diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 83fd0ea765..b311f49601 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -58,6 +58,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [September 2020](#september-2020) - [August 2020](#august-2020) - [July 2020](#july-2020) - [June 2020](#june-2020) @@ -1414,6 +1415,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • Update/ExcludeWUDriversInQualityUpdate
  • Update/PauseFeatureUpdates
  • Update/PauseQualityUpdates
    • +
  • Update/SetProxyBehaviorForUpdateDetection
  • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
  • WindowsInkWorkspace/AllowWindowsInkWorkspace
  • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
    • @@ -1996,6 +1998,11 @@ How do I turn if off? | The service can be stopped from the "Services" console o ## Change history in MDM documentation +### September 2020 +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Update](policy-csp-update.md)|Added the following policy setting:
    Update/SetProxyBehaviorForUpdateDetection
    | + ### August 2020 |New or updated topic | Description| |--- | ---| diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 7986a6fae0..5bb7f9d9c8 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -3918,6 +3918,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Update/SetEDURestart
    +
    + Update/SetProxyBehaviorForUpdateDetection +
    Update/TargetReleaseVersion
    diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 38e9dd4066..4eb6ccaccf 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -194,6 +194,9 @@ manager: dansimp
    Update/SetEDURestart
    +
    + Update/SetProxyBehaviorForUpdateDetection +
    Update/TargetReleaseVersion
    @@ -4133,6 +4136,78 @@ The following list shows the supported values:
    + + +**Update/SetProxyBehaviorForUpdateDetection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark1
    Businesscheck mark1
    Enterprisecheck mark1
    Educationcheck mark1
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in Windows 10, version 1607 and later. By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents. + +This policy setting does not impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security. + + + +ADMX Info: +- GP English name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* +- GP name: *Select the proxy behavior* +- GP element: *Select the proxy behavior* +- GP path: *Windows Components/Windows Update/Specify intranet Microsoft update service location* +- GP ADMX file name: *WindowsUpdate.admx* + + + +The following list shows the supported values: + +- 0 (default) - Allow system proxy only for HTTP scans. +- 1 - Allow user proxy to be used as a fallback if detection using system proxy fails. +> [!NOTE] +> Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure. + + + + +
    + **Update/TargetReleaseVersion** diff --git a/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md b/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md index 617be22113..8e70dd707e 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md +++ b/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md @@ -66,6 +66,7 @@ ms.date: 07/18/2019 - [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) - [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) - [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/SetProxyBehaviorForUpdateDetection](policy-csp-update.md#update-setproxybehaviorforupdatedetection) ## Related topics diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 0ec64812e8..b43ed6868d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -97,7 +97,7 @@ #### [Network protection]() ##### [Protect your network](microsoft-defender-atp/network-protection.md) ##### [Evaluate network protection](microsoft-defender-atp/evaluate-network-protection.md) -##### [Turning on network protection](microsoft-defender-atp/enable-network-protection.md) +##### [Turn on network protection](microsoft-defender-atp/enable-network-protection.md) #### [Web protection]() ##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx b/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx index 84b5f2a664..bd35122350 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx and b/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index f081c6ad4a..b54b1ac8a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -1,6 +1,6 @@ --- -title: Turning on network protection -description: Enable Network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager. +title: Turn on network protection +description: Enable network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager. keywords: ANetwork protection, exploits, malicious website, ip, domain, domains, enable, turn on search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -14,7 +14,7 @@ ms.reviewer: manager: dansimp --- -# Turning on network protection +# Turn on network protection **Applies to:** @@ -22,6 +22,8 @@ manager: dansimp [Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to view which apps would be blocked before you enable it. +[Learn more about network filtering configuration options](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering) + ## Check if network protection is enabled Check if network protection has been enabled on a local device by using Registry editor. @@ -40,9 +42,8 @@ Check if network protection has been enabled on a local device by using Registry Enable network protection by using any of these methods: * [PowerShell](#powershell) -* [Microsoft Intune](#intune) * [Mobile Device Management (MDM)](#mobile-device-management-mdm) -* [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager) +* [Microsoft Endpoint Manager / Intune](#microsoft-endpoint-manager-formerly-intune) * [Group Policy](#group-policy) ### PowerShell @@ -62,41 +63,17 @@ Enable network protection by using any of these methods: Use `Disabled` instead of `AuditMode` or `Enabled` to turn off the feature. -### Intune - -1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. - -2. Go to **Device configuration** > **Profiles** > **Create profile**. - -3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. - - ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) - -4. Select **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. - - ![Enable network protection in Intune](../images/enable-np-intune.png) - -5. Select **OK** to save each open section and **Create**. - -6. Select the profile called **Assignments**, assign to **All Users & All Devices**, and **Save**. - -### Mobile Device Management (MDM) +### Mobile device management (MDM) Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode. -## Microsoft Endpoint Configuration Manager +### Microsoft Endpoint Manager (formerly Intune) -1. In Microsoft Endpoint Configuration Manager, go to **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +1. Sign into the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com) -2. Then go to **Home** > **Create Exploit Guard Policy**. +2. Create or edit an [endpoint protection configuration profile](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-configure) -3. Enter a name and a description, select **Network protection**, and then **Next**. - -4. Choose whether to block or audit access to suspicious domains and select **Next**. - -5. Review the settings and select **Next** to create the policy. - -6. After the policy is created, **Close**. +3. Under "Configuration Settings" in the profile flow, go to **Microsoft Defender Exploit Guard** > **Network filtering** > **Network protection** > **Enable** or **Audit only** ### Group Policy @@ -112,6 +89,9 @@ Use the following procedure to enable network protection on domain-joined comput 3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Windows Defender Exploit Guard** > **Network protection**. +> [!NOTE] +> On older versions of Windows, the group policy path may say "Windows Defender Antivirus" instead of "Microsoft Defender Antivirus." + 4. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following options: * **Block** - Users can't access malicious IP addresses and domains * **Disable (Default)** - The Network protection feature won't work. Users won't be blocked from accessing malicious domains diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 11aa392b29..af31192f3b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -55,7 +55,7 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- **Dashboard** | Get a high-level view of the organization exposure score, Microsoft Secure Score for Devices, device exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed device data. -[**Security recommendations**](tvm-remediation.md) | See the list of security recommendations, their related components, whether software or software versions in your network have reached end-of-support, insights, number or exposed devices, impact, and request for remediation. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Microsoft Defender ATP. +[**Security recommendations**](tvm-security-recommendation.md) | See the list of security recommendations, their related components, whether software or software versions in your network have reached end-of-support, insights, number or exposed devices, impact, and request for remediation. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Microsoft Defender ATP. [**Remediation**](tvm-remediation.md) | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. [**Software inventory**](tvm-software-inventory.md) | See the list of software, versions, weaknesses, whether there's an exploit found on the software, whether the software or software version has reached end-of-support, prevalence in the organization, how many were installed, how many exposed devices there are, and the numerical value of the impact. You can select each item in the list and opt to open the software page that shows the associated vulnerabilities, misconfigurations, affected device, version distribution details, and missing KBs (security updates). [**Weaknesses**](tvm-weaknesses.md) | See the list of common vulnerabilities and exposures, the severity, the common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed devices there are. You can select each item in the list to see a flyout panel with the vulnerability description and other details. diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md b/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md index cc9c36fae9..2c2ed8bfbc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md +++ b/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md @@ -76,10 +76,18 @@ To add a new policy: 4. Specify the policy scope. Select the device groups to specify where to apply the policy. Only devices in the selected device groups will be prevented from accessing websites in the selected categories. 5. Review the summary and save the policy. The policy may take up to 15 minutes to apply to your selected devices. +Tip: You can deploy a policy without selecting any category on a device group. This action will create an audit only policy, to help you understand user behavior before creating a block policy. + >[!NOTE] >If you are removing a policy or changing device groups at the same time, this might cause a delay in policy deployment. ->ProTip: You can deploy a policy without selecting any category on a device group. This action will create an audit only policy, to help you understand user behavior before creating a block policy. +### Allow specific websites + +It is possible to override the blocked category in web content filtering to allow a single site by creating a custom indicator policy. The custom indicator policy will supersede the web content filtering policy when it is applied to the device group in question. + +1. Create a custom indicator in the Microsoft Defender Security Center by going to **Settings** > **Indicators** > **URL/Domain** > **Add Item** +2. Enter the domain of the site +3. Set the policy action to **Allow**. ## Web content filtering cards and details