From dad8d2e2fb4bece4dfa2cfa27aef1fde33cac6d2 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Fri, 4 Sep 2020 15:59:34 -0700 Subject: [PATCH 01/12] network protection update --- .../enable-network-protection.md | 45 +++++-------------- 1 file changed, 11 insertions(+), 34 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index f081c6ad4a..12bf4e6a76 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -1,6 +1,6 @@ --- -title: Turning on network protection -description: Enable Network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager. +title: Turn on network protection +description: Enable network protection with Group Policy, PowerShell, or Mobile Device Management and Configuration Manager. keywords: ANetwork protection, exploits, malicious website, ip, domain, domains, enable, turn on search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -14,7 +14,7 @@ ms.reviewer: manager: dansimp --- -# Turning on network protection +# Turn on network protection **Applies to:** @@ -22,6 +22,8 @@ manager: dansimp [Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to view which apps would be blocked before you enable it. +[Learn more about network filtering configuration options](https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-protection-windows-10#network-filtering) + ## Check if network protection is enabled Check if network protection has been enabled on a local device by using Registry editor. @@ -40,9 +42,8 @@ Check if network protection has been enabled on a local device by using Registry Enable network protection by using any of these methods: * [PowerShell](#powershell) -* [Microsoft Intune](#intune) * [Mobile Device Management (MDM)](#mobile-device-management-mdm) -* [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager) +* [Microsoft Endpoint Manager / Intune](#microsoft-endpoint-manager-formerly-intune) * [Group Policy](#group-policy) ### PowerShell @@ -62,41 +63,17 @@ Enable network protection by using any of these methods: Use `Disabled` instead of `AuditMode` or `Enabled` to turn off the feature. -### Intune - -1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. - -2. Go to **Device configuration** > **Profiles** > **Create profile**. - -3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. - - ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) - -4. Select **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. - - ![Enable network protection in Intune](../images/enable-np-intune.png) - -5. Select **OK** to save each open section and **Create**. - -6. Select the profile called **Assignments**, assign to **All Users & All Devices**, and **Save**. - -### Mobile Device Management (MDM) +### Mobile device management (MDM) Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode. -## Microsoft Endpoint Configuration Manager +### Microsoft Endpoint Manager (formerly Intune) -1. In Microsoft Endpoint Configuration Manager, go to **Assets and Compliance** > **Endpoint Protection** > **Windows Defender Exploit Guard**. +1. Sign into the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com) -2. Then go to **Home** > **Create Exploit Guard Policy**. +2. Create or edit an [endpoint protection configuration profile](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-configure) -3. Enter a name and a description, select **Network protection**, and then **Next**. - -4. Choose whether to block or audit access to suspicious domains and select **Next**. - -5. Review the settings and select **Next** to create the policy. - -6. After the policy is created, **Close**. +3. Under "Configuration Settings" in the profile flow, go to **Microsoft Defender Exploit Guard** > **Network filtering** > **Network protection** > **Enable** or **Audit only** ### Group Policy From ede7ee4845b1e8fde93ba929e99e4273d1720b17 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Fri, 4 Sep 2020 16:03:15 -0700 Subject: [PATCH 02/12] remove enus --- .../microsoft-defender-atp/enable-network-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index 12bf4e6a76..dbe7692a37 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -22,7 +22,7 @@ manager: dansimp [Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to view which apps would be blocked before you enable it. -[Learn more about network filtering configuration options](https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-protection-windows-10#network-filtering) +[Learn more about network filtering configuration options](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-windows-10#network-filtering) ## Check if network protection is enabled From 84e7eb14d12f90403fcd1eb2046a49acf5ae2ae4 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Sep 2020 09:32:48 -0700 Subject: [PATCH 03/12] Added new Update policy setting --- .../mdm/policy-csp-update.md | 76 ++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 38e9dd4066..a628a70813 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -192,7 +192,10 @@ manager: dansimp Update/SetDisableUXWUAccess
- Update/SetEDURestart + Update/f +
+
+ Update/SetProxyBehaviorForUpdateDetection
Update/TargetReleaseVersion @@ -4133,6 +4136,77 @@ The following list shows the supported values:
+ + +**Update/SetProxyBehaviorForUpdateDetection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark
Businesscheck mark
Enterprisecheck mark
Educationcheck mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents. + +This policy setting does not impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security. + + + +ADMX Info: +- GP English name: *Allow user proxy to be used as a fallback if detection using system proxy fails* +- GP name: ** +- GP path: *Windows Components/Windows Update/SpecifyintranetMicrosoftupdateserviceLocation* +- GP ADMX file name: *WindowsUpdate.admx* + + + +The following list shows the supported values: + +- 0 - Allow system proxy only for HTTP scans. +- 1 - Allow user proxy to be used as a fallback if detection using system proxy fails. +> [!NOTE] +> Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure. + + + + +
+ **Update/TargetReleaseVersion** From bb9f486e255faf57825632ce04c87721c093e0ae Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Sep 2020 10:27:15 -0700 Subject: [PATCH 04/12] minor update --- windows/client-management/mdm/policy-csp-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index a628a70813..d964981cd4 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -192,7 +192,7 @@ manager: dansimp Update/SetDisableUXWUAccess
- Update/f + Update/SetEDURestart
Update/SetProxyBehaviorForUpdateDetection From d9a3d81a0a1941f7e941ee6df91942732ed0e815 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Sep 2020 12:18:58 -0700 Subject: [PATCH 05/12] Updated GP info --- .../mdm/policy-csp-update.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index d964981cd4..4eb6ccaccf 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -4152,19 +4152,19 @@ The following list shows the supported values: Pro - check mark + check mark1 Business - check mark + check mark1 Enterprise - check mark + check mark1 Education - check mark + check mark1 @@ -4181,23 +4181,24 @@ The following list shows the supported values: -By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents. +Available in Windows 10, version 1607 and later. By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents. This policy setting does not impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security. ADMX Info: -- GP English name: *Allow user proxy to be used as a fallback if detection using system proxy fails* -- GP name: ** -- GP path: *Windows Components/Windows Update/SpecifyintranetMicrosoftupdateserviceLocation* +- GP English name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* +- GP name: *Select the proxy behavior* +- GP element: *Select the proxy behavior* +- GP path: *Windows Components/Windows Update/Specify intranet Microsoft update service location* - GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 - Allow system proxy only for HTTP scans. +- 0 (default) - Allow system proxy only for HTTP scans. - 1 - Allow user proxy to be used as a fallback if detection using system proxy fails. > [!NOTE] > Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure. From f2640ab730886a5edc652fb1610a4d8b5aab05ea Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Wed, 9 Sep 2020 13:03:42 -0700 Subject: [PATCH 06/12] updated link --- .../microsoft-defender-atp/tvm-dashboard-insights.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 11aa392b29..af31192f3b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -55,7 +55,7 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- **Dashboard** | Get a high-level view of the organization exposure score, Microsoft Secure Score for Devices, device exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed device data. -[**Security recommendations**](tvm-remediation.md) | See the list of security recommendations, their related components, whether software or software versions in your network have reached end-of-support, insights, number or exposed devices, impact, and request for remediation. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Microsoft Defender ATP. +[**Security recommendations**](tvm-security-recommendation.md) | See the list of security recommendations, their related components, whether software or software versions in your network have reached end-of-support, insights, number or exposed devices, impact, and request for remediation. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Microsoft Defender ATP. [**Remediation**](tvm-remediation.md) | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. [**Software inventory**](tvm-software-inventory.md) | See the list of software, versions, weaknesses, whether there's an exploit found on the software, whether the software or software version has reached end-of-support, prevalence in the organization, how many were installed, how many exposed devices there are, and the numerical value of the impact. You can select each item in the list and opt to open the software page that shows the associated vulnerabilities, misconfigurations, affected device, version distribution details, and missing KBs (security updates). [**Weaknesses**](tvm-weaknesses.md) | See the list of common vulnerabilities and exposures, the severity, the common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed devices there are. You can select each item in the list to see a flyout panel with the vulnerability description and other details. From b8913f5b229394d0ddd52e00dd973b56a9bed48a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 9 Sep 2020 13:30:16 -0700 Subject: [PATCH 07/12] update urls --- .../downloads/mdatp-urls.xlsx | Bin 18213 -> 18176 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx b/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx index 84b5f2a66467e388d41c0299d5193fcf0b3e2fd3..bd35122350d32aa1293c2156966b22a90c7a39c5 100644 GIT binary patch delta 9930 zcmY+qWmKF?(=|M}JHaKm1-D_a1a~I{cPCiz0E2t5!JXg`+$Fe6a0u@15In#;$vMyY z?(h25Yu2vn>XKbGy}BS8#xEMC3I+*GL-B%74+j8vA^`wc006+lj@{kC+1A9t!IsVA zqun>nkIG9N*v}%?FI|_n*n(%_jOx?0B)AG;uID(Zy}1OQkgW;oUhta0$3@P<5|c8W z*7jDR+vQ01B11mc;H;)&$)!;aVJe~vdIz*gq0#dga|?K)>j++ivc-_`b8hh2MRM(U zw$gmLcbmhKG(132w1=gjWsv95yU%tmyN=x9t$IU^1#0wV*RkM`_GBec%hg;b$irex zBCruTP6#oNRX*-2e=IbO-v*7^vk!mbOzZ0rLmfyIvBKigX+Ns1T+pwHFi~ZkhEd9u zB2$#7-0b#M(Dz)nMVULV^E@y-f$b%Hse6S@+(?6iyesU)Zql#TJ0?yhA4tI1BNeQQ7J_qLppmbn%% zM={Tp)nP{vav%3p>tFH13b@!ikSToq#nTxEzrB{>HM}ultFJIp%uKtjGx20AVKRJm2lAVq z=#x=L0$;lz*))>&L|S8oJzCcut-;h^U)#(BbxurXC%BKBz$*GRWBIwXBoaqpPv*jGLh>AI8nCte{KHman{qLlD3^{;$V&T(R(QP?nd=BrlGX!W@t_XFu&|$o` zqSLBRlcy8KQP@4z9m97=Sbl9iz*=-$0WBzLh^+@M+j2l3K6MX+wG+iJuK7qp57AY?!p4kv~18C37C-PB*~7tQijV+hgOAGJ=SM+4873H-COY=O410FB+nDt%cJj z_r32LAx_zv&M0{&*{usJ6SF5%xuDcSn55fP;o(rI=aL!KX!H1M4ZTDB*DKK}V5`8C zt_e>?y{1c1az zkU)yjvA{_sFPNL?xVjAzbLfcEwXNe3qrGBwBP>j^x9B&m4yr==rKiozN$IdHTifUR zHTjg0-#$yoQ$AllUa9X{wy%`)v(K+=Z`Ldg8NN>sy&h>iIt4#novzd^Eu18?V~rGz z$@{K6(X6??TwaL2Z1q%*-8`Ohj^C2&ZkW5T_<)zs4A*YGT4zn4+m`k146X=UcaAI` z+m@HW_8r%5l}q0DjvfXl$mfm31jdG?i>?#GV`U&iJuk2HN-wVynG7~Yu2eSEH4 zUb;A=n6GRtUA$s0T)uLCd>S}vo!z~kO}eY`)j4|s;-9!>X`K zG{JkfrkJ=I>dvC-!XVOIa z_3zy@C*wBBPmv=Bvo64tAf$8+qlgZT&*bp8i!4|XJvi>I%j}}QKka>8j}N-rb6V%k zoh}tu33np4Y&ANDuW{y2jw$EM&a(OG;C6nJF2aE|HGXR(w4E+$O?kP$2S43kT#BC+ z3HNI`db5$=(3O#gpEVgvuemQLVLooo@*=jI_Vb3cZ&kR^-UMh865l6%?&G>){nW>G z!HU+$bX{DaAI}%l)y0#&dB5O2H3$-=nm8U8{6#&Bv#W$MAUOcyMO z$XC?~;9-_m6h|$==VD4xGa|VOc96|0o{)g1B_W86Y0y1j{d z)hSV8laciuSz4|-fP>KsmXu~Vr9D$V7ICw>ym&GsER;2Wo&8lNv8x|VY1Di*%!cvO);MVO=M|n zl+EHdyqHY+YJ>Ska{f;E@51$Bzn@&HX;^iudg+n*I90coya7c!mxYS!4O{-P4SvPx zRkx~6NN8c*2c5Bks#q}{lp;bq?b^Ns0z|W=FG+q8s9;4u=#DDplQ4<8!f!VZMYf#K zdnFH|%dm5%HUaV7VyM=1@Bm(21#9EClI-*G6S)$2)G2yWaEHc`)%fHMm?(65a&Vq; zs{LXq37}pS3M70cG_@%ml&XkxA`g5W$;QRgpyUJ$ho+SvCIz(2D<+*Cix>g~Od*28 zKG&4@-~%UXS#$p)mtXnyxL-AA1x`4N^Cp;EW|HcLr5gR;Tcb{w3Nh@yZ(hiw(?XYA zq*LmHYc}&6ur1gwC8bDyuYF(qW)Lzb7xrG0L89yzV_n_x`p3v{T6&NllL8A7MNR;c zd?C`J%C@s^NsqdG!^0<`;b2MscPA)aHqrFxhhWC42!h6)88w{;iCufyMAD{>3}B9f z&2)HkUsvZ_wilJ|%)Pqjz=0mNxv<;wrcaTu2$xV(yJs`>iDpzC>y;@YQhzpK2MwKN zAZr1A-eR1YCq=$<<#1u!hBtZJMoo=;Jeuika0Ibc&1C9O2tT;M% zkBy@*px~W9U>pIYLq@<71G%gMcm_rtuG4YRpM>JA&arJEPUNUy0XCi;Cc|zqUIY#y zP8Lr$MA8FYNTGR6gjFEH%Dc5uPE2e>NdxpM*{D`pTMypy(1_N&09!SLfe2pOgWx|2 z)Sa&f4)c1y1Quk9oBf!Cl5HWYdVfT20uGI~KM%=K6)tChLq=5x1V|zA@$qpcIgBn5 zi0yRbN?iD$f)alvbI`k@<>Se?azjH>^vMk|g`!_Udqz6~tKL+J_;4WHQ5jAZe9(z{ z!sc`RE~!ar5Uoduiz&WuHnHI4{^0G?Y}cT>MFLbz;4~#KTF{+Qhe}y0!vE`pHD&rQ zQxm)tl3lP;VtGc2AXz%PIb{WA$UftJ#P(%_4-7(kz6s1m>!sQMhA9OYnPO#o*b*)x4%FPwb2r?KWM9=0}X; z17|gg!m}B*-o{UO-nQgad%z4LjVWF^_C-XPB3NZWcvjU;EbHHGa1RC~s5y8iP^77g zHzwoA>p?_cdm8P|?IH#xs<@Le&8h1dcsi)LaAs7I8^$FbI8%`oFyMPqk!?KS&E?C{ zL%49tF%>Jr6yRO;{1U=vvambK`SD^+G1)2fy^PX3 zkARUrCFDbAm0 zYr=~EgX{geKLMLS{F5{W-A9dWa`fJV1d;_#h=%(0h|x2nHc-SXE@P${CIt?G45n&o zYFujQ_y|gmGiKP3w9Xj-Lq=Lo$nDqRb||`s$sI2Q4=2sYkc|vgaS-w+mmC*E=>t_yH(%3%Rg-uT9lglgDTTb^gRnUEZ4)@Y5pNJ7P^M-inH9d|0P`cn{a)>>YGU^f5 zaJZ6)!?}ne>eerIbDHEIPWlGUh~f2gonKk1xV3S7jMDl|AGEp_W(jq z@Z!Y7``4`AgK=?MvT~X4&gXRWJM-H?Ino4u2y^Q|Q^-~7pD zKm(Rw2&XZU!Upk&^j`=lP?3Y%sXuvCiwO!gF*NqmoO6O_OsuO=|9b#vu%b+eAgX_Z zrJ56hB;C+8Y(#`;gV#VDey2a_)e;^k^smJfP>X5)T1=zT6G(G~ z?8XS%R=z+rlD!QGLUyFw;7 zstjMw&2T8-V#Jz#ZlJ0~jBIkqeu${_;cq$3d}eM3M0wm`iZ8c0X8id^)Nbw*cYOrb8~51*s6aip3N|1Tt?U+;pZcCqYP z6gN@>!Ey{6j&mGwsliZZ4Ssp~2IHRTL ziKxd3EYD=&Q4$Y3^=P>D4}U1Ugsa#P@LvAC(Gz}_3p|^dA3jj9#@Uc9afVj6N$cUm zRYK8#ThF88VH|;3TdI~qg456G4KQRPCXm`-gBFgi?SPi>=lM_WSttJ9GC8hN(`Skp zXHQ-R;>ZWpqSQhS0cZmc-z+dEb=Z9cv5zWU@Ajk$*8(oTMTsFSZ}xm6)FBrm*s(2) z`{|e^MOVUOYVnhvz@QJY$5#()raoO!UGMyD{7XorXwP;gR-gHH;Y|jR671Z8U;-U;S>S1 ze)-QGs~R!VKPcD|qmNd9CPWNI`dcJK{U6Yo_rjd^L5x#_T zzaewK%?)MDWZ6!#7-xFKe=E0JYy@$2R7@5rMRN9za$IecnhZ0lxuhe0s9~3iKrd8# zkPjR^%!U>L`wuO@sbgFpdy~N7r>)`R8wQpHq7hyBAZa;!e)9}Nm^UW4R0*Z0ta{JKZa<5>_r3OSW~PO`kvm-8P73|J8Mr_du>!VDGs{^kZQkM%|)qqsd} zJrn*A%Roo>XG$}&Qv986%%~{T!>DLXv_bFtZCUDdx>#RcXIK*@Ot2o&r9mKq=f4dp zWG=UZIAki9J8B9)1m|>OK-1DELr+|1zDC-=i~fOw=6E!iO84kLe80frnUlgJhB}ed z9UBZd!BJWLQa9Qn0*V#}_2k@;7OdDJ*024;bwqns9Rr*v{0dMrZb<3$h-f@bqc>HJ z93K@s@WRDTM`Oos0)+ljC~8kiM&6SMzO_w1Hp-ppgq&*QFG{g6##A|0xGme_M3 zhm3aYzk?RXk4ax;lSKz`N;gOM3BR0&z(7HpRWW^YhMFQZdQ<37-@CIPkbnK*n2`sU z-RrW>5$qHs=$LTsGzgU7#lb8<>Yyc?3Ce5uwDOwnAJ0LNDA~O{8-I}Lf01aRHq>Nt zq`pi)yl#uPe_$@SvJXP1y+3RL{4p5{RyKKXOz8%8`vB$cfM#b!X~;+&2-zH%hrOyx zndCF!kiRqz)r-g8j;gzQAo+x-z!tr&woA>CsO9`1Wo&oth;HS^Sl;w|QKLLIN^;$4 z57BjV`(KhF+S~7C;LHRnU~nwI&oFj`%N#tjNHZ3t;0(ycrzWZapJnCM2y*8$(EZZ@ zfYJ;i;Rn6OHhvooo9N;PHApUB)fC{xFR;{vpzS0nml40t2Qx9D3s` zOQPZQ$@j{0}sn$?J56o_h+WdW(&g7wO z04$ZgE7hyJ!MJU}TTIBHEca&?=>`_=?e}3xrg=G~2$6+SCVoTqzstLN_?P|+w*Hg8AG$t7i3zym{IgL)6FF0zg zmi_CNip`Z=ps+NzFC#UWKJ+*J!gyK<`Ece#deDEcp<-!-PUm-r^EYs0M*+ z<^!T3boz=ayMu--N;%OY!^w(VaHCj(!O@D>%FT+tJ2wScdPiV0cKECBp)}bPByON7 zB4&$h>`ueFpEz``8ZUa-1va#S=00+B(dy22EKx2f?~=?(#vH7Ab{r<|#dS%fb>Wne zN1V+(2Hctexpk|iDy=i}6B@?rb~I+8@7ooe$UX;-T+5^3t;GtJ`r5Qoh%EjACcEi>cKIfByE|zSc&eAy~|w z{^Wb5_jJSwHWb-j+B9^l@m;aInH4=YR-budU3>93v1>T`ZQik5`R96Xe$1^yzv6b~ zN8ap9eKl#8z2W=~=G}9F{@K%Lfq$pQynx zb|iv!xtq=HM#KK<X9+udd^JXY{BWI5KeQ61@^&5n%p@4#I)3bTQmJ);BWBcxu2EQN~AFfHS z#p)BDl&YXYLg!)l1PL`d4RN(ECoZL6A`ErAgkHB5r!+UQ=GVl*O1Q`3w7G}AeB}sS zscK`=Lc3nZRyZsupzHxLW>AFxZ1Yl%Kd*awsr{JdWcZNJjB+;|ojUOWT8`}q<0j1K zQTrwPC7uteu)_nY&caJ2m0x@+qVs2}UVUC?6q!1bQrn+F-Bz&5)`QIhB4mCBQ*}hZ z5cmgO>3p|;81u^E+-~YUb%i6AH@C(nAI%uT;W5_!!a{NtxA}qfE42A)yODE8)m?d^ zgf=#R_wv&ZAp6#M;Le9 zQxrS1&BzNG!6Mdt3fTq5IeHi)yGT+Z@ytP)d7Zj=USl<0D=CsB5~X(@0UbI@8!vG) zB=5B=VDYJu}U8DlAf&JovaD`s5k51Rn+9XaXzT4>jL^h=;6CQ6kG6MaZovx zZ6ZQ|GE(}h#nH%2R)duXjCG!Yl9SNI`CD`HAa)Fclk8q-QN(hoDe(9F#_0;@uZluj z>Q^s_K*q?cIKP<8ZY}ZUYV_P^mk7G5`ETU3mMNtslihM3KGF#$AskX$8g?&vtWce1 z$Ia`%6+Y9*!fMD#7ipY`4(dL*UvnezJUih5y%Mi%SqrrJ)xT7x3T}Bj#(dyxo3^aR zP&>hMJ#@A|942oUV4rJo^IgxwsD__`E2z>Rf-6xCm-K7d-Rs`pm7Z&Ep#A0*%?D2z92l<1b*#0q`|7-q zaChOSt;AH~W>urI_-O)YUUkmdud-nE=~Rudz~^WP{uFT{O+=B6#wY>Nb*_UB+C-|{ z$>!9x(-~^`I`BT02blO?T)?f-lOy%jo<&&35DA%8j+n@Q`yJurisTk@U292*t)nB6 zL{YrPCa%mP?+q3eF9};0?4UA;pI|m13Jh0fxXiw$7ePB%B`I$wR%*uy)DQZyhlS)O znYyGL3;}0X0~~4?(qw{#!hB61yXjz68A#UJQ>wPj8PS@$#Rw*~zlDy7Wq)f2bF1E9 zFDJ}DKtyFe%G{Y<`$Xpcw#S>5m>{-S4{HlGv@L8>eg=O(09zTZp&!;KO*_nzB#)NW ze}8rzv(>wh}BaLd2jg)M>J`bCMPhlM;5i_h}eK5-ACMs2z#WDRH- zX=^-E+=J|a>bnZI=13G5OY75;4L+_nUmscIfwwT)aL-ob&RocrTx$tM2ixW+g*e~w zA01c#(DoupIk*zMyS9Wi*du zALQc+_kq@}m5bA@zU*=9Zi4O)C9~#5gc+_WDsj;TX$EfeSYX$2!BJ3!NtP8Io1nb0 zAlTsPVI;Ud+Fxs7 zTltHFT3<`mH}`%qDSG6d2g~nkWw3lM*>Bw_e%(B^B|5tOIDO0s{`P#cG{C$RCOum~ zT5@SQ9u88hFRhTGM^Pgt{&)>Rqs|Oj&MEkmxB@f*w_^mUNV2^XIQYmXR(j`h1b_y=}#(mP6iJOv?f zCV0NB=IJm+V$QsJQx=#vuO_2dtkrkV6%Qnolk?rEms!40MGE#~98XwVxG=LGPb0z{ zE7+4id*Y8;P%}Tp)5_l@oFCvHEw^K9CbC9!-!}jFc6Nz!a@%B{sn$AG;uF%rU3jg6{}mV7yXsByhwr8=yAf>2*&^D}u* zfhZhA{iX+|3Mnp316cb;I0W={UG!U}X5F?qF85*(S!@4|UGJ;x0GyeGL|(eL*1fCF zc*w3)RTq=`_Lj#2A_!yTp~2a1_JI0KN>P(dXX20nKGkpkv?0Vzl^IrKuj$%145-rGnrq;F=`i#I z^TB_Gn0znJ6jB3t7*J*1Y=1&@cdey)8mn*RAc=sMHSqpk(TMN zWfISBp!Qe-B-t2_#@AVH!`kN2f#f#CTfl3ISjjpS$W&iB`^Nu$vyxk@DO zj8L7r`J%F_v-eo@1{z{0mhjpX$#d7MSp$o<4=AgZJM?3d9@|7svTvo2uQtMbM99)z zR9Arqz3T4dy82D)pbIb@jDFch|V)ksfxa~Zu&8Zvl7A>E($~e8t;`XQzY(U z$lQI$T=+>ahQkrTtRj#2CNA_w8^7CQVhq678(;cv)14Bes5pF44e769b`&ldarI{y z6ZzB+>vA`U27W6>5RpHZHMeGkFr0EMEaB&&ybf|OPB$|AG7LX0vh^E{&`> z^Xsk)-MFoia^Ur7HTqN!A0^4J+=-#}hknx3sz^4CulN2XVCy<-(#EH+{3jN)!E~hF zft!1>^hA!V7r?X!>(N!EDzu@IRJS4oI*BO90K&Vjip3cKUD(Kw}#4Fgr8k`MBf+QO*ur(i=ASaWjc*JtUG#dOC(o<#4- z*KF!?sURv4aA|Cd!0ko_@vAHP3a^|RU#y#*hb)Zb7@|jc#)2A47F9EHbDpP36&sh$ z+?>yKKX)~!o$O*VU;wR^w@W1zz6nb`f*17RK0yXE?ZN6A$`=M^M4Iw0IKC|_@6vuR zTB_TVy*8)PXe1L{tGE~3Mv4IWd+T?v%Xy#gapsi9fs3nSMP)KLi2VDGobPtsbSDZ? zVl_zKzG{%#PVwev^Fea-oZmZS&E|gM7q4p(oPa8fC&DtYOQ476OSDIVUJR9zuDt& z?;{hGM=YgB*$$J!u@_Dn=^^l))0#8Q3oHs2G4&^%z2hSF487cJ-~`7D7^acWMS-iy z*MnjOlGam0y0OQ8Y)5PehHq(! z3UuE1@AHJjN=U*GLgpmsN&mk;jQ{|~e~3SeBnYA8YqI}F6jA^H`tId_J|i|rE*k;F zT9O&offrKEO9$PR88(~`GQ!6M!IENz#o~vk@)NMA$iu+0LS_GN==mFd7yv*O768Ec eAAQjMA>L9VFhP)3DPb5z$h{Oj;ydv_fd2< delta 9921 zcmZX4WmsEVw>8j0f#UA&E-7wBf)=N^7k4Nw8}|YwSaEl^;spW(r&zH9#R|o(xLi)p zd+xdK_vP14o-ya1nPbec)=pMn9DGq6d@cM7U^28phw>R5oc#+pI7~P=I4^rnPbXJ9 zGbblI4lf7$N-YPc3@)q(F`LJpQ%^!AG?da`cnH?Xi)Fj@7aN`_{biQC z+?;!QzN4BM%oFA|(Rn3s-&n6jGIqOl7PFEKrKvY5u_n#o}tlkUk_j*o7wP-N%$qx2}NdN!DFSr1u5 zJ8ruzNW*R62f1Wne2=OHv)jkgjv5(r4=O#)?{N2y>`RW)6=&u@Y^y16QZ~yS;n$Vl zPKluB63u$Q4_IXyJ7PihRrGJ1Jx2c_3mEEjOyZWVw3J&^Yn3RtA$%Q=JI}Z(+f%(^ zL0tMQD1Z?qs3)SJ4}Hc;-T~2a?nX80F1?+w#?!OgNk&e*R0chEk3p?UiYoiYs@<`j zmN+|_lgqivy{x7rNz_J9@ZxM~jZogN4s=#Z?7b=7Hr?L;I<8FuUx|IAFd~~R4)kPo zmtxT$u{H#MqaY6!L6)5OJmKgLDt;Wce*QQCd6|2hERH~p+&+J~C+L;w55(Ct%caEP zq_e5_?!1$<9J1K?z#Q94Ej!7A>Vu9&t|T^{bOq|S&9`w9|Xu%bSi z>rTDVU=7XJH*&k{P?7}dRQVk6YG-`JDd4=S=mnmS2tY6xRhz`c&$p#EXV_em4--^WB|h zUAp{4Q+es=gU*RWC7MawE^6uf>$T3|^V{`K68lMa9)rT=X@K_*by9m>Ze#za9CRyn zWOnOgGvTk@TL(VS6lH;Xxb3|A4z*R~+JXuMiy9w-ERE4%hDwisI<_>-8;J)8hXH|n zL}Le<%O3gG(Qx$Rq`#pdO*gbpL@U80?MGOdrmQ?}U2d1G#QS|-wKuN59a@n2lKQ3c^JPYA&D{Ot&GvG;?w8Nvl}3l!Dod$% zZI7~DM~_=j-~o1$~l^gzdo}Cn*GO&_h~Vgmd|!g z9$RmHx`5@airWqFgvxeEOw7;|-Oy7(&e1z-oaS~`-#O_qu`wj+v1UEO-+iiadZ1@D&uVjpaQON2aYbY z?pM1X_$xi!W^7a@GJZR@uZoe4+i#t@j^3SfPH;|W@3rBGKbGJQwl( zknYzd#*#KfoXqjGgt7f(o?_r}(J=?muR%?3{`xBiV8u|gW9eHjeW+g!U>)Xk$a^WA za9?N7oiKY-d;Kw$-pT3$fAR6i#s1>5V#(Ec`}dAmhxonGhx0=L(uXc!Z+RQD;z%U| zum?C!$L3%mtva1gtTgEQ!d;^!TGe5*l_;mW$YwbT?X7l$eHNDu`z1*0{ z$+(4XxC2~5q(OfVaMx1ESN4_BO!VTe3`gY)&x`HWf)vu zzP&$LTfe`?^o^`pyV4ZeKdUB>I%+Y6b$fnKiR&{8*`<+M<=Lj8U3H0|>1WO**_;3D z_m&NJwO*A?W3^tBjdwMXB}H*HkvT=WqZx@J=Jb4>p=2#n|M1n_dL`W&Cg;TdCUeO} zPOmXu=iw6b-acR~GN)1m^IyRAey*9ae)TDe(OX|^M^x6uZ#3C7a$`fej0PiNqNqQ+ zUs(lAMin!xo+%Ks0WgPYqJF|tVpfWQ)Vvt%ihgd*CCqB6eEy!zw(*2X^fg7Y%$Azi z&IuOeT{W7NQlfBC^ro6#un3Fdm=tOm9uISxx(S5`tPg-1#WG%);bRsuO(7MYKM&GO zK^U~Ai#u34Rf~^I3w5&~TMupgH_Tb7;jFc9OG#~|9?UpI1`)nm26CHFHp}sY-K+3*%mR%Rn_mz3yE9?jSlS1|)sp{TRfWhJ zo9p|jHLsp-LQ@2Ls)+C?V>lm|neumJq~h&gfvE+50!Mb{3kVc}sxZ71bvf2NZ}`+d zC4xPuFFe3c(cmJ+!P5Gj*kM^w@Vc4!whLN6;%;08R>9OdS7NU^stx^fqQ4_#Vy-;o zU@Q(vCa&D*Wex1%8t2PGj7iR~(YFv~iC=zH-^F6_B70lNCNFPCAIREk{zEMgpM5`L z!cTqyK#sUoP3!Ics>Tn`N_i2ehSg(kYGM!(luSXGrkUcUz^J0fN^PQ*Wf}jP98qVo ztBYJ`;rVAc);Fdm$t9-Y$(X*~n+W-Gy?uh-Oxjq-UhF9b(a;S9R@R&(dhaPc6!?nW z(7jL&z0Vk?0YnEjSM2JUHDZQ>K*VO(AhldoU&-#p zf|nsesI~d`{S%a~s*J?aIJlDCGYCwXQn}$Tt?4#s9k|dU8zQOUqmgNAc?q%lv6~n{Ba4?7 zsmV71)^yV5(IKu!e=PBN>aZ#jFhfy^#_Hof5y(SMcWqd7%0}1V( z>E$8|&kctq=)qZVB@M8K5t;dV)JbHiert(6F2v4ed!o|xYlw1hl6msC%gBmcx<)LS zqGAvtrf;qcCI1|fRBp25bCPTm6S6g3u-6o_3c(upF;i}g#E&s@SYSwes1SgW*2~+* z_lx`m#f8KOg&OIogpppdBwCv&n{IBLn;ru_Jw0u|gc=c`%hx;p zPfals>``6}n-F0Unn@Hfir}(N{OUq4DS^tZ~TyI^zEA^D^>h>0bXmWlu-WCnU?tgdYBms7LZk+FUfohltF*8y$LMf#C9TsldU*aH3%ME`a$G5cj^u1S)dfZrO zxO>J8B$Co*vcIy$$SM8Nh8a(!ypoA+5RtNyDl~+t-QkJ8G;4S3L>W4U(hZ)%zQT)8 zBJk670l>9S$4%Tv$H3LZg~rHGy2f1yPJaPKyT-uDj=&B=8F)f3DcGt+n)ZF5FNLB- zWQ9`0SgQD~Sxu1*4^+!+{DUJz!{4WRv{D|u@j{hqlys%(#Wj!sd!=A!gL)w{UT7ky zJIcKYrbrC_`ND-h%#V|l}>L)=Wi zgUb-#>z28I-3WM6MB90Ygjk`tKMjg#$E>CicLl60)YaAhnx8Ng#!tgs3>raYVJZR| zuhEa(li8opKQ#^+Mj2_;d%6t7@X8Vx|B}+xdz>;fa~k|Ky{k}K0Ds2WcrI#xzNtsG zFdr}90$pScmtKbD_gnWuNrnH&NS$~2N>gGKJ)gzNElxv_2PyZoD)4 z+Y7%UN&|oOr%stB*;J_zLE~keb73&a3M+fNivt&4nROVlu5@9r&|y-(-2W<}K`Sf{-uQG#Xm|g<)N0q_D1peiICs%M6RW-v{A4SYM=6HqN$S6Q{p~nqo>lPcbjNW zajG!5V+R#gVHR@U^1uPgpEnW2aY93iaawwh0eT~fn@#A+>20hc``k$mjXXqpop$bY zQeMF^&_%Z!;oVc+?9yUv_j=^`AX(FSc|4xzC`l943FzX?vDI;=iPFx|k0*0cEt5i9 z(uhM0-y4VH9xuLhC+WcHOzQ^8k$ zjw7)@vPDb#A?eRR^_D>3paDvHeO5rN^=0T+5*jiS6Ilw%1xnTsQ?X2AuAIm_gj?5Z z)qvN3XkD9@58#d-;xw`SB)%prp$grgb>dP*g8C(qg?@X1%^zrD%t6@(ANo)7Ml(Ff z+b8>E%zXP~pR&dHPnJ`~R)nRJ8`+59E*TSP5z6@C_#HOIGaw$J4Kibn2l08LR4CKu ziBi2{iYH3nOYa6rt|goJ>ea=TLcm^sx(&Z9&%+Zf4>qxdCszimLZ7iiur0X!2DXId zy(DGnXy;RX2a4YPDFgM4*fY_GtfDahtgEyer0}Nf$ziVsXQYVHPSkd>D7}KuYA-Uy zfQndk%+q&;L`;NnQm^ z@icIS79<60x+e?xCzPzhaYG;zSNJh$3KtDu5;0g(LF6a~))|$GhNL3)Ik! z)jID4;ZSht1)u47g(p*Zh7Sp|63lCJO++3SHf=ZdL2h}Dr2+Uox=yC9At{dGEvt-x z;2~l9XvE)d4r~PIU4L>FyrT5QxxtdyhtW?^96oy3BEIIg{#)}Ls#(%#=JaMJ zBw9W{lqmDDm5FL8FJ(FkRTh7qOXTIH?LeC?bZWZ~4N35r{)Cv4K$H=}%<-|Au+YrV;U6KzD%S@`CE|0%vLFd$l@fskSh@p5 zhsb<)IJHKLyu&6HcYzQirc+HO@#?*;W9h+J%RM%D{!ilBao^d(Ro zETTS=)k$Rhdz12Xn}}ZNU$dXUHmK9cm%H=vissTIOXZlJ2$W7T} z4FIMhRm@0S(w=gAV&{g+hNOH}pdAOz_kl{WVTa3mNUzp6|HA@k9g+qnE9Uy(OdE&8 z@u9B6TlR#>ip8<-*95EDU>0fp!9RITNv4%aPRx^=pWsyJUg_2Ae-YM>-VX&eN}f6~ zuen$!)YJXhSpgDi*6*KcF#l6Sxn<{?e&yA{<));OKrN+Hlwt|XES*`<1Xrubj=%5e ze+Z7x&+t35VpbZ-p7A%Q$=ef9GNo8EBBQ@c)iV;(gcxj=GpxTp5a4sGCjUnh@yd%Q zHcG-68fmgElNue8ZHQ( zkm3s}kMeSM%HhJ?9a3A$qMU(1{t)|wgb=Qlt}H^Jo2POd@1zklHnt4xS}ed%tKF+> z@|tv6Fx_#>bV$1EKgGu>r=Qv=X<%r)jC0nG14th35{}?)8G3sR1p(fo{T{;7{c((6 z@PlDTm8UosNPVxK@^9OP&UKX{sz2eZt7+L@>6x#5yc-;AZKfQ^ zi%oOZ%-#ha%47`Ny6T?f{-pN}mKDQT-m2G>qvQK@v0wJib)-k*@&v5KZHj{oj=mKm zk?3Jj&9(1ZZ)*ElGxVw*9E3`-jI=5H6LLK{_kflknI7;kB9L^E>0&J^vR0~uF3?Eg z+9^B@mJ-0jT`Lt~BvaS@CM>*`kR2=XH{ACx{NWRx{Xcl}$<$gqhHLgR-hOETmI;&y z%@p@6T#R2sgXRYPusrweFR@ZK9_D5b_kf=ktG>gO`@CHO z4IjoG&wkh4+}HYxmV0;_H%CA(T5smeyV@o^`@ihl{jOc6Cqf)mH(V?NG}D`Syyjdw1Y-he|Y~ zvyQ*_@MG5^`9(oD1*17g=aXe8uj7U|KE4C-7tY&u{ujDY*1oL@4% zj*PK3FXbXf8F8yhM3=^UQ50=F7)q47Gjz(6Y?;dIvfcpr1#010Q+hAM${#FUpfb67PreJnlN8Gw#)oC?sCUs7Z>5Jd0hn zHrfrG@>mk`k18z@OhOGE19+b#PMi*(=HEJ#VN2(L$5Fyis4UawiG@}nyO~W~sq^@F z`|{z7i9IjJ&kMogvkyzbNNW-(W_5mh8Y0GHl1r<7)OlLZ5zpCg| zzAlW8XS}M|!h4{UuX^2%bRRighX;CHnj~5-Y6=S)>t|$+xne`C7Zl?6hQ5yG_SiSQ z(zUVzVA+C46AebnH_P0O)M2zLzCctbhd3u8lpu}33-LUHP2Lf^1b`{xcQ3nB=$oY= zl|7*8J%=$LhHcT7s+^=jMLBaxG|RRcE8eL!U6k03ZEV3U`S1tzz*=0_j+uP)-wVAV z@Cx`bl#t31yIV7ygCj=3Jd%NS<7~1i17Zh2m?xPiYwRKBR~7lw)ET5^0%zVG{*Fs6 zAvbeths)gO)hTu~_>V{erO{_WftZH9+EU;3c{L4RxxszZoRhSopR0YHym*P~8I>~cjW;=iu zCR6R!ikI)Jw>0x%_#19x=LRGn32vsuuF1_g<--mpV;O%SiJ5sIj9D9TznfeSjV{8? zX}`m`3GFz|wCO)Wyo^!=;SYIl;- zl6`(l3+ZrR0aTeSHvP54A?Ewfb-hp-_wCKxO|Y4Qwg8koaS>*aCP-l!OuyU;lup@qHzx@`Ss zuY$eCFl`#=F0{WiAMuMji#q}zKAE5{A4aT-Wgny31BLU2^3%>YGhXBTJdg%S@P#EUjt6yA9*?!t0-q9Ok zzJ}TQX81Wo+N<5lx#GeY@U68L0Ly;%#Q~3Y^F^PhThee6bXs^FAEgQ>ll%7Ci{?@H zOW(HOj{fu>|Jf>k;=qW=<$5vH&F197{Q79silaMYKZ-#kZ}4VyzDrexYEOE@f*c~- zsbmqPs?%pCq@6*-O{=$)TOuCjBaO7!Wf&21J z$tCB`*Z(BX*PR?hO1_;xZJotiGx?jNn#5@DbbXg)N9fJ=>6hW;JVFB^9{xS3JpV~EwmLMgUBv!DEK z8+<2Czq#O_Nwd1l>Y^@PZ`{lob5yybbqpK1TaH`gK)-@{Ke_^>J4#G<+wvJn!gn^s zd1J9Z>atMQrs(!_vi#9BIJ6>UgtQOK&(`jwBDNGB2K$}er+gpvw{NC~_Y^%v2`s5; zU5MNEMiS!Q!lVxSG&3xI-x-l=i{9q1D=BXE4nZBZfX#lZj1%OQ9;KHS`EK{=LCeUb z#GeHFBDLrr>Cb_gWBZ?kJMen(91OUg~Rghach&as;nb15WgrhP4r5 z*3=bW?hnk99r_A(C#y8C8wjPdiuJTqXd%zbVq=?ch7dn0L+v@FGQ&%<;Y>6A60tc# zL?gonIPr@0ZL%y3E&JjPNU(WJ7J?ah7}|EiU_K84HQB%&t4RJJy$cRr1@bmA3O#G5 zJ}{opn$knTkEL(E;!WX=lDhCdn0YNPSKdij)n=Cx_&@m7E8auR*KFiN*9UGYuasmqpk z8KcaWl63$w{#zm0>^RtGE@fuyHDj(X0H{Z7-_LlnH8y{HvUVPxie!IFa*(Sl^~XFs$IS!D0l78l zZ5MumC~2VgevNFw7%9?mFq(;fik;Y}L=H!=NYRim);PHim4vu;P9St@GI_PqUawww z4b=hox&O|~?Gl6CqNDDY-Ls5v3qT*SndJRP&w^qGLU!xlxQR*(2K+O6^7bKE+7 z9;2R~xP9}C%uZE?#xVwhmY>G^qdBA={$@_iVZG}S$;rKe^_J(PH3ZQ}@8o-}G}eL4 zBb)ViV^=$w6%AExDfNLK^L$FRHL(3iCr30O!d%K5@10J6HAp#`Wz%eGUV`2xKO2*r zBB?WHfTD-ssq3ltK6&smb>pRtOTsy_=gV~)tGk;6+&a*=PosVBbPDEuGB^Ecm6bfa z@V9qLxQBCfDQ}nB%e>qDMz*WY*mEu`$Coxqr(P(*idDouznNyt(Jp@GW?`Vm4zj+C%q=Z{1gTeC==d>qL8&&ao9JmUz4svLCR0ZVnO~XU-mw zMUUdYx&?%0pP9#S43iRO3CJlB&X0S|7%T}hrle>a)!%JGC4z*i>zN(LviBx)^-4>E z;!va#hKGNlWgtIt!ZM5-mOp?)Tnl=D$O*A9oh%fc7O$O+f;nSe!umD?}t(n(!64Xe?I9VMpK_x3N67c`wl5IX8XWN6xUM!krE$d3A{HUee=}v0~Ss ze*K&6!BRYTENFn4L|OZ^W9=NIb3`^mCAxo>Cqs#ph34qknT(?MJ`ZOM)BX)mFgD+k zMcC=UPs_}<@Pjl-T!p76*e(h-`Ax;{!Xv~`&gihQ2CORChs@{|M7eLP#4eL$Zad~R zyyTJAb5)_OWxbuC5%;3XmwiINxuvJ@=XDd7Tj&ExXz&m4%MKSt6G;KBR|yfH0_DAR zeOw5#bH1$7+wm(jD+j2o7_mwM!TlmBCp`W$L(1}Hh*%c{bPJ{eD%+>K)VyTzvI51BBg4sr|Y{&?b<0el`IOG*8650nH9Cid`i8Z56U8=o)P#< z98>SFzf)Vmd7bV-JtC@%4LpyPJ34I$^Rx?YRX^>ri$$Wvct;h{D0|ib&ab{qFD22| z1gW6TvZwCfbAD$%eWpV6I^9r`Oc8Xxja^d?@lvA#5(G?Zk7GWM0X1#x(zDO`SjlrQ z3&ERdX8auHFPQG#M`ydz`0=9%Um7n;yA3q3Ex;A56T|68!6mAZ%8}x&%<`d&c4@uF zsc{DU4xUx&A^2?%-5`FjfagX?;0yFIZ$+@m;R-#_{M_^2v=gxr1r1lH!Td)S3wo%y zS*X#Y5#a5xXPydS@dhekI(Q&9aZDM?g%x@v*CDm(YX(~@ z(UE6?-;Gj`YeaBq*moes7EW=HyS)&QCsi+d5!cT9;Nh|5*QM=#{_LC92M*PAEW99s z50&T55__{W*?EKB)$}!_=!imrQfH?(EQH}v1HBavXgbD0F$nU)3`#*BE2QCdxWcO6 z>3i}*T5N#Ib+IIm7<58ozn5t^t`YcN9Ie|e&ju{%@@dthv2D5>mY)@NtA-#PkSjy* z9=%0%wm8IglA|=V9!z?bVJ#ZXcp(C9m(?U69F`ayzQK^MHSX&Cy!W&}ur4nvz_GY7 zr`2}*n~#vG#5lL43x7f5U(uwZ#C-kbDbWt3bB)xf#-tMNi#6~`|Jn@hyE|*>8gh5&nYsu z_ulpv5OEoN(*NGM{9kMsgk9z}d@{sIMissW(k-J2{|bT+X8fCJ$ZIe@JTF8WECyc& TNdb$(yFzBb3`mwze`WX|@eZ5i From 82250e95eaa570d7ed0c322ba26b4819170a34e5 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Sep 2020 14:01:05 -0700 Subject: [PATCH 08/12] Added new Update setting --- .../mdm/new-in-windows-mdm-enrollment-management.md | 7 +++++++ .../mdm/policy-configuration-service-provider.md | 3 +++ .../mdm/policy-csps-supported-by-iot-enterprise.md | 1 + 3 files changed, 11 insertions(+) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 83fd0ea765..fdd17f0525 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -58,6 +58,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [September 2020](#september-2020) - [August 2020](#august-2020) - [July 2020](#july-2020) - [June 2020](#june-2020) @@ -1414,6 +1415,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • Update/ExcludeWUDriversInQualityUpdate
  • Update/PauseFeatureUpdates
  • Update/PauseQualityUpdates
    • +
  • Update/SetAutoRestartNotificationDisable
  • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
  • WindowsInkWorkspace/AllowWindowsInkWorkspace
  • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
    • @@ -1996,6 +1998,11 @@ How do I turn if off? | The service can be stopped from the "Services" console o ## Change history in MDM documentation +### September 2020 +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Update](policy-csp-update.md)|Added the following policy setting:
    Update/SetAutoRestartNotificationDisable
    | + ### August 2020 |New or updated topic | Description| |--- | ---| diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 7986a6fae0..5bb7f9d9c8 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -3918,6 +3918,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Update/SetEDURestart
    +
    + Update/SetProxyBehaviorForUpdateDetection +
    Update/TargetReleaseVersion
    diff --git a/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md b/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md index 617be22113..fe61104ca3 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md +++ b/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md @@ -66,6 +66,7 @@ ms.date: 07/18/2019 - [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) - [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) - [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/SetAutoRestartNotificationDisable](policy-csp-update.md#update-setautorestartnotificationdisable) ## Related topics From 53f31dd95340250a12e9c13adea2968201e21436 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Sep 2020 14:27:23 -0700 Subject: [PATCH 09/12] Corrected policy name --- .../mdm/new-in-windows-mdm-enrollment-management.md | 4 ++-- .../mdm/policy-csps-supported-by-iot-enterprise.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index fdd17f0525..b311f49601 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1415,7 +1415,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • Update/ExcludeWUDriversInQualityUpdate
  • Update/PauseFeatureUpdates
  • Update/PauseQualityUpdates
    • -
  • Update/SetAutoRestartNotificationDisable
    • +
  • Update/SetProxyBehaviorForUpdateDetection
  • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
  • WindowsInkWorkspace/AllowWindowsInkWorkspace
  • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
    • @@ -2001,7 +2001,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o ### September 2020 |New or updated topic | Description| |--- | ---| -|[Policy CSP - Update](policy-csp-update.md)|Added the following policy setting:
    Update/SetAutoRestartNotificationDisable
    | +|[Policy CSP - Update](policy-csp-update.md)|Added the following policy setting:
    Update/SetProxyBehaviorForUpdateDetection
    | ### August 2020 |New or updated topic | Description| diff --git a/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md b/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md index fe61104ca3..8e70dd707e 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md +++ b/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md @@ -66,7 +66,7 @@ ms.date: 07/18/2019 - [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) - [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) - [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) -- [Update/SetAutoRestartNotificationDisable](policy-csp-update.md#update-setautorestartnotificationdisable) +- [Update/SetProxyBehaviorForUpdateDetection](policy-csp-update.md#update-setproxybehaviorforupdatedetection) ## Related topics From 342d800e1e5d09426f7801e1de4339da99dc75de Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Wed, 9 Sep 2020 14:37:28 -0700 Subject: [PATCH 10/12] add text per customer request --- .../microsoft-defender-atp/web-content-filtering.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md b/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md index cc9c36fae9..2c2ed8bfbc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md +++ b/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering.md @@ -76,10 +76,18 @@ To add a new policy: 4. Specify the policy scope. Select the device groups to specify where to apply the policy. Only devices in the selected device groups will be prevented from accessing websites in the selected categories. 5. Review the summary and save the policy. The policy may take up to 15 minutes to apply to your selected devices. +Tip: You can deploy a policy without selecting any category on a device group. This action will create an audit only policy, to help you understand user behavior before creating a block policy. + >[!NOTE] >If you are removing a policy or changing device groups at the same time, this might cause a delay in policy deployment. ->ProTip: You can deploy a policy without selecting any category on a device group. This action will create an audit only policy, to help you understand user behavior before creating a block policy. +### Allow specific websites + +It is possible to override the blocked category in web content filtering to allow a single site by creating a custom indicator policy. The custom indicator policy will supersede the web content filtering policy when it is applied to the device group in question. + +1. Create a custom indicator in the Microsoft Defender Security Center by going to **Settings** > **Indicators** > **URL/Domain** > **Add Item** +2. Enter the domain of the site +3. Set the policy action to **Allow**. ## Web content filtering cards and details From fd019c2a946cd7d7d655c8120dbcf6096be9a0e5 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Wed, 9 Sep 2020 14:51:50 -0700 Subject: [PATCH 11/12] note per customer request --- .../microsoft-defender-atp/enable-network-protection.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index dbe7692a37..b54b1ac8a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -89,6 +89,9 @@ Use the following procedure to enable network protection on domain-joined comput 3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Windows Defender Exploit Guard** > **Network protection**. +> [!NOTE] +> On older versions of Windows, the group policy path may say "Windows Defender Antivirus" instead of "Microsoft Defender Antivirus." + 4. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following options: * **Block** - Users can't access malicious IP addresses and domains * **Disable (Default)** - The Network protection feature won't work. Users won't be blocked from accessing malicious domains From 2fc1ed61b6b7f7004e251488d222dcb5b206bb50 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Wed, 9 Sep 2020 14:54:26 -0700 Subject: [PATCH 12/12] updating toc to match heading --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 0ec64812e8..b43ed6868d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -97,7 +97,7 @@ #### [Network protection]() ##### [Protect your network](microsoft-defender-atp/network-protection.md) ##### [Evaluate network protection](microsoft-defender-atp/evaluate-network-protection.md) -##### [Turning on network protection](microsoft-defender-atp/enable-network-protection.md) +##### [Turn on network protection](microsoft-defender-atp/enable-network-protection.md) #### [Web protection]() ##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md)