From 4639ae48f001b340d087d831fbe43fd61c199720 Mon Sep 17 00:00:00 2001 From: isbrahm <43386070+isbrahm@users.noreply.github.com> Date: Fri, 31 Jul 2020 12:45:39 -0700 Subject: [PATCH 1/3] Correct server availability information MI is not available on Server 2016 --- ...ndows-defender-application-control-with-managed-installer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index 8ad3ce6f98..2b4dd900b3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -22,7 +22,7 @@ ms.date: 06/13/2018 **Applies to:** - Windows 10 -- Windows Server 2016 and above +- Windows Server 2019 Creating and maintaining application execution control policies has always been challenging, and finding ways to address this issue has been a frequently-cited request for customers of AppLocker and Windows Defender Application Control (WDAC). This is especially true for enterprises with large, ever changing software catalogs. From dc112a8989dd5eecf433854416ce74f69c93310b Mon Sep 17 00:00:00 2001 From: Mark Stanfill Date: Mon, 3 Aug 2020 10:49:30 -0500 Subject: [PATCH 2/3] Fix-up for XML and Bash syntax terminate keys --- .../microsoft-defender-atp/mac-schedule-scan-atp.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md b/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md index d7a913d13f..ce7fb8d947 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-schedule-scan-atp.md @@ -36,12 +36,13 @@ While you can start a threat scan at any time with Microsoft Defender ATP, your ProgramArguments sh - -c - /usr/local/bin/mdatp --scan --quick + -c + /usr/local/bin/mdatp --scan --quick RunAtLoad - StartCalendarInterval + StartCalendarInterval + Day 3 Hour @@ -68,8 +69,8 @@ While you can start a threat scan at any time with Microsoft Defender ATP, your 4. To load your file into **launchd**, enter the following commands: ```bash - `$ launchctl load /Library/LaunchDaemons/` - `$ launchctl start ` + launchctl load /Library/LaunchDaemons/` + launchctl start ` ``` 5. Your scheduled scan runs at the date, time, and frequency you defined in your .plist file. In the example, the scan runs at 2:00 AM every 7 days on a Friday, with the StartInterval using 604800 seconds for one week. From ffe1280c31885de02b298bdcfb10771eb3be6de4 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 3 Aug 2020 17:40:49 -0700 Subject: [PATCH 3/3] Re-implemented corrections following force-push --- ...plication-control-with-managed-installer.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md index 2b4dd900b3..f0c0979e51 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md @@ -36,7 +36,7 @@ A managed installer uses a new rule collection in AppLocker to specify one or mo Specifying an executable as a managed installer will cause Windows to tag files that are written from the executable’s process (or processes it launches) as having originated from a trusted installation authority. The Managed Installer rule collection is currently supported for AppLocker rules in Group Policy and in Configuration Manager, but not in the AppLocker CSP for OMA-URI policies. Once the IT administrator adds the Allow: Managed Installer option to a WDAC policy, the WDAC component will subsequently check for the presence of the origin information when evaluating other application execution control rules specified in the policy. -If there are no deny rules present for the file, it will be authorized based on the managed installer origin information.+ +If there are no deny rules present for the file, it will be authorized based on the managed installer origin information. Admins needs to ensure that there is a WDAC policy in place to allow the system to boot and run any other authorized applications that may not be deployed through a managed installer. Examples of WDAC policies available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies help authorize Windows OS components, WHQL signed drivers and all Store apps. @@ -46,9 +46,9 @@ Examples of WDAC policies available in C:\Windows\schemas\CodeIntegrity\ExampleP Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled. There are three primary steps to keep in mind: -- Specify managed installers using the Managed Installer rule collection in AppLocker policy -- Enable service enforcement in AppLocker policy -- Enable the managed installer option in a WDAC policy +- Specify managed installers by using the Managed Installer rule collection in AppLocker policy. +- Enable service enforcement in AppLocker policy. +- Enable the managed installer option in a WDAC policy. ### Specify managed installers using the Managed Installer rule collection in AppLocker policy @@ -60,7 +60,7 @@ For more information about creating an AppLocker policy that includes a managed As mentioned above, the AppLocker CSP for OMA-URI policies does not currently support the Managed Installer rule collection or the Service Enforcement rule extensions mentioned below. -```code +```xml @@ -82,10 +82,10 @@ As mentioned above, the AppLocker CSP for OMA-URI policies does not currently su ## Enable service enforcement in AppLocker policy Since many installation processes rely on services, it is typically necessary to enable tracking of services. -Correct tracking of services requires the presence of at least one rule in the rule collection – a simple audit only rule will suffice. +Correct tracking of services requires the presence of at least one rule in the rule collection — a simple audit only rule will suffice. For example: -```code +```xml @@ -124,7 +124,7 @@ In order to enable trust for the binaries laid down by managed installers, the E This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption). An example of the managed installer option being set in policy is shown below. -```code +```xml @@ -149,7 +149,7 @@ An example of the managed installer option being set in policy is shown below. To enable the managed installer, you need to set the AppLocker filter driver to autostart and start it. Run the following command as an Administrator: -```code +```console appidtel.exe start [-mionly] ```