BitLocker for enterprises and see recommendations for different computers.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -21,6 +21,7 @@ ms.custom: bitlocker
|
||||
# BitLocker recovery guide
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
This topic for IT professionals describes how to recover BitLocker keys from AD DS.
|
||||
@ -43,7 +44,7 @@ BitLocker recovery is the process by which you can restore access to a BitLocker
|
||||
|
||||
The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive:
|
||||
|
||||
- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](https://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](https://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout.
|
||||
- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout.
|
||||
- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised.
|
||||
- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD.
|
||||
- Failing to boot from a network drive before booting from the hard drive.
|
||||
@ -84,14 +85,14 @@ The following list provides examples of specific events that will cause BitLocke
|
||||
|
||||
> [!NOTE]
|
||||
> Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components.
|
||||
|
||||
|
||||
For planned scenarios, such as a known hardware or firmware upgrades, you can avoid initiating recovery by temporarily suspending BitLocker protection. Because suspending BitLocker leaves the drive fully encrypted, the administrator can quickly resume BitLocker protection after the planned task has been completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key.
|
||||
|
||||
> [!NOTE]
|
||||
> If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool.
|
||||
|
||||
If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method.
|
||||
|
||||
|
||||
Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user.
|
||||
|
||||
## <a href="" id="bkmk-testingrecovery"></a>Testing recovery
|
||||
@ -109,17 +110,16 @@ Before you create a thorough BitLocker recovery process, we recommend that you t
|
||||
|
||||
1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
`manage-bde. -ComputerName <RemoteComputerName> -forcerecovery <BitLockerVolume>`
|
||||
`manage-bde -ComputerName <RemoteComputerName> -forcerecovery <BitLockerVolume>`
|
||||
|
||||
> [!NOTE]
|
||||
> Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx).
|
||||
|
||||
|
||||
## <a href="" id="bkmk-planningrecovery"></a>Planning your recovery process
|
||||
|
||||
When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model.
|
||||
|
||||
Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker
|
||||
Administration and Monitoring](https://technet.microsoft.com/windows/hh826072.aspx).
|
||||
Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/mbam-v25/).
|
||||
|
||||
After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization.
|
||||
|
||||
@ -150,7 +150,7 @@ DS** check box if you want to prevent users from enabling BitLocker unless the c
|
||||
|
||||
> [!NOTE]
|
||||
> If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required.
|
||||
|
||||
|
||||
The BitLocker Recovery Password Viewer for Active Directory Users and Computers tool allows domain administrators to view BitLocker recovery passwords for specific computer objects in Active Directory.
|
||||
|
||||
You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool.
|
||||
@ -191,7 +191,7 @@ Because the recovery password is 48 digits long the user may need to record the
|
||||
|
||||
> [!NOTE]
|
||||
> Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-planningpostrecovery"></a>Post-recovery analysis
|
||||
|
||||
When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption
|
||||
@ -227,7 +227,7 @@ The details of this reset can vary according to the root cause of the recovery.
|
||||
|
||||
> [!NOTE]
|
||||
> You can perform a BitLocker validation profile reset by suspending and resuming BitLocker.
|
||||
|
||||
|
||||
- [Unknown PIN](#bkmk-unknownpin)
|
||||
- [Lost startup key](#bkmk-loststartup)
|
||||
- [Changes to boot files](#bkmk-changebootknown)
|
||||
@ -262,19 +262,18 @@ This error might occur if you updated the firmware. As a best practice you shoul
|
||||
|
||||
Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives.
|
||||
|
||||
|
||||
## BitLocker recovery screen
|
||||
|
||||
During BitLocker recovery, Windows can display a custom recovery message and hints that identify where a key can be retrieved from. These improvements can help a user during BitLocker recovery.
|
||||
|
||||
### Custom recovery message
|
||||
|
||||
BitLocker Group Policy settings in Windows 10, version 1511, let you confiure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support.
|
||||
BitLocker Group Policy settings in Windows 10, version 1511, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support.
|
||||
|
||||
This policy can be configured using GPO under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Configure pre-boot recovery message and URL**.
|
||||
|
||||
It can also be configured using Intune mobile device management (MDM) in the BitLocker CSP:
|
||||
*<LocURI>./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage</LocURI>*
|
||||
*\<LocURI>./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage\</LocURI>*
|
||||
|
||||
|
||||
|
||||
@ -282,30 +281,26 @@ Example of customized recovery screen:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### BitLocker recovery key hints
|
||||
|
||||
BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume’s recovery key. Hints are displayed on the recovery screen and refer to the location where key has been saved. Hints are displayed in both the modern (blue) and legacy (black) recovery screen. This applies to both the bootmanager recovery screen and the WinRE unlock screen.
|
||||
BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where key has been saved. Hints are displayed in both the modern (blue) and legacy (black) recovery screen. This applies to both the bootmanager recovery screen and the WinRE unlock screen.
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> We don't recommend printing recovery keys or saving them to a file. Instead, use Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and Microsoft Account.
|
||||
|
||||
|
||||
There are rules governing which hint is shown during the recovery (in order of processing):
|
||||
|
||||
1. Always display custom recovery message if it has been configured (using GPO or MDM).
|
||||
2. Always display generic hint: "For more information, go to https://aka.ms/recoverykeyfaq."
|
||||
2. Always display generic hint: "For more information, go to <https://aka.ms/recoverykeyfaq>".
|
||||
3. If multiple recovery keys exist on the volume, prioritize the last created (and successfully backed up) recovery key.
|
||||
4. Prioritize keys with successful backup over keys that have never been backed up.
|
||||
5. Prioritize backup hints in the following order for remote backup locations: **Microsoft Account > Azure AD > Active Directory**.
|
||||
6. If a key has been printed and saved to file, display a combined hint, “Look for a printout or a text file with the key,” instead of two separate hints.
|
||||
5. Prioritize backup hints in the following order for remote backup locations: **Microsoft Account > Azure AD > Active Directory**.
|
||||
6. If a key has been printed and saved to file, display a combined hint, "Look for a printout or a text file with the key," instead of two separate hints.
|
||||
7. If multiple backups of the same type (remove vs. local) have been performed for the same recovery key, prioritize backup info with latest backed up date.
|
||||
8. There is no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, “Contact your organization’s help desk,” will be displayed.
|
||||
9. If two recovery keys are present on the disk, but only one has been successfully backed up, the system will ask for a key that has been backed up, even if another key is newer.
|
||||
|
||||
8. There is no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, "Contact your organization's help desk," will be displayed.
|
||||
9. If two recovery keys are present on the disk, but only one has been successfully backed up, the system will ask for a key that has been backed up, even if another key is newer.
|
||||
|
||||
#### Example 1 (single recovery key with single backup)
|
||||
|
||||
@ -378,7 +373,6 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 5 (multiple recovery passwords)
|
||||
|
||||
| Custom URL | No |
|
||||
@ -408,7 +402,6 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
## <a href="" id="bkmk-usingaddrecovery"></a>Using additional recovery information
|
||||
|
||||
Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used.
|
||||
@ -419,7 +412,7 @@ If the recovery methods discussed earlier in this document do not unlock the vol
|
||||
|
||||
> [!NOTE]
|
||||
> You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package.
|
||||
|
||||
|
||||
The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc).
|
||||
|
||||
## <a href="" id="bkmk-appendixb"></a>Resetting recovery passwords
|
||||
@ -456,6 +449,7 @@ You can reset the recovery password in two ways:
|
||||
```powershell
|
||||
Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692}
|
||||
```
|
||||
|
||||
> [!WARNING]
|
||||
> You must include the braces in the ID string.
|
||||
|
||||
@ -471,7 +465,7 @@ You can reset the recovery password in two ways:
|
||||
|
||||
> [!NOTE]
|
||||
> To manage a remote computer, you can specify the remote computer name rather than the local computer name.
|
||||
|
||||
|
||||
You can use the following sample script to create a VBScript file to reset the recovery passwords.
|
||||
|
||||
```vb
|
||||
@ -891,5 +885,3 @@ End Function
|
||||
## See also
|
||||
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
|
||||
|
||||
|
||||
@ -28,11 +28,11 @@ Open Event Viewer and review the following logs under Applications and Services
|
||||
- Microsoft-Windows-BitLocker/BitLocker Operational
|
||||
- Microsoft-Windows-BitLocker/BitLocker Management
|
||||
|
||||
- **BitLocker-DrivePreparationTool**. Review the Admin log, the **Operational log, and any other logs that are generated in this folder. The default logs have the following unique names:
|
||||
- **BitLocker-DrivePreparationTool**. Review the Admin log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names:
|
||||
- Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
|
||||
- Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
|
||||
|
||||
Additionally, review the Windows logs\\System log for events that were produced by the TCM and TCM-WMI event sources.
|
||||
Additionally, review the Windows logs\\System log for events that were produced by the TPM and TPM-WMI event sources.
|
||||
|
||||
To filter and display or export logs, you can use the [wevtutil.exe](https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](https://docs.microsoft.com/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6) cmdlet.
|
||||
|
||||
|
||||
@ -84,11 +84,15 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if
|
||||
1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar.
|
||||
2. Check the value of **Kernel DMA Protection**.
|
||||
|
||||
3. If the current state of **Kernel DMA Protection** is OFF and **Virtualization Technology in Firmware** is NO:
|
||||
3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO:
|
||||
- Reboot into BIOS settings
|
||||
- Turn on Intel Virtualization Technology.
|
||||
- Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md).
|
||||
- Reboot system into Windows 10.
|
||||
|
||||
>[!NOTE]
|
||||
> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES.
|
||||
|
||||
4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature.
|
||||
|
||||
For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection.
|
||||
|
||||
@ -20,13 +20,18 @@
|
||||
### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md)
|
||||
### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md)
|
||||
|
||||
## [Migration guides]()
|
||||
### [Migrate from Symantec to Microsoft Defender ATP]()
|
||||
## [Migration guides](microsoft-defender-atp/migration-guides.md)
|
||||
### [Switch from McAfee to Microsoft Defender ATP]()
|
||||
#### [Get an overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md)
|
||||
#### [Prepare for your migration](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md)
|
||||
#### [Set up Microsoft Defender ATP](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md)
|
||||
#### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md)
|
||||
### [Switch from Symantec to Microsoft Defender ATP]()
|
||||
#### [Get an overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md)
|
||||
#### [Prepare for your migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md)
|
||||
#### [Set up Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md)
|
||||
#### [Onboard to Microsoft Defender ATP](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md)
|
||||
### [Manage Microsoft Defender ATP post migration]()
|
||||
### [Manage Microsoft Defender ATP after migration]()
|
||||
#### [Overview](microsoft-defender-atp/manage-atp-post-migration.md)
|
||||
#### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md)
|
||||
#### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md)
|
||||
@ -66,7 +71,8 @@
|
||||
##### [Application isolation]()
|
||||
###### [Application guard overview](microsoft-defender-application-guard/md-app-guard-overview.md)
|
||||
###### [System requirements](microsoft-defender-application-guard/reqs-md-app-guard.md)
|
||||
###### [Install Windows Defender Application Guard](microsoft-defender-application-guard/install-md-app-guard.md)
|
||||
###### [Install Microsoft Defender Application Guard](microsoft-defender-application-guard/install-md-app-guard.md)
|
||||
###### [Install Microsoft Defender Application Guard Extension](microsoft-defender-application-guard/md-app-guard-browser-extension.md)
|
||||
|
||||
##### [Application control](windows-defender-application-control/windows-defender-application-control.md)
|
||||
###### [Audit Application control policies](windows-defender-application-control/audit-windows-defender-application-control-policies.md)
|
||||
@ -76,7 +82,7 @@
|
||||
##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md)
|
||||
|
||||
#### [Device control]()
|
||||
##### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
|
||||
##### [Code integrity](device-guard/enable-virtualization-based-protection-of-code-integrity.md)
|
||||
##### [Control USB devices](device-control/control-usb-devices-using-intune.md)
|
||||
|
||||
|
||||
@ -86,7 +92,7 @@
|
||||
##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md)
|
||||
##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md)
|
||||
##### [Import, export, and deploy exploit protection configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md)
|
||||
|
||||
##### [Exploit protection reference](microsoft-defender-atp/exploit-protection-reference.md )
|
||||
|
||||
#### [Network protection]()
|
||||
##### [Protect your network](microsoft-defender-atp/network-protection.md)
|
||||
@ -338,7 +344,6 @@
|
||||
|
||||
#### [Reporting]()
|
||||
##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md)
|
||||
##### [Create and build Power BI reports using Microsoft Defender ATP data connectors (deprecated)](microsoft-defender-atp/powerbi-reports.md)
|
||||
##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md)
|
||||
#### [Device health and compliance reports](microsoft-defender-atp/machine-reports.md)
|
||||
|
||||
@ -431,8 +436,6 @@
|
||||
#### [General]()
|
||||
##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md)
|
||||
##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md)
|
||||
##### [Configure advanced features](microsoft-defender-atp/advanced-features.md)
|
||||
|
||||
#### [Permissions]()
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Appendix A, Security monitoring recommendations for many audit events (Windows 10)
|
||||
description: Appendix A, Security monitoring recommendations for many audit events
|
||||
description: Learn about recommendations for the type of monitoring required for certain classes of security audit events.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other Privilege Use Events (Windows 10)
|
||||
description: This security policy setting is not used.
|
||||
description: Learn about the audit other privilege use events, an auditing subcategory that should not have any events in it but enables generation of event 4985(S).
|
||||
ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Basic security audit policies (Windows 10)
|
||||
description: Before you implement auditing, you must decide on an auditing policy.
|
||||
description: Learn about basic security audit policies that specify the categories of security-related events that you want to audit for the needs of your organization.
|
||||
ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4608(S) Windows is starting up. (Windows 10)
|
||||
description: Describes security event 4608(S) Windows is starting up.
|
||||
description: Describes security event 4608(S) Windows is starting up. This event is logged when the LSASS.EXE process starts and the auditing subsystem is initialized.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.author: dansimp
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4608.png" alt="Event 4608 illustration" width="449" height="317" hspace="10" align="left" />
|
||||
<img src="images/event-4608.png" alt="Event 4608 illustration" width="449" height="317" hspace="10" align="top" />
|
||||
|
||||
***Subcategory:*** [Audit Security State Change](audit-security-state-change.md)
|
||||
|
||||
@ -30,12 +30,13 @@ This event is logged when LSASS.EXE process starts and the auditing subsystem is
|
||||
|
||||
It typically generates during operating system startup process.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4615(S) Invalid use of LPC port. (Windows 10)
|
||||
description: Describes security event 4615(S) Invalid use of LPC port.
|
||||
description: Describes security event 4615(S) Invalid use of LPC port. It appears that the Invalid use of LPC port event never occurs.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4616(S) The system time was changed. (Windows 10)
|
||||
description: Describes security event 4616(S) The system time was changed.
|
||||
description: Describes security event 4616(S) The system time was changed. This event is generated every time system time is changed.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.author: dansimp
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4616.png" alt="Event 4616 illustration" width="522" height="518" hspace="10" align="left" />
|
||||
<img src="images/event-4616.png" alt="Event 4616 illustration" width="522" height="518" hspace="10" align="top" />
|
||||
|
||||
***Subcategory:*** [Audit Security State Change](audit-security-state-change.md)
|
||||
|
||||
@ -32,12 +32,13 @@ This event is always logged regardless of the "Audit Security State Change" sub-
|
||||
|
||||
You will typically see these events with “**Subject\\Security ID**” = “**LOCAL SERVICE**”, these are normal time correction actions.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
@ -87,7 +88,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “change system time” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “change system time” operation.
|
||||
|
||||
@ -161,7 +163,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L
|
||||
|
||||
For 4616(S): The system time was changed.
|
||||
|
||||
> **Important** For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
> [!IMPORTANT]
|
||||
> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
|
||||
- Report all “**Subject\\Security ID**” not equals **“LOCAL SERVICE”**, which means that the time change was not made not by Windows Time service.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4625(F) An account failed to log on. (Windows 10)
|
||||
description: Describes security event 4625(F) An account failed to log on.
|
||||
description: Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -20,7 +20,7 @@ ms.author: dansimp
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
<img src="images/event-4625.png" alt="Event 4625 illustration" width="449" height="780" hspace="10" align="left" />
|
||||
<img src="images/event-4625.png" alt="Event 4625 illustration" width="449" height="780" hspace="10" align="top" />
|
||||
|
||||
***Subcategories:*** [Audit Account Lockout](audit-account-lockout.md) and [Audit Logon](audit-logon.md)
|
||||
|
||||
@ -32,12 +32,13 @@ It generates on the computer where logon attempt was made, for example, if logon
|
||||
|
||||
This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
> **Note** For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
> [!NOTE]
|
||||
> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
|
||||
|
||||
<br clear="all">
|
||||
|
||||
***Event XML:***
|
||||
```
|
||||
```xml
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
@ -93,7 +94,8 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that reported information about logon failure. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about logon failure.
|
||||
|
||||
@ -109,27 +111,30 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
|
||||
**Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field.
|
||||
- **Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field.
|
||||
|
||||
| <span id="Windows_Logon_Types" class="anchor"></span>Logon Type | Logon Title | Description |
|
||||
|-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 2 | Interactive | A user logged on to this computer. |
|
||||
| 3 | Network | A user or computer logged on to this computer from the network. |
|
||||
| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |
|
||||
| 5 | Service | A service was started by the Service Control Manager. |
|
||||
| 7 | Unlock | This workstation was unlocked. |
|
||||
| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |
|
||||
| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |
|
||||
| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |
|
||||
| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |
|
||||
|
||||
> <span id="_Ref433822321" class="anchor"></span>Table: Windows Logon Types
|
||||
<span id="_Ref433822321" class="anchor"></span>**Table 11: Windows Logon Types**
|
||||
|
||||
| <span id="Windows_Logon_Types" class="anchor"></span>Logon Type | Logon Title | Description |
|
||||
|-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 2 | Interactive | A user logged on to this computer. |
|
||||
| 3 | Network | A user or computer logged on to this computer from the network. |
|
||||
| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |
|
||||
| 5 | Service | A service was started by the Service Control Manager. |
|
||||
| 7 | Unlock | This workstation was unlocked. |
|
||||
| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |
|
||||
| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |
|
||||
| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. |
|
||||
| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |
|
||||
|
||||
|
||||
**Account For Which Logon Failed:**
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of the account that was specified in the logon attempt. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
> [!NOTE]
|
||||
> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that was specified in the logon attempt.
|
||||
|
||||
@ -151,35 +156,36 @@ This event generates on domain controllers, member servers, and workstations.
|
||||
|
||||
- **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event it typically has “**Account locked out**” value.
|
||||
|
||||
- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event it typically has “**0xC0000234**” value. The most common status codes are listed in “Table 12. Windows logon status codes.”
|
||||
- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event it typically has “**0xC0000234**” value. The most common status codes are listed in Table 12. Windows logon status codes.
|
||||
|
||||
| Status\\Sub-Status Code | Description |
|
||||
|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 0XC000005E | There are currently no logon servers available to service the logon request. |
|
||||
| 0xC0000064 | User logon with misspelled or bad user account |
|
||||
| 0xC000006A | User logon with misspelled or bad password |
|
||||
| 0XC000006D | This is either due to a bad username or authentication information |
|
||||
| 0XC000006E | Unknown user name or bad password. |
|
||||
| 0xC000006F | User logon outside authorized hours |
|
||||
| 0xC0000070 | User logon from unauthorized workstation |
|
||||
| 0xC0000071 | User logon with expired password |
|
||||
| 0xC0000072 | User logon to account disabled by administrator |
|
||||
| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |
|
||||
| 0XC0000133 | Clocks between DC and other computer too far out of sync |
|
||||
| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |
|
||||
| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |
|
||||
| 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. |
|
||||
| 0xC0000193 | User logon with expired account |
|
||||
| 0XC0000224 | User is required to change password at next logon |
|
||||
| 0XC0000225 | Evidently a bug in Windows and not a risk |
|
||||
| 0xC0000234 | User logon with account locked |
|
||||
| 0XC00002EE | Failure Reason: An Error occurred during Logon |
|
||||
| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |
|
||||
| 0x0 | Status OK. |
|
||||
<span id="_Ref433822658" class="anchor"></span>**Table 12: Windows logon status codes.**
|
||||
|
||||
> <span id="_Ref433822658" class="anchor"></span>Table: Windows logon status codes.
|
||||
>
|
||||
> **Note** To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK.
|
||||
| Status\\Sub-Status Code | Description |
|
||||
|-------------------------|------------------------------------------------------------------------------------------------------|
|
||||
| 0XC000005E | There are currently no logon servers available to service the logon request. |
|
||||
| 0xC0000064 | User logon with misspelled or bad user account |
|
||||
| 0xC000006A | User logon with misspelled or bad password |
|
||||
| 0XC000006D | This is either due to a bad username or authentication information |
|
||||
| 0XC000006E | Unknown user name or bad password. |
|
||||
| 0xC000006F | User logon outside authorized hours |
|
||||
| 0xC0000070 | User logon from unauthorized workstation |
|
||||
| 0xC0000071 | User logon with expired password |
|
||||
| 0xC0000072 | User logon to account disabled by administrator |
|
||||
| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |
|
||||
| 0XC0000133 | Clocks between DC and other computer too far out of sync |
|
||||
| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine |
|
||||
| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |
|
||||
| 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. |
|
||||
| 0xC0000193 | User logon with expired account |
|
||||
| 0XC0000224 | User is required to change password at next logon |
|
||||
| 0XC0000225 | Evidently a bug in Windows and not a risk |
|
||||
| 0xC0000234 | User logon with account locked |
|
||||
| 0XC00002EE | Failure Reason: An Error occurred during Logon |
|
||||
| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. |
|
||||
| 0x0 | Status OK. |
|
||||
|
||||
> [!NOTE]
|
||||
> To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK.
|
||||
|
||||
More information: <https://dev.windows.com/en-us/downloads>
|
||||
|
||||
@ -187,7 +193,7 @@ More information: <https://dev.windows.com/en-us/downloads>
|
||||
|
||||
**Process Information:**
|
||||
|
||||
- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
|
||||
- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):<br/><br/>
|
||||
|
||||
<img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" />
|
||||
|
||||
@ -241,7 +247,8 @@ More information: <https://dev.windows.com/en-us/downloads>
|
||||
|
||||
For 4625(F): An account failed to log on.
|
||||
|
||||
> **Important** For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
> [!IMPORTANT]
|
||||
> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md).
|
||||
|
||||
- If you have a pre-defined “**Process Name**” for the process reported in this event, monitor all events with “**Process Name**” not equal to your defined value.
|
||||
|
||||
@ -277,17 +284,17 @@ For 4625(F): An account failed to log on.
|
||||
|
||||
- Monitor for all events with the fields and values in the following table:
|
||||
|
||||
| **Field** | Value to monitor for |
|
||||
|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.” <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”. <br>Especially if you get a number of these in a row, it can be a sign of user enumeration attack. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”. <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. |
|
||||
| **Field** | Value to monitor for |
|
||||
|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.” <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”. <br>Especially if you get a number of these in a row, it can be a sign of user enumeration attack. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts. <br>Especially watch for a number of such events in a row. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”. <br>This is typically not a security issue but it can be an infrastructure or availability issue. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. |
|
||||
| **Failure Information\\Status** or <br>**Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. |
|
||||
|
||||
|
||||
@ -81,29 +81,29 @@ This event generates every time a new process starts.
|
||||
|
||||
- 1 - Windows Server 2012 R2, Windows 8.1.
|
||||
|
||||
- Added “Process Command Line” field.
|
||||
- Added "Process Command Line" field.
|
||||
|
||||
- 2 - Windows 10.
|
||||
|
||||
- **Subject** renamed to **Creator Subject**.
|
||||
|
||||
- Added “**Target Subject**” section.
|
||||
- Added "**Target Subject**" section.
|
||||
|
||||
- Added “**Mandatory Label**” field.
|
||||
- Added "**Mandatory Label**" field.
|
||||
|
||||
- Added “**Creator Process Name**” field.
|
||||
- Added "**Creator Process Name**" field.
|
||||
|
||||
***Field Descriptions:***
|
||||
|
||||
**Creator Subject** \[Value for versions 0 and 1 – **Subject**\]**:**
|
||||
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the “create process” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
- **Security ID** \[Type = SID\]**:** SID of account that requested the "create process" operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
|
||||
|
||||
> **Note** A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers).
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “create process” operation.
|
||||
- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the "create process" operation.
|
||||
|
||||
- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following:
|
||||
- **Account Domain** \[Type = UnicodeString\]**:** subject's domain or computer name. Formats vary, and include the following:
|
||||
|
||||
- Domain NETBIOS name example: CONTOSO
|
||||
|
||||
@ -111,11 +111,11 @@ This event generates every time a new process starts.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY".
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81".
|
||||
|
||||
- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.”
|
||||
- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on."
|
||||
|
||||
**Target Subject** \[Version 2\]**:**
|
||||
|
||||
@ -127,7 +127,7 @@ This event generates every time a new process starts.
|
||||
|
||||
- **Account Name** \[Type = UnicodeString\] \[Version 2\]**:** the name of the target account.
|
||||
|
||||
- **Account Domain** \[Type = UnicodeString\] \[Version 2\]**:** target account’s domain or computer name. Formats vary, and include the following:
|
||||
- **Account Domain** \[Type = UnicodeString\] \[Version 2\]**:** target account's domain or computer name. Formats vary, and include the following:
|
||||
|
||||
- Domain NETBIOS name example: CONTOSO
|
||||
|
||||
@ -135,11 +135,11 @@ This event generates every time a new process starts.
|
||||
|
||||
- Uppercase full domain name: CONTOSO.LOCAL
|
||||
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
|
||||
- For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY".
|
||||
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
|
||||
- For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81".
|
||||
|
||||
- **Logon ID** \[Type = HexInt64\] \[Version 2\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.”
|
||||
- **Logon ID** \[Type = HexInt64\] \[Version 2\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on."
|
||||
|
||||
**Process Information:**
|
||||
|
||||
@ -173,11 +173,11 @@ This event generates every time a new process starts.
|
||||
|
||||
- **Creator Process ID** \[Type = Pointer\]**:** hexadecimal Process ID of the process which ran the new process. If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager.
|
||||
|
||||
> You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**.
|
||||
> You can also correlate this process ID with a process ID in other events, for example, "[4688](event-4688.md): A new process has been created" **Process Information\\New Process ID**.
|
||||
|
||||
- **Creator Process Name** \[Version 2\] \[Type = UnicodeString\]**:** full path and the name of the executable for the process.
|
||||
|
||||
- **Process Command Line** \[Version 1, 2\] \[Type = UnicodeString\]**:** contains the name of executable and arguments which were passed to it. You must enable “Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events” group policy to include command line in process creation events:
|
||||
- **Process Command Line** \[Version 1, 2\] \[Type = UnicodeString\]**:** contains the name of executable and arguments which were passed to it. You must enable "Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events" group policy to include command line in process creation events:
|
||||
|
||||
<img src="images/group-policy.png" alt="Group policy illustration" width="490" height="448" />
|
||||
|
||||
@ -189,28 +189,27 @@ For 4688(S): A new process has been created.
|
||||
|
||||
| **Type of monitoring required** | **Recommendation** |
|
||||
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.<br>Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that corresponds to the high-value account or accounts. |
|
||||
| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. |
|
||||
| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that corresponds to the accounts that should never be used. |
|
||||
| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Creator Subject\\Security ID”** and **“Target Subject\\Security ID”** for accounts that are outside the allow list. |
|
||||
| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** to see whether the account type is as expected. |
|
||||
| **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** corresponding to accounts from another domain or “external” accounts. |
|
||||
| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that you are concerned about. |
|
||||
| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** for names that don’t comply with naming conventions. |
|
||||
| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.<br>Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the high-value account or accounts. |
|
||||
| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** (with other information) to monitor how or when a particular account is being used. |
|
||||
| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the accounts that should never be used. |
|
||||
| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "whitelist-only" action, review the **"Creator Subject\\Security ID"** and **"Target Subject\\Security ID"** for accounts that are outside the allow list. |
|
||||
| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** to see whether the account type is as expected. |
|
||||
| **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** corresponding to accounts from another domain or "external" accounts. |
|
||||
| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that you are concerned about. |
|
||||
| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** for names that don't comply with naming conventions. |
|
||||
|
||||
- If you have a pre-defined “**New** **Process Name**” or **“Creator Process Name**” for the process reported in this event, monitor all events with “**New** **Process Name**” or **“Creator Process Name**” not equal to your defined value.
|
||||
- If you have a pre-defined "**New** **Process Name**" or **"Creator Process Name**" for the process reported in this event, monitor all events with "**New** **Process Name**" or **"Creator Process Name**" not equal to your defined value.
|
||||
|
||||
- You can monitor to see if “**New** **Process Name**” or **“Creator Process Name**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**).
|
||||
- You can monitor to see if "**New** **Process Name**" or **"Creator Process Name**" is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**).
|
||||
|
||||
- If you have a pre-defined list of restricted substrings or words in process names (for example “**mimikatz**” or “**cain.exe**”), check for these substrings in “**New** **Process Name**” or **“Creator Process Name**.”
|
||||
- If you have a pre-defined list of restricted substrings or words in process names (for example "**mimikatz**" or "**cain.exe**"), check for these substrings in "**New** **Process Name**" or **"Creator Process Name**."
|
||||
|
||||
- It can be unusual for a process to run using a local account in either **Creator Subject\\Security ID** or in **Target** **Subject\\Security ID**.
|
||||
|
||||
- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol<b>.</b> Typically this means that UAC is disabled for this account for some reason.
|
||||
- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn't contain the $ symbol. Typically this means that UAC is disabled for this account for some reason.
|
||||
|
||||
- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol<b>.</b> This means that a user ran a program using administrative privileges.
|
||||
- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn't contain the $ symbol. This means that a user ran a program using administrative privileges.
|
||||
|
||||
- You can also monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when a computer object was used to run the process, but that computer object is not the same computer where the event occurs.
|
||||
|
||||
- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the “**Mandatory Label**” in this event.
|
||||
|
||||
- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the "**Mandatory Label**" in this event.
|
||||
@ -135,7 +135,7 @@ Integrate Microsoft Defender Advanced Threat Protection into your existing workf
|
||||
- [API and SIEM integration](microsoft-defender-atp/configure-siem.md)
|
||||
- [Exposed APIs](microsoft-defender-atp/apis-intro.md)
|
||||
- [Role-based access control (RBAC)](microsoft-defender-atp/rbac.md)
|
||||
- [Reporting and trends](microsoft-defender-atp/powerbi-reports.md)
|
||||
- [Reporting and trends](microsoft-defender-atp/threat-protection-reports.md)
|
||||
|
||||
<a name="integration"></a>
|
||||
**[Integration with Microsoft solutions](microsoft-defender-atp/threat-protection-integration.md)** <br>
|
||||
|
||||
@ -38,6 +38,6 @@ Go to the [MVI program page](virus-initiative-criteria.md) for more information.
|
||||
|
||||
CME is open to organizations who are involved in cybersecurity and antimalware or interested in fighting cybercrime.
|
||||
|
||||
The program aims to bring organizations in cybersecurity and other industries together to pool tools, information and actions to drive coordinated campaigns against malware. The ultimate goal is to create efficient and long-lasting results for better protection of our collective communities, customers, and businesses.
|
||||
The program aims to bring organizations in cybersecurity and other industries together to pool tools, information, and actions to drive coordinated campaigns against malware. The ultimate goal is to create efficient and long-lasting results for better protection of our communities, customers, and businesses.
|
||||
|
||||
Go to the [CME program page](coordinated-malware-eradication.md) for more information.
|
||||
|
||||
@ -23,19 +23,19 @@ This page provides answers to common questions we receive from software develope
|
||||
|
||||
## Does Microsoft accept files for a known list or false-positive prevention program?
|
||||
|
||||
No. We do not accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list or, far less frequently, in adding your digital certificate to a list of trusted publishers.
|
||||
No. We don't accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list. Far less frequently, in will add your digital certificate to a list of trusted publishers.
|
||||
|
||||
## How do I dispute the detection of my program?
|
||||
|
||||
Submit the file in question as a software developer. Wait until your submission has a final determination.
|
||||
|
||||
If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We will use the information you provide to investigate further if necessary.
|
||||
If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We'll use the information you provide to investigate further if necessary.
|
||||
|
||||
We encourage all software vendors and developers to read about [how Microsoft identifies malware and Potentially Unwanted Applications (PUA)](criteria.md).
|
||||
|
||||
## Why is Microsoft asking for a copy of my program?
|
||||
|
||||
This can help us with our analysis. Participants of the [Microsoft Active Protection Service (MAPS)](https://www.microsoft.com/msrc/mapp) may occasionally receive these requests. The requests will stop once our systems have received and processed the file.
|
||||
Providing copies can help us with our analysis. Participants of the [Microsoft Active Protection Service (MAPS)](https://www.microsoft.com/msrc/mapp) may occasionally receive these requests. The requests will stop once our systems have received and processed the file.
|
||||
|
||||
## Why does Microsoft classify my installer as a software bundler?
|
||||
|
||||
@ -43,8 +43,8 @@ It contains instructions to offer a program classified as unwanted software. You
|
||||
|
||||
## Why is the Windows Defender Firewall blocking my program?
|
||||
|
||||
This is not related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security).
|
||||
Firewall blocks aren't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security).
|
||||
|
||||
## Why does the Microsoft Defender SmartScreen say my program is not commonly downloaded?
|
||||
## Why does the Microsoft Defender Windows Defender SmartScreen say my program isn't commonly downloaded?
|
||||
|
||||
This is not related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)
|
||||
This isn't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender Windows Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview)
|
||||
|
||||
@ -26,4 +26,4 @@ Learn about the common questions we receive from software developers and get oth
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Software developer FAQ](developer-faq.md) | Provides answers to common questions we receive from software developers.
|
||||
[Developer resources](developer-resources.md) | Provides information about how to submit files, detection criteria, and how to check your software against the latest security intelligence and cloud protection from Microsoft.
|
||||
[Developer resources](developer-resources.md) | Provides information about how to submit files and the detection criteria. Learn how to check your software against the latest security intelligence and cloud protection from Microsoft.
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Exploits and exploit kits
|
||||
ms.reviewer:
|
||||
description: Learn about how exploits use vulnerabilities in common software to give an attackers access to your computer and to install other malware.
|
||||
description: Learn about how exploits use vulnerabilities in common software to give attackers access to your computer and install other malware.
|
||||
keywords: security, malware, exploits, exploit kits, prevention, vulnerabilities, Microsoft, Exploit malware family, exploits, java, flash, adobe, update software, prevent exploits, exploit pack, vulnerability, 0-day, holes, weaknesses, attack, Flash, Adobe, out-of-date software, out of date software, update, update software, reinfection, Java cache, reinfected, won't remove, won't clean, still detects, full scan, MSE, Defender, WDSI, MMPC, Microsoft Malware Protection Center
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: secure
|
||||
@ -21,17 +21,17 @@ Exploits take advantage of vulnerabilities in software. A vulnerability is like
|
||||
|
||||
## How exploits and exploit kits work
|
||||
|
||||
Exploits are often the first part of a larger attack. Hackers scan for outdated systems that contain critical vulnerabilities, which they then exploit by deploying targeted malware. Exploits often include what's called "shellcode". This is a small malware payload that's used to download additional malware from attacker-controlled networks. This allows hackers to infect devices and infiltrate organizations.
|
||||
Exploits are often the first part of a larger attack. Hackers scan for outdated systems that contain critical vulnerabilities, which they then exploit by deploying targeted malware. Exploits often include shellcode, which is a small malware payload used to download additional malware from attacker-controlled networks. Shellcode allows hackers to infect devices and infiltrate organizations.
|
||||
|
||||
Exploit kits are more comprehensive tools that contain a collection of exploits. These kits scan devices for different kinds of software vulnerabilities and, if any are detected, deploys additional malware to further infect a device. Kits can use exploits targeting a variety of software, including Adobe Flash Player, Adobe Reader, Internet Explorer, Oracle Java and Sun Java.
|
||||
Exploit kits are more comprehensive tools that contain a collection of exploits. These kits scan devices for different kinds of software vulnerabilities and, if any are detected, deploy additional malware to further infect a device. Kits can use exploits targeting a variety of software, including Adobe Flash Player, Adobe Reader, Internet Explorer, Oracle Java, and Sun Java.
|
||||
|
||||
The most common method used by attackers to distribute exploits and exploit kits is through webpages, but exploits can also arrive in emails. Some websites unknowingly and unwillingly host malicious code and exploits in their ads.
|
||||
|
||||
The infographic below shows how an exploit kit might attempt to exploit a device when a compromised webpage is visited.
|
||||
The infographic below shows how an exploit kit might attempt to exploit a device after you visit a compromised webpage.
|
||||
|
||||
|
||||
|
||||
|
||||
*Figure 1. Example of how exploit kits work*
|
||||
*Figure 1. Example of how to exploit kits work*
|
||||
|
||||
Several notable threats, including Wannacry, exploit the Server Message Block (SMB) vulnerability CVE-2017-0144 to launch malware.
|
||||
|
||||
@ -56,6 +56,6 @@ You can read more on the [CVE website](https://cve.mitre.org/).
|
||||
|
||||
## How to protect against exploits
|
||||
|
||||
The best prevention for exploits is to keep your organization's [software up to date](https://portal.msrc.microsoft.com/). Software vendors provide updates for many known vulnerabilities and making sure these updates are applied to all devices is an important step to prevent malware.
|
||||
The best prevention for exploits is to keep your organization's [software up to date](https://portal.msrc.microsoft.com/). Software vendors provide updates for many known vulnerabilities, so make sure these updates are applied to all devices.
|
||||
|
||||
For more general tips, see [prevent malware infection](prevent-malware-infection.md).
|
||||
|
||||
@ -18,9 +18,9 @@ search.appverid: met150
|
||||
|
||||
# Fileless threats
|
||||
|
||||
What exactly are fileless threats? The term "fileless" suggests that a threat does not come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no generally accepted definition for fileless malware. The term is used broadly; it's also used to describe malware families that do rely on files to operate.
|
||||
What exactly are fileless threats? The term "fileless" suggests that a threat doesn't come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no one definition for fileless malware. The term is used broadly, and sometimes to describe malware families that do rely on files to operate.
|
||||
|
||||
Given that attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, or information theft, some parts of the attack chain may be fileless, while others may involve the filesystem in some form.
|
||||
Attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, or information theft. Some parts of the attack chain may be fileless, while others may involve the file system in some form.
|
||||
|
||||
For clarity, fileless threats are grouped into different categories.
|
||||
|
||||
@ -29,42 +29,42 @@ For clarity, fileless threats are grouped into different categories.
|
||||
|
||||
Fileless threats can be classified by their entry point, which indicates how fileless malware can arrive on a machine. They can arrive via an exploit, through compromised hardware, or via regular execution of applications and scripts.
|
||||
|
||||
Next, list the form of entry point. For example, exploits can be based on files or network data, PCI peripherals are a type of hardware vector, and scripts and executables are sub-categories of the execution vector.
|
||||
Next, list the form of entry point. For example, exploits can be based on files or network data, PCI peripherals are a type of hardware vector, and scripts and executables are subcategories of the execution vector.
|
||||
|
||||
Finally, classify the host of the infection. For example, a Flash application that may contain an exploit, a simple executable, malicious firmware from a hardware device, or an infected MBR, which could bootstrap the execution of a malware before the operating system even loads.
|
||||
Finally, classify the host of the infection. For example, a Flash application may contain a variety of threats such as an exploit, a simple executable, and malicious firmware from a hardware device.
|
||||
|
||||
This helps you divide and categorize the various kinds of fileless threats. Clearly, the categories are not all the same: some are more dangerous but also more difficult to implement, while others are more commonly used despite (or precisely because of) not being very advanced.
|
||||
Classifying helps you divide and categorize the various kinds of fileless threats. Some are more dangerous but also more difficult to implement, while others are more commonly used despite (or precisely because of) not being very advanced.
|
||||
|
||||
From this categorization, you can glean three main types of fileless threats based on how much fingerprint they may leave on infected machines.
|
||||
|
||||
## Type I: No file activity performed
|
||||
|
||||
A completely fileless malware can be considered one that never requires writing a file on the disk. How would such malware infect a machine in the first place? An example scenario could be a target machine receiving malicious network packets that exploit the EternalBlue vulnerability, leading to the installation of the DoublePulsar backdoor, which ends up residing only in the kernel memory. In this case, there is no file or any data written on a file.
|
||||
A fully fileless malware can be considered one that never requires writing a file on the disk. How would such malware infect a machine in the first place? One example is where a target machine receives malicious network packets that exploit the EternalBlue vulnerability. The vulnerability allows the installation of the DoublePulsar backdoor, which ends up residing only in the kernel memory. In this case, there's no file or any data written on a file.
|
||||
|
||||
Another scenario could involve compromised devices, where malicious code could be hiding in device firmware (such as a BIOS), a USB peripheral (like the BadUSB attack), or even in the firmware of a network card. All these examples do not require a file on the disk to run and can theoretically live only in memory, surviving even reboots, disk reformats, and OS reinstalls.
|
||||
A compromised device may also have malicious code hiding in device firmware (such as a BIOS), a USB peripheral (like the BadUSB attack), or in the firmware of a network card. All these examples don't require a file on the disk to run, and can theoretically live only in memory. The malicious code would survive reboots, disk reformats, and OS reinstalls.
|
||||
|
||||
Infections of this type can be extra difficult to detect and remediate. Antivirus products usually don’t have the capability to access firmware for inspection; even if they did, it would be extremely challenging to detect and remediate threats at this level. Because this type of fileless malware requires high levels of sophistication and often depend on particular hardware or software configuration, it’s not an attack vector that can be exploited easily and reliably. For this reason, while extremely dangerous, threats of this type tend to be very uncommon and not practical for most attacks.
|
||||
Infections of this type can be extra difficult deal with because antivirus products usually don’t have the capability to inspect firmware. Even if they did, it would be extremely challenging to detect and remediate threats at this level. This type of fileless malware requires high levels of sophistication and often depends on particular hardware or software configuration. It’s not an attack vector that can be exploited easily and reliably. While dangerous, threats of this type are uncommon and not practical for most attacks.
|
||||
|
||||
## Type II: Indirect file activity
|
||||
|
||||
There are other ways that malware can achieve fileless presence on a machine without requiring significant engineering effort. Fileless malware of this type doesn't directly write files on the file system, but they can end up using files indirectly. This is the case for [Poshspy backdoor](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html). Attackers installed a malicious PowerShell command within the WMI repository and configured a WMI filter to run such command periodically.
|
||||
There are other ways that malware can achieve fileless presence on a machine without requiring significant engineering effort. Fileless malware of this type doesn't directly write files on the file system, but they can end up using files indirectly. For example, with the [Poshspy backdoor](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html) attackers installed a malicious PowerShell command within the WMI repository and configured a WMI filter to run the command periodically.
|
||||
|
||||
It’s possible to carry out such installation via command line without requiring the presence of the backdoor to be on a file in the first place. The malware can thus be installed and theoretically run without ever touching the file system. However, the WMI repository is stored on a physical file that is a central storage area managed by the CIM Object Manager and usually contains legitimate data. Therefore, while the infection chain does technically use a physical file, for practical purposes it’s considered a fileless attack given that the WMI repository is a multi-purpose data container that cannot be simply detected and removed.
|
||||
It’s possible to carry out such installation via command line without requiring a backdoor to already be on the file. The malware can be installed and theoretically run without ever touching the file system. However, the WMI repository is stored on a physical file in a central storage area managed by the CIM Object Manager, and usually contains legitimate data. Even though the infection chain does technically use a physical file, it’s considered a fileless attack because the WMI repository is a multi-purpose data container that can't be detected and removed.
|
||||
|
||||
## Type III: Files required to operate
|
||||
|
||||
Some malware can have some sort of fileless persistence but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. This action means that opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe.
|
||||
Some malware can have a sort of fileless persistence, but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. Opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe.
|
||||
|
||||
<br>
|
||||
*Figure 2. Kovter’s registry key*
|
||||
|
||||
When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an auto-run key configured to open such file when the machine starts.
|
||||
When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an autorun key configured to open such file when the machine starts.
|
||||
|
||||
Kovter is considered a fileless threat because the file system is of no practical use: the files with random extension contain junk data that is not usable in verifying the presence of the threat, and the files that store the registry are containers that cannot be detected and deleted if malicious content is present.
|
||||
Kovter is considered a fileless threat because the file system is of no practical use. The files with random extensions contain junk data that isn't usable in verifying the presence of the threat. The files that store the registry are containers that can't be detected and deleted if malicious content is present.
|
||||
|
||||
## Categorizing fileless threats by infection host
|
||||
|
||||
Having described the broad categories, we can now dig into the details and provide a breakdown of the infection hosts. This comprehensive classification covers the panorama of what is usually referred to as fileless malware. It drives our efforts to research and develop new protection features that neutralize classes of attacks and ensure malware does not get the upper hand in the arms race.
|
||||
Having described the broad categories, we can now dig into the details and provide a breakdown of the infection hosts. This comprehensive classification covers the panorama of what is usually referred to as fileless malware. It drives our efforts to research and develop new protection features that neutralize classes of attacks and ensure malware doesn't get the upper hand in the arms race.
|
||||
|
||||
### Exploits
|
||||
|
||||
@ -76,26 +76,28 @@ Having described the broad categories, we can now dig into the details and provi
|
||||
|
||||
**Device-based** (Type I: network card, hard disk): Devices like hard disks and network cards require chipsets and dedicated software to function. Software residing and running in the chipset of a device is called firmware. Although a complex task, the firmware can be infected by malware, as the [Equation espionage group has been caught doing](https://www.kaspersky.com/blog/equation-hdd-malware/7623/).
|
||||
|
||||
**CPU-based** (Type I): Modern CPUs are extremely complex and may include subsystems running firmware for management purposes. Such firmware may be vulnerable to hijacking and allow the execution of malicious code that would hence operate from within the CPU. In December 2017, two researchers reported a vulnerability that can allow attackers to execute code inside the [Management Engine (ME)](https://en.wikipedia.org/wiki/Intel_Management_Engine) present in any modern CPU from Intel. Meanwhile, the attacker group PLATINUM has been observed to have the capability to use Intel's [Active Management Technology (AMT)](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) to perform [invisible network communications](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/) bypassing the installed operating system. ME and AMT are essentially autonomous micro-computers that live inside the CPU and that operate at a very low level. Because these technologies’ purpose is to provide remote manageability, they have direct access to hardware, are independent of the operating system, and can run even if the computer is turned off. Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.emsec.rub.de/media/crypto/veroeffentlichungen/2015/03/19/beckerStealthyExtended.pdf) in the past. Just recently it has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution.
|
||||
**CPU-based** (Type I): Modern CPUs are complex and may include subsystems running firmware for management purposes. Such firmware may be vulnerable to hijacking and allow the execution of malicious code that would operate from within the CPU. In December 2017, two researchers reported a vulnerability that can allow attackers to execute code inside the [Management Engine (ME)](https://en.wikipedia.org/wiki/Intel_Management_Engine) present in any modern CPU from Intel. Meanwhile, the attacker group PLATINUM has been observed to have the capability to use Intel's [Active Management Technology (AMT)](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) to perform [invisible network communications](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/), bypassing the installed operating system. ME and AMT are essentially autonomous micro-computers that live inside the CPU and that operate at a very low level. Because these technologies’ purpose is to provide remote manageability, they have direct access to hardware, are independent of the operating system, and can run even if the computer is turned off.
|
||||
|
||||
**USB-based** (Type I): USB devices of all kinds can be reprogrammed with malicious firmware capable of interacting with the operating system in nefarious ways. This is the case of the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/), demonstrated few years ago, which allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will.
|
||||
Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.emsec.rub.de/media/crypto/veroeffentlichungen/2015/03/19/beckerStealthyExtended.pdf) in the past. It has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution.
|
||||
|
||||
**BIOS-based** (Type I): A BIOS is a firmware running inside a chipset. It executes when a machine is powered on, initializes the hardware, and then transfers control to the boot sector. It’s a very important component that operates at a very low level and executes before the boot sector. It’s possible to reprogram the BIOS firmware with malicious code, as has happened in the past with the [Mebromi rootkit](https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/).
|
||||
**USB-based** (Type I): USB devices of all kinds can be reprogrammed with malicious firmware capable of interacting with the operating system in nefarious ways. For example, the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/) allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will.
|
||||
|
||||
**Hypervisor-based** (Type I): Modern CPUs provide hardware hypervisor support, allowing the operating system to create robust virtual machines. A virtual machine runs in a confined, simulated environment, and is in theory unaware of the emulation. A malware taking over a machine may implement a small hypervisor to hide itself outside of the realm of the running operating system. Malware of this kind has been theorized in the past, and eventually real hypervisor rootkits [have been observed](http://seclists.org/fulldisclosure/2017/Jun/29), although very few are known to date.
|
||||
**BIOS-based** (Type I): A BIOS is a firmware running inside a chipset. It executes when a machine is powered on, initializes the hardware, and then transfers control to the boot sector. The BIOS is an important component that operates at a low level and executes before the boot sector. It’s possible to reprogram the BIOS firmware with malicious code, as has happened in the past with the [Mebromi rootkit](https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/).
|
||||
|
||||
**Hypervisor-based** (Type I): Modern CPUs provide hardware hypervisor support, allowing the operating system to create robust virtual machines. A virtual machine runs in a confined, simulated environment, and is in theory unaware of the emulation. A malware taking over a machine may implement a small hypervisor to hide itself outside of the realm of the running operating system. Malware of this kind has been theorized in the past, and eventually real hypervisor rootkits [have been observed](http://seclists.org/fulldisclosure/2017/Jun/29), although few are known to date.
|
||||
|
||||
### Execution and injection
|
||||
|
||||
**File-based** (Type III: executables, DLLs, LNK files, scheduled tasks): This is the standard execution vector. A simple executable can be launched as a first-stage malware to run an additional payload in memory or inject it into other legitimate running processes.
|
||||
**File-based** (Type III: executables, DLLs, LNK files, scheduled tasks): This is the standard execution vector. A simple executable can be launched as a first-stage malware to run an additional payload in memory, or injected into other legitimate running processes.
|
||||
|
||||
**Macro-based** (Type III: Office documents): The [VBA language](https://msdn.microsoft.com/vba/office-shared-vba/articles/getting-started-with-vba-in-office) is a flexible and powerful tool designed to automate editing tasks and add dynamic functionality to documents. As such, it can be abused by attackers to carry out malicious operations like decoding, running, or injecting an executable payload, or even implementing an entire ransomware, like in [the case of qkG](https://blog.trendmicro.com/trendlabs-security-intelligence/qkg-filecoder-self-replicating-document-encrypting-ransomware/). Macros are executed within the context of an Office process (e.g., Winword.exe), and they’re implemented in a scripting language, so there is no binary executable that an antivirus can inspect. While Office apps require explicit consent from the user to execute macros from a document, attackers use social engineering techniques to trick users into allowing macros to execute.
|
||||
**Macro-based** (Type III: Office documents): The [VBA language](https://msdn.microsoft.com/vba/office-shared-vba/articles/getting-started-with-vba-in-office) is a flexible and powerful tool designed to automate editing tasks and add dynamic functionality to documents. As such, it can be abused by attackers to carry out malicious operations like decoding, running, or injecting an executable payload, or even implementing an entire ransomware, like in [the case of qkG](https://blog.trendmicro.com/trendlabs-security-intelligence/qkg-filecoder-self-replicating-document-encrypting-ransomware/). Macros are executed within the context of an Office process (e.g., Winword.exe) and implemented in a scripting language. There's no binary executable that an antivirus can inspect. While Office apps require explicit consent from the user to execute macros from a document, attackers use social engineering techniques to trick users into allowing macros to execute.
|
||||
|
||||
**Script-based** (Type II: file, service, registry, WMI repo, shell): The JavaScript, VBScript, and PowerShell scripting languages are available by default on Windows platforms. Scripts have the same advantages as macros: they are textual files (not binary executables) and run within the context of the interpreter (e.g., wscript.exe, powershell.exe, etc.), which is a clean and legitimate component. Scripts are very versatile; they can be run from a file (e.g., by double-clicking them) or, in some cases, executed directly on the command line of an interpreter. Being able to run on the command line can allow malware to encode malicious command-line scripts as auto-start services inside [autorun registry keys](https://www.gdatasoftware.com/blog/2014/07/23947-poweliks-the-persistent-malware-without-a-file) as [WMI event subscriptions](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html) from the WMI repo. Furthermore, an attacker who has gained access to an infected machine may input the script on the command prompt.
|
||||
**Script-based** (Type II: file, service, registry, WMI repo, shell): The JavaScript, VBScript, and PowerShell scripting languages are available by default on Windows platforms. Scripts have the same advantages as macros, they are textual files (not binary executables) and run within the context of the interpreter (like wscript.exe, powershell.exe), which is a clean and legitimate component. Scripts are versatile and can be run from a file (by double-clicking them) or executed directly on the command line of an interpreter. Running on the command line allows malware to encode malicious scripts as autostart services inside [autorun registry keys](https://www.gdatasoftware.com/blog/2014/07/23947-poweliks-the-persistent-malware-without-a-file) as [WMI event subscriptions](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html) from the WMI repo. Furthermore, an attacker who has gained access to an infected machine may input the script on the command prompt.
|
||||
|
||||
**Disk-based** (Type II: Boot Record): The [Boot Record](https://en.wikipedia.org/wiki/Boot_sector) is the first sector of a disk or volume and contains executable code required to start the boot process of the operating system. Threats like [Petya](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/?source=mmpc) are capable of infecting the Boot Record by overwriting it with malicious code, so that when the machine is booted the malware immediately gains control (and in the case of Petya, with disastrous consequences). The Boot Record resides outside the file system, but it’s accessible by the operating system, and modern antivirus products have the capability to scan and restore it.
|
||||
**Disk-based** (Type II: Boot Record): The Boot Record is the first sector of a disk or volume, and contains executable code required to start the boot process of the operating system. Threats like [Petya](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/?source=mmpc) are capable of infecting the Boot Record by overwriting it with malicious code. When the machine is booted, the malware immediately gains control. The Boot Record resides outside the file system, but it’s accessible by the operating system. Modern antivirus products have the capability to scan and restore it.
|
||||
|
||||
## Defeating fileless malware
|
||||
|
||||
At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions that continuously enhance Windows security and mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender Advanced Threat Protection [(Microsoft Defender ATP)](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats.
|
||||
At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions to mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender Advanced Threat Protection [(Microsoft Defender ATP)](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats.
|
||||
|
||||
To learn more, read: [Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/)
|
||||
|
||||
@ -21,9 +21,9 @@ Macros are a powerful way to automate common tasks in Microsoft Office and can m
|
||||
|
||||
## How macro malware works
|
||||
|
||||
Macro malware hides in Microsoft Office files and are delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more.
|
||||
Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more.
|
||||
|
||||
Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. However, in recent versions of Microsoft Office, macros are disabled by default. This means malware authors need to convince users to turn on macros so that their malware can run. They do this by showing fake warnings when a malicious document is opened.
|
||||
Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. In recent versions of Microsoft Office, macros are disabled by default. Now, malware authors need to convince users to turn on macros so that their malware can run. They try to scare users by showing fake warnings when a malicious document is opened.
|
||||
|
||||
We've seen macro malware download threats from the following families:
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ We name the malware and unwanted software that we detect according to the Comput
|
||||
|
||||
|
||||
|
||||
When our analysts research a particular threat, they will determine what each of the components of the name will be.
|
||||
When our analysts research a particular threat, they'll determine what each of the components of the name will be.
|
||||
|
||||
## Type
|
||||
|
||||
@ -61,7 +61,7 @@ Describes what the malware does on your computer. Worms, viruses, trojans, backd
|
||||
|
||||
## Platforms
|
||||
|
||||
Indicates the operating system (such as Windows, Mac OS X, and Android) that the malware is designed to work on. The platform is also used to indicate programming languages and file formats.
|
||||
Platforms indicate the operating system (such as Windows, masOS X, and Android) the malware is designed to work on. The platform is also used to indicate programming languages and file formats.
|
||||
|
||||
### Operating systems
|
||||
|
||||
@ -71,8 +71,8 @@ Indicates the operating system (such as Windows, Mac OS X, and Android) that the
|
||||
* FreeBSD: FreeBSD platform
|
||||
* iPhoneOS: iPhone operating system
|
||||
* Linux: Linux platform
|
||||
* MacOS: MAC 9.x platform or earlier
|
||||
* MacOS_X: MacOS X or later
|
||||
* macOS: MAC 9.x platform or earlier
|
||||
* macOS_X: MacOS X or later
|
||||
* OS2: OS2 platform
|
||||
* Palm: Palm operating system
|
||||
* Solaris: System V-based Unix platforms
|
||||
@ -105,11 +105,11 @@ Indicates the operating system (such as Windows, Mac OS X, and Android) that the
|
||||
* INF: Install scripts
|
||||
* IRC: mIRC/pIRC scripts
|
||||
* Java: Java binaries (classes)
|
||||
* JS: Javascript scripts
|
||||
* JS: JavaScript scripts
|
||||
* LOGO: LOGO scripts
|
||||
* MPB: MapBasic scripts
|
||||
* MSH: Monad shell scripts
|
||||
* MSIL: .Net intermediate language scripts
|
||||
* MSIL: .NET intermediate language scripts
|
||||
* Perl: Perl scripts
|
||||
* PHP: Hypertext Preprocessor scripts
|
||||
* Python: Python scripts
|
||||
@ -125,7 +125,7 @@ Indicates the operating system (such as Windows, Mac OS X, and Android) that the
|
||||
|
||||
* A97M: Access 97, 2000, XP, 2003, 2007, and 2010 macros
|
||||
* HE: macro scripting
|
||||
* O97M: Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint
|
||||
* O97M: Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and PowerPoint
|
||||
* PP97M: PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros
|
||||
* V5M: Visio5 macros
|
||||
* W1M: Word1Macro
|
||||
|
||||
@ -18,59 +18,90 @@ search.appverid: met150
|
||||
|
||||
# Phishing
|
||||
|
||||
Phishing attacks attempt to steal sensitive information through emails, websites, text messages, or other forms of electronic communication that often look to be official communication from legitimate companies or individuals.
|
||||
Phishing attacks attempt to steal sensitive information through emails, websites, text messages, or other forms of electronic communication. They try to look like official communication from legitimate companies or individuals.
|
||||
|
||||
The information that phishers (as the cybercriminals behind phishing attacks are called) attempt to steal can be user names and passwords, credit card details, bank account information, or other credentials. Attackers can then use stolen information for malicious purposes, such as hacking, identity theft, or stealing money directly from bank accounts and credit cards. Phishers can also sell the information in cybercriminal underground marketplaces.
|
||||
Cybercriminals often attempt to steal usernames, passwords, credit card details, bank account information, or other credentials. They use stolen information for malicious purposes, such as hacking, identity theft, or stealing money directly from bank accounts and credit cards. The information can also be sold in cybercriminal underground markets.
|
||||
|
||||
## What to do if you've been a victim of a phishing scam
|
||||
|
||||
If you feel you've been a victim of a phishing attack:
|
||||
|
||||
1. Contact your IT admin if you are on a work computer.
|
||||
2. Immediately change all passwords associated with the accounts.
|
||||
3. Report any fraudulent activity to your bank and credit card company.
|
||||
|
||||
### Reporting spam
|
||||
|
||||
- **Outlook.com**: If you receive a suspicious email message that asks for personal information, select the check box next to the message in your Outlook inbox. Select the arrow next to **Junk**, and then select **Phishing**.
|
||||
|
||||
- **Microsoft Office Outlook**: While in the suspicious message, select **Report message** from the ribbon, and then select **Phishing**.
|
||||
|
||||
- **Microsoft**: Create a new, blank email message with the one of the following recipients:
|
||||
- Junk: junk@office365.microsoft.com
|
||||
- Phishing: phish@office365.microsoft.com
|
||||
|
||||
Drag and drop the junk or phishing message into the new message. This will save the junk or phishing message as an attachment in the new message. Don't copy and paste the content of the message or forward the message (we need the original message so we can inspect the message headers). For more information, see [Submit spam, non-spam, and phishing scam messages to Microsoft for analysis](https://docs.microsoft.com/office365/SecurityCompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis).
|
||||
|
||||
- **Anti-Phishing Working Group**: phishing-report@us-cert.gov. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions, and law enforcement agencies are involved.
|
||||
|
||||
If you’re on a suspicious website:
|
||||
|
||||
- **Microsoft Edge**: While you’re on a suspicious site, select the **More (…) icon** > **Help and feedback** > **Report Unsafe site**. Follow the instructions on the webpage that displays to report the website.
|
||||
|
||||
- **Internet Explorer**: While you’re on a suspicious site, select the gear icon, point to **Safety**, and then select **Report Unsafe Website**. Follow the instructions on the webpage that displays to report the website.
|
||||
|
||||
>[!NOTE]
|
||||
>For more information, see [Protect yourself from phishing](https://support.microsoft.com/en-us/help/4033787/windows-protect-yourself-from-phishing).
|
||||
|
||||
## How phishing works
|
||||
|
||||
Phishing attacks are scams that often use social engineering bait or lure content. For example, during tax season, bait content involves tax-filing announcements that attempt to lure you into providing your personal information such as your Social Security number or bank account information.
|
||||
Phishing attacks are scams that often use social engineering bait or lure content. For example, during tax season bait content can be tax-filing announcements that attempt to lure you into providing personal information such as your SSN or bank account information.
|
||||
|
||||
Legitimate-looking communication, usually email, that links to a phishing site is one of the most common methods used in phishing attacks. The phishing site typically mimics sign-in pages that require users to input login credentials and account information. The phishing site then captures the sensitive information as soon as the user provides it, giving attackers access to the information.
|
||||
Legitimate-looking communication, usually email, that links to a phishing site is one of the most common methods used in phishing attacks. The phishing site typically mimics sign in pages that require users to input credentials and account information. The phishing site then captures the sensitive information as soon as the user provides it, giving attackers access to the information.
|
||||
|
||||
Another common phishing technique is the use of emails that direct you to open a malicious attachment, for example a PDF file. The attachment often contains a message asking you to provide login credentials to another site such as email or file sharing websites to open the document. When you access these phishing sites using your login credentials, the attacker now has access to your information and can gain additional personal information about you.
|
||||
Another common phishing technique is the use of emails that direct you to open a malicious attachment like a PDF file. The attachment often contains a message asking you to sign in to another site, such as email or file sharing websites, to open the document. When you access these phishing sites using your sign-in credentials, the attacker now has access to your information and can gain additional personal information about you.
|
||||
|
||||
## Phishing trends and techniques
|
||||
|
||||
### Invoice phishing
|
||||
|
||||
In this scam, the attacker attempts to lure you with an email stating that you have an outstanding invoice from a known vendor or company and provides a link for you to access and pay your invoice. When you access the site, the attacker is poised to steal your personal information and funds.
|
||||
In this scam, the attacker attempts to lure you with an email stating that you have an outstanding invoice from a known vendor or company. They then provide a link for you to access and pay your invoice. When you access the site, the attacker is poised to steal your personal information and funds.
|
||||
|
||||
### Payment/delivery scam
|
||||
|
||||
You are asked to provide a credit card or other personal information so that your payment information can be updated with a commonly known vendor or supplier. The update is requested so that you can take delivery of your ordered goods. Generally, you may be familiar with the company and have likely done business with them in the past, but you are not aware of any items you have recently purchased from them.
|
||||
You're asked to provide a credit card or other personal information so that your payment information can be updated with a commonly known vendor or supplier. The update is requested so that you can take delivery of your ordered goods. Generally, you may be familiar with the company and have likely done business with them in the past. However, you aren't aware of any items you have recently purchased from them.
|
||||
|
||||
### Tax-themed phishing scams
|
||||
|
||||
A common IRS phishing scams is one in which an urgent email letter is sent indicating that you owe money to the IRS. Often the email threatens legal action if you do not access the site in a timely manner and pay your taxes. When you access the site, the attackers can steal your personal credit card or bank information and drain your accounts.
|
||||
A common IRS phishing scam is receiving an urgent email letter indicating that you owe money to the IRS. Often the email threatens legal action if you don't access the site in a timely manner and pay your taxes. When you access the site, the attackers can steal your personal credit card or bank information and drain your accounts.
|
||||
|
||||
### Downloads
|
||||
|
||||
Another frequently-used phishing scam is one in which an attacker sends a fraudulent email requesting you to open or download a document, often one requiring you to sign in.
|
||||
An attacker sends a fraudulent email requesting you to open or download a document, often requiring you to sign in.
|
||||
|
||||
### Phishing emails that deliver other threats
|
||||
|
||||
Phishing emails can be very effective, and so attackers can using them to distribute [ransomware](ransomware-malware.md) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files.
|
||||
Phishing emails are often very effective, so attackers sometimes use them to distribute [ransomware](ransomware-malware.md) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files.
|
||||
|
||||
We have also seen phishing emails that have links to [tech support scam](support-scams.md) websites, which use various scare tactics to trick you into calling hotlines and paying for unnecessary "technical support services" that supposedly fix contrived device, platform, or software problems.
|
||||
We have also seen phishing emails that have links to [tech support scam](support-scams.md) websites. These websites use various scare tactics to trick you into calling hotlines and paying for unnecessary "technical support services" that supposedly fix contrived device, platform, or software problems.
|
||||
|
||||
## Targeted attacks against enterprises
|
||||
|
||||
### Spear phishing
|
||||
|
||||
Spear phishing is a targeted phishing attack that involves highly customized lure content. To perform spear phishing, attackers will typically do reconnaissance work, surveying social media and other information sources about their intended target.
|
||||
Spear phishing is a targeted phishing attack that involves highly customized lure content. Attackers will typically do reconnaissance work by surveying social media and other information sources about their intended target.
|
||||
|
||||
Spear phishing may involve tricking you into logging into fake sites and divulging credentials. Spear phishing may also be designed to lure you into opening documents by clicking on links that automatically install malware. With this malware in place, attackers can remotely manipulate the infected computer.
|
||||
Spear phishing may involve tricking you into logging into fake sites and divulging credentials. I may also lure you into opening documents by clicking on links that automatically install malware. With this malware in place, attackers can remotely manipulate the infected computer.
|
||||
|
||||
The implanted malware serves as the point of entry for a more sophisticated attack known as an advanced persistent threat (APT). APTs are generally designed to establish control and steal data over extended periods. As part of the attack, attackers often try to deploy more covert hacking tools, move laterally to other computers, compromise or create privileged accounts, and regularly exfiltrate information from compromised networks.
|
||||
The implanted malware serves as the point of entry for a more sophisticated attack, known as an advanced persistent threat (APT). APTs are designed to establish control and steal data over extended periods. Attackers may try to deploy more covert hacking tools, move laterally to other computers, compromise or create privileged accounts, and regularly exfiltrate information from compromised networks.
|
||||
|
||||
### Whaling
|
||||
|
||||
Whaling is a form of phishing in which the attack is directed at high-level or senior executives within specific companies with the direct goal of gaining access to their credentials and/or bank information. The content of the email may be written as a legal subpoena, customer complaint, or other executive issue. This type of attack can also lead to an APT attack within an organization. When the links or attachment are opened, it can assist the attacker in accessing credentials and other personal information, or launch a malware that will lead to an APT.
|
||||
Whaling is a form of phishing directed at high-level or senior executives within specific companies to gain access to their credentials and/or bank information. The content of the email may be written as a legal subpoena, customer complaint, or other executive issue. This type of attack can also lead to an APT attack within an organization.
|
||||
|
||||
### Business email compromise
|
||||
|
||||
Business email compromise (BEC) is a sophisticated scam that targets businesses often working with foreign suppliers and businesses that regularly perform wire transfer payments. One of the most common schemes used by BEC attackers involves gaining access to a company’s network through a spear phishing attack, where the attacker creates a domain similar to the company they are targeting or spoofs their email to scam users into releasing personal account information for money transfers.
|
||||
Business email compromise (BEC) is a sophisticated scam that targets businesses who frequently work with foreign suppliers or do money wire transfers. One of the most common schemes used by BEC attackers involves gaining access to a company’s network through a spear phishing attack. The attacker creates a domain similar to the company they're targeting, or spoofs their email to scam users into releasing personal account information for money transfers.
|
||||
|
||||
## How to protect against phishing attacks
|
||||
|
||||
@ -78,35 +109,35 @@ Social engineering attacks are designed to take advantage of a user's possible l
|
||||
|
||||
### Awareness
|
||||
|
||||
The best protection is awareness and education. Don’t open attachments or click links in unsolicited emails, even if the emails came from a recognized source. If the email is unexpected, be wary about opening the attachment and verify the URL.
|
||||
The best protection is awareness and education. Don’t open attachments or links in unsolicited emails, even if the emails came from a recognized source. If the email is unexpected, be wary about opening the attachment and verify the URL.
|
||||
|
||||
Enterprises should educate and train their employees to be wary of any communication that requests personal or financial information, and instruct them to report the threat to the company’s security operations team immediately.
|
||||
Enterprises should educate and train their employees to be wary of any communication that requests personal or financial information. They should also instruct employees to report the threat to the company’s security operations team immediately.
|
||||
|
||||
Here are several telltale signs of a phishing scam:
|
||||
|
||||
* The links or URLs provided in emails are **not pointing to the correct location** or are attempting to have you access a third-party site that is not affiliated with the sender of the email. For example, in the image below the URL provided does not match the URL that you will be taken to.
|
||||
* The links or URLs provided in emails are **not pointing to the correct location** or are pointing to a third-party site not affiliated with the sender of the email. For example, in the image below the URL provided doesn't match the URL that you'll be taken to.
|
||||
|
||||
|
||||
|
||||
* There is a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email.
|
||||
* There's a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email.
|
||||
|
||||
* **Items in the email address will be changed** so that it is similar enough to a legitimate email address but has added numbers or changed letters.
|
||||
* **Items in the email address will be changed** so that it is similar enough to a legitimate email address, but has added numbers or changed letters.
|
||||
|
||||
* The message is **unexpected and unsolicited**. If you suddenly receive an email from an entity or a person you rarely deal with, consider this email suspect.
|
||||
|
||||
* The message or the attachment asks you to **enable macros, adjust security settings, or install applications**. Normal emails will not ask you to do this.
|
||||
* The message or the attachment asks you to **enable macros, adjust security settings, or install applications**. Normal emails won't ask you to do this.
|
||||
|
||||
* The message contains **errors**. Legitimate corporate messages are less likely to have typographic or grammatical errors or contain wrong information.
|
||||
|
||||
* The **sender address does not match** the signature on the message itself. For example, an email is purported to be from Mary of Contoso Corp, but the sender address is john<span></span>@example.com.
|
||||
* The **sender address doesn't match the signature** on the message itself. For example, an email is purported to be from Mary of Contoso Corp, but the sender address is john<span></span>@example.com.
|
||||
|
||||
* There are **multiple recipients** in the “To” field and they appear to be random addresses. Corporate messages are normally sent directly to individual recipients.
|
||||
|
||||
* The greeting on the message itself **does not personally address you**. Apart from messages that mistakenly address a different person, those that misuse your name or pull your name directly from your email address tend to be malicious.
|
||||
* The greeting on the message itself **doesn't personally address you**. Apart from messages that mistakenly address a different person, greetings that misuse your name or pull your name directly from your email address tend to be malicious.
|
||||
|
||||
* The website looks familiar but there are **inconsistencies or things that are not quite right** such as outdated logos, typos, or ask users to give additional information that is not asked by legitimate sign-in websites.
|
||||
* The website looks familiar but there are **inconsistencies or things that aren't quite right**. Warning signs include outdated logos, typos, or ask users to give additional information that is not asked by legitimate sign-in websites.
|
||||
|
||||
* The page that opens is **not a live page** but rather an image that is designed to look like the site you are familiar with. A pop-up may appear that requests credentials.
|
||||
* The page that opens is **not a live page**, but rather an image that is designed to look like the site you are familiar with. A pop-up may appear that requests credentials.
|
||||
|
||||
If in doubt, contact the business by known channels to verify if any suspicious emails are in fact legitimate.
|
||||
|
||||
@ -114,7 +145,7 @@ For more information, download and read this Microsoft [e-book on preventing soc
|
||||
|
||||
### Software solutions for organizations
|
||||
|
||||
* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) and [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) offer protection from the increasing threat of targeted attacks using Microsoft's industry leading Hyper-V virtualization technology. If a browsed website is deemed untrusted, the Hyper-V container will isolate that device from the rest of your network thereby preventing access to your enterprise data.
|
||||
* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) and [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) offer protection from the increasing threat of targeted attacks using Microsoft's industry-leading Hyper-V virtualization technology. If a browsed website is deemed untrusted, the Hyper-V container will isolate that device from the rest of your network thereby preventing access to your enterprise data.
|
||||
|
||||
* [Microsoft Exchange Online Protection (EOP)](https://products.office.com/exchange/exchange-email-security-spam-protection) offers enterprise-class reliability and protection against spam and malware, while maintaining access to email during and after emergencies. Using various layers of filtering, EOP can provide different controls for spam filtering, such as bulk mail controls and international spam, that will further enhance your protection services.
|
||||
|
||||
@ -122,19 +153,7 @@ For more information, download and read this Microsoft [e-book on preventing soc
|
||||
|
||||
For more tips and software solutions, see [prevent malware infection](prevent-malware-infection.md).
|
||||
|
||||
## What do I do if I've already been a victim of a phishing scam?
|
||||
|
||||
If you feel that you have been a victim of a phishing attack, contact your IT Admin. You should also immediately change all passwords associated with the accounts, and report any fraudulent activity to your bank, credit card company, etc.
|
||||
|
||||
### Reporting spam
|
||||
|
||||
Submit phishing scam emails to **Microsoft** by sending an email with the scam as an attachment to: phish@office365.microsoft.com. For more information on submitting messages to Microsoft, see [Submit spam, non-spam, and phishing scam messages to Microsoft for analysis](https://docs.microsoft.com/office365/SecurityCompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis).
|
||||
|
||||
For Outlook and Outlook on the web users, use the **Report Message Add-in** for Microsoft Outlook. For information about how to install and use this tool, see [Enable the Report Message add-in](https://support.office.com/article/4250c4bc-6102-420b-9e0a-a95064837676).
|
||||
|
||||
Send an email with the phishing scam to **The Anti-Phishing Working Group**: reportphishing@apwg.org. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions and law enforcement agencies are involved.
|
||||
|
||||
## Where to find more information about phishing attacks
|
||||
## More information about phishing attacks
|
||||
|
||||
For information on the latest phishing attacks, techniques, and trends, you can read these entries on the [Microsoft Security blog](https://www.microsoft.com/security/blog/product/windows/):
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ Most ransomware infections start with:
|
||||
|
||||
Once ransomware infects a device, it starts encrypting files, folders, entire hard drive partitions using encryption algorithms like RSA or RC4.
|
||||
|
||||
Ransomware is one of the most lucrative revenue channels for cybercriminals, so malware authors continually improve their malware code to better target enterprise environments. Ransomware-as-a-service is a cybercriminal business model in which malware creators sell their ransomware and other services to cybercriminals, who then operate the ransomware attacks. The business model also defines profit sharing between the malware creators, ransomware operators, and other parties that may be involved. For cybercriminals, ransomware is a big business, at the expense of individuals and businesses.
|
||||
Ransomware is one of the most lucrative revenue channels for cybercriminals, so malware authors continually improve their malware code to better target enterprise environments. Ransomware-as-a-service is a cybercriminal business model where malware creators sell their ransomware and other services to cybercriminals, who then operate the ransomware attacks. The business model also defines profit sharing between the malware creators, ransomware operators, and other parties that may be involved. For cybercriminals, ransomware is big business at the expense of individuals and businesses.
|
||||
|
||||
### Examples
|
||||
|
||||
@ -43,9 +43,9 @@ Sophisticated ransomware like **Spora**, **WannaCrypt** (also known as WannaCry)
|
||||
|
||||
* A Petya variant exploits the same vulnerability, in addition to CVE-2017-0145 (also known as EternalRomance), and uses stolen credentials to move laterally across networks.
|
||||
|
||||
Older ransomware like **Reveton** locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they are effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and fine needs to be paid. Because of this, Reveton is nicknamed "Police Trojan" or "Police ransomware".
|
||||
Older ransomware like **Reveton** (nicknamed "Police Trojan" or "Police ransomware") locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they're effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and a fine needs to be paid.
|
||||
|
||||
Ransomware like **Cerber** and **Locky** search for and encrypt specific file types, typically document and media files. When the encryption is complete, the malware leaves a ransom note using text, image, or an HTML file with instructions to pay a ransom to recover files.
|
||||
Ransomware like **Cerber** and **Locky** search for and encrypt specific file types, typically document and media files. When the encryption is complete, the malware leaves a ransom note using text, image, or an HTML file with instructions to pay a ransom to recover files.
|
||||
|
||||
**Bad Rabbit** ransomware was discovered attempting to spread across networks using hardcoded usernames and passwords in brute force attacks.
|
||||
|
||||
|
||||
@ -17,15 +17,15 @@ search.appverid: met150
|
||||
---
|
||||
# Rootkits
|
||||
|
||||
Malware authors use rootkits to hide malware on your device, allowing malware to persist as long as possible. A successful rootkit can potentially remain in place for years if it is undetected. During this time it will steal information and resources.
|
||||
Malware authors use rootkits to hide malware on your device, allowing malware to persist as long as possible. A successful rootkit can potentially remain in place for years if it's undetected. During this time, it will steal information and resources.
|
||||
|
||||
## How rootkits work
|
||||
|
||||
Rootkits intercept and change standard operating system processes. After a rootkit infects a device, you can’t trust any information that device reports about itself.
|
||||
|
||||
For example, if you were to ask a device to list all of the programs that are running, the rootkit might stealthily remove any programs it doesn’t want you to know about. Rootkits are all about hiding things. They want to hide both themselves and their malicious activity on a device.
|
||||
If you were to ask a device to list all of the programs that are running, the rootkit might stealthily remove any programs it doesn’t want you to know about. Rootkits are all about hiding things. They want to hide both themselves and their malicious activity on a device.
|
||||
|
||||
Many modern malware families use rootkits to try and avoid detection and removal, including:
|
||||
Many modern malware families use rootkits to try to avoid detection and removal, including:
|
||||
|
||||
* [Alureon](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fAlureon)
|
||||
|
||||
@ -53,12 +53,12 @@ For more general tips, see [prevent malware infection](prevent-malware-infection
|
||||
|
||||
### What if I think I have a rootkit on my device?
|
||||
|
||||
Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you might have a rootkit on your device and your antimalware software isn’t detecting it, you might need an extra tool that lets you boot to a known trusted environment.
|
||||
Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you have a rootkit that your antimalware software isn’t detecting, you may need an extra tool that lets you boot to a known trusted environment.
|
||||
|
||||
[Microsoft Defender Offline](https://support.microsoft.com/help/17466/microsoft-defender-offline-help-protect-my-pc) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly due to a possible malware infection.
|
||||
[Microsoft Defender Offline](https://support.microsoft.com/help/17466/microsoft-defender-offline-help-protect-my-pc) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly because of a possible malware infection.
|
||||
|
||||
[System Guard](https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/) in Windows 10 protects against rootkits and threats that impact system integrity.
|
||||
|
||||
### What if I can’t remove a rootkit?
|
||||
|
||||
If the problem persists, we strongly recommend reinstalling the operating system and security software. You should then restore your data from a backup.
|
||||
If the problem persists, we strongly recommend reinstalling the operating system and security software. Then restore your data from a backup.
|
||||
|
||||
@ -26,7 +26,7 @@ You can send us files that you think might be malware or files that have been in
|
||||
|
||||
We receive a large number of samples from many sources. Our analysis is prioritized by the number of file detections and the type of submission. You can help us complete a quick analysis by providing detailed information about the product you were using and what you were doing when you found the file.
|
||||
|
||||
If you sign in before you submit a sample, you will be able to track your submissions.
|
||||
After you sign in, you will be able to track your submissions.
|
||||
|
||||
## Can I send a sample by email?
|
||||
|
||||
@ -34,9 +34,7 @@ No, we only accept submissions through our [sample submission portal](https://ww
|
||||
|
||||
## Can I submit a sample without signing in?
|
||||
|
||||
Yes, you many submit a file as an anonymous home customer. You will get a link to a webpage where you can view the status of the submission.
|
||||
|
||||
If you're an enterprise customer, you need to sign in so that we can prioritize your submission appropriately. If you are currently experiencing a virus outbreak or security-related incident, you should contact your designated Microsoft support professional or go to [Microsoft Support](https://support.microsoft.com/) for immediate assistance.
|
||||
No. If you're an enterprise customer, you need to sign in so that we can prioritize your submission appropriately. If you are currently experiencing a virus outbreak or security-related incident, you should contact your designated Microsoft support professional or go to [Microsoft Support](https://support.microsoft.com/) for immediate assistance.
|
||||
|
||||
## What is the Software Assurance ID (SAID)?
|
||||
|
||||
@ -52,9 +50,7 @@ We encourage all software vendors and developers to read about [how Microsoft id
|
||||
|
||||
## How do I track or view past sample submissions?
|
||||
|
||||
You can track your submissions through the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). Your submission will only appear on this page if you were signed in when you submitted it.
|
||||
|
||||
If you’re not signed in when you submit a sample, you will be redirected to a tracking page. Bookmark this page if you want to come back and check on the status of your submission.
|
||||
You can track your submissions through the [submission history page](https://www.microsoft.com/wdsi/submissionhistory).
|
||||
|
||||
## What does the submission status mean?
|
||||
|
||||
@ -66,7 +62,7 @@ Each submission is shown to be in one of the following status types:
|
||||
|
||||
* Closed—a final determination has been given by an analyst
|
||||
|
||||
If you are signed in, you can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory).
|
||||
You can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory).
|
||||
|
||||
## How does Microsoft prioritize submissions
|
||||
|
||||
|
||||
@ -17,6 +17,9 @@ manager: dansimp
|
||||
Microsoft Baseline Security Analyzer (MBSA) is used to verify patch compliance. MBSA also performed several other security checks for Windows, IIS, and SQL Server. Unfortunately, the logic behind these additional checks had not been actively maintained since Windows XP and Windows Server 2003. Changes in the products since then rendered many of these security checks obsolete and some of their recommendations counterproductive.
|
||||
|
||||
MBSA was largely used in situations where neither Microsoft Update nor a local WSUS or Configuration Manager server was available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 introduced support for Windows Server 2012 R2 and Windows 8.1, it has since been deprecated and no longer developed. MBSA 2.3 is not updated to fully support Windows 10 and Windows Server 2016.
|
||||
|
||||
> [!NOTE]
|
||||
> In accordance with our [SHA-1 deprecation initiative](https://aka.ms/sha1deprecation), the Wsusscn2.cab file is no longer dual-signed using both SHA-1 and the SHA-2 suite of hash algorithms (specifically SHA-256). This file is now signed using only SHA-256. Administrators who verify digital signatures on this file should now expect only single SHA-256 signatures. Starting with the August 2020 Wsusscn2.cab file, MBSA will return the following error "The catalog file is damaged or an invalid catalog." when attempting to scan using the offline scan file.
|
||||
|
||||
## The Solution
|
||||
A script can help you with an alternative to MBSA’s patch-compliance checking:
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 08/26/2020
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are also enabled. In most cases, these prerequisite settings are also enabled by default, so the feature is running without any intervention.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ manager: dansimp
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
When Microsoft Defender Antivirus finds a suspicious file, it can prevent the file from running while it queries the [Microsoft Defender Antivirus cloud service](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ manager: dansimp
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
To ensure Microsoft Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers.
|
||||
|
||||
@ -57,7 +57,7 @@ The table below lists the services and their associated URLs. Make sure that the
|
||||
| Microsoft Update Service (MU) <br/> Windows Update Service (WU)| Security intelligence and product updates |`*.update.microsoft.com` <br/> `*.delivery.mp.microsoft.com`<br/> `*.windowsupdate.com` <br/><br/> For details see [Connection endpoints for Windows Update](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints#windows-update)|
|
||||
|Security intelligence updates Alternate Download Location (ADL)| Alternate location for Microsoft Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| `*.download.microsoft.com` </br> `*.download.windowsupdate.com`</br> `https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx`|
|
||||
| Malware submission storage|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | `ussus1eastprod.blob.core.windows.net` <br/> `ussus1westprod.blob.core.windows.net` <br/> `usseu1northprod.blob.core.windows.net` <br/> `usseu1westprod.blob.core.windows.net` <br/> `ussuk1southprod.blob.core.windows.net` <br/> `ussuk1westprod.blob.core.windows.net` <br/> `ussas1eastprod.blob.core.windows.net` <br/> `ussas1southeastprod.blob.core.windows.net` <br/> `ussau1eastprod.blob.core.windows.net` <br/> `ussau1southeastprod.blob.core.windows.net` |
|
||||
| Certificate Revocation List (CRL)|Used by Windows when creating the SSL connection to MAPS for updating the CRL | `https://www.microsoft.com/pkiops/crl/` <br/> `https://www.microsoft.com/pkiops/certs` <br/> `https://crl.microsoft.com/pki/crl/products` <br/> `https://www.microsoft.com/pki/certs` |
|
||||
| Certificate Revocation List (CRL)|Used by Windows when creating the SSL connection to MAPS for updating the CRL | `http://www.microsoft.com/pkiops/crl/` <br/> `http://www.microsoft.com/pkiops/certs` <br/> `http://crl.microsoft.com/pki/crl/products` <br/> `http://www.microsoft.com/pki/certs` |
|
||||
| Symbol Store|Used by Microsoft Defender Antivirus to restore certain critical files during remediation flows | `https://msdl.microsoft.com/download/symbols` |
|
||||
| Universal Telemetry Client| Used by Windows to send client diagnostic data; Microsoft Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: `vortex-win.data.microsoft.com` <br/> `settings-win.data.microsoft.com`|
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ manager: dansimp
|
||||
- [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge)
|
||||
|
||||
> [!NOTE]
|
||||
> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might not be be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices.
|
||||
> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices.
|
||||
|
||||
Potentially unwanted applications (PUA) are not considered viruses, malware, or other types of threats, but they might perform actions on endpoints which adversely affect endpoint performance or use. _PUA_ can also refer to an application that has a poor reputation, as assessed by Microsoft Defender ATP, due to certain kinds of undesirable behavior.
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.custom: nextgen
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
> [!NOTE]
|
||||
> The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 83 KiB |
@ -13,6 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.date: 09/07/2020
|
||||
---
|
||||
|
||||
# Manage Microsoft Defender Antivirus updates and apply baselines
|
||||
@ -57,6 +58,44 @@ All our updates contain:
|
||||
* serviceability improvements
|
||||
* integration improvements (Cloud, MTP)
|
||||
<br/>
|
||||
<details>
|
||||
<summary> August-2020 (Platform: 4.18.2008.3 | Engine: 1.1.17400.5)</summary>
|
||||
|
||||
 Security intelligence update version: **1.323.9.0**
|
||||
 Released: **August 27, 2020**
|
||||
 Platform: **4.18.2008.9**
|
||||
 Engine: **1.1.17400.5**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
### What's new
|
||||
* Add more telemetry events
|
||||
* Improved scan event telemetry
|
||||
* Improved behavior monitoring for memory scans
|
||||
* Improved macro streams scanning
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary> July-2020 (Platform: 4.18.2007.8 | Engine: 1.1.17300.4)</summary>
|
||||
|
||||
 Security intelligence update version: **1.321.30.0**
|
||||
 Released: **July 28, 2020**
|
||||
 Platform: **4.18.2007.8**
|
||||
 Engine: **1.1.17300.4**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
### What's new
|
||||
* Improved telemetry for BITS
|
||||
* Improved Authenticode code signing certificate validation
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary> June-2020 (Platform: 4.18.2006.10 | Engine: 1.1.17200.2)</summary>
|
||||
|
||||
@ -86,7 +125,7 @@ No known issues
|
||||
 Released: **May 26, 2020**
|
||||
 Platform: **4.18.2005.4**
|
||||
 Engine: **1.1.17100.2**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
 Support phase: **Technical upgrade Support (Only)**
|
||||
|
||||
### What's new
|
||||
* Improved logging for scan events
|
||||
@ -108,7 +147,7 @@ No known issues
|
||||
 Released: **April 30, 2020**
|
||||
 Platform: **4.18.2004.6**
|
||||
 Engine: **1.1.17000.2**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
 Support phase: **Technical upgrade Support (Only)**
|
||||
|
||||
### What's new
|
||||
* WDfilter improvements
|
||||
|
||||
@ -20,7 +20,7 @@ ms.custom: nextgen
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
## Microsoft Defender Antivirus: Your next-generation protection
|
||||
|
||||
|
||||
@ -14,6 +14,7 @@ audience: ITPro
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 08/31/2020
|
||||
---
|
||||
|
||||
# Protect security settings with tamper protection
|
||||
@ -80,24 +81,20 @@ If you are a home user, or you are not subject to settings managed by a security
|
||||
|
||||
## Turn tamper protection on (or off) for your organization using Intune
|
||||
|
||||
If you are part of your organization's security team, and your subscription includes [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the Microsoft 365 Device Management portal ([https://aka.ms/intuneportal](https://aka.ms/intuneportal)).
|
||||
|
||||
> [!NOTE]
|
||||
> The ability to manage tamper protection in Intune is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) (Microsoft Defender ATP) and that you meet the prerequisites listed below.
|
||||
If you are part of your organization's security team, and your subscription includes [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) portal.
|
||||
|
||||
You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task.
|
||||
|
||||
1. Make sure your organization meets all of the following requirements to manage tamper protection using Intune:
|
||||
|
||||
- Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in [Microsoft 365 E5](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview)).
|
||||
- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; this is included in Microsoft 365 E5.)
|
||||
- Your Windows machines must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later. (See [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) for more details about releases.)
|
||||
- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).
|
||||
- Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)
|
||||
|
||||
2. Go to the Microsoft 365 Device Management portal ([https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com)) and sign in with your work or school account.
|
||||
2. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in with your work or school account.
|
||||
|
||||
3. Select **Device configuration** > **Profiles**.
|
||||
3. Select **Devices** > **Configuration Profiles**.
|
||||
|
||||
4. Create a profile as follows:
|
||||
|
||||
@ -109,7 +106,7 @@ You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-
|
||||
|
||||
- Tamper Protection: **Enabled**
|
||||
|
||||
|
||||
|
||||
|
||||
5. Assign the profile to one or more groups.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.custom: nextgen
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
You can specify the level of cloud-protection offered by Microsoft Defender Antivirus with Group Policy and Microsoft Endpoint Configuration Manager.
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ The table in this section lists the main Microsoft Defender Antivirus event IDs
|
||||
## To view a Microsoft Defender Antivirus event
|
||||
|
||||
1. Open **Event Viewer**.
|
||||
2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Microsoft Defender Antivirus**.
|
||||
2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**.
|
||||
3. Double-click on **Operational**.
|
||||
4. In the details pane, view the list of individual events to find your event.
|
||||
5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs.
|
||||
|
||||
@ -18,7 +18,7 @@ ms.custom: nextgen
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- Microsoft Defender Antivirus
|
||||
|
||||
Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models.
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user