From ae9fef9a50cc12f8f638d20fd466510fcf90f472 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Thu, 19 Nov 2020 01:04:18 +0100 Subject: [PATCH 1/9] Defender SmartScreen: typo correction & URL update As reported in issue ticket #8665 (Correction To Microsoft Defender SmartScreen "login", replace with "log in"), there is a typo where the phrase "Debug log in Event Viewer" has lost its required spacing between "log" and "in". Thanks to secdev-01 for finding and reporting this typo. Additional update: the URL to the [Event 1035 - Anti-Phishing] page has been changed to reflect its permanent redirect from - https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx - to - - https://docs.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/compatibility/dd565657(v=vs.85) Closes #8665 --- .../microsoft-defender-smartscreen-overview.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index 56d43dafc5..0c20744eee 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -67,12 +67,12 @@ When submitting Microsoft Defender SmartScreen products, make sure to select **M ## Viewing Microsoft Defender SmartScreen anti-phishing events > [!NOTE] -> No Smartscreen events will be logged when using Microsoft Edge version 77 or later. +> No SmartScreen events will be logged when using Microsoft Edge version 77 or later. -When Microsoft Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://technet.microsoft.com/scriptcenter/dd565657(v=msdn.10).aspx). +When Microsoft Defender SmartScreen warns or blocks a user from a website, it's logged as [Event 1035 - Anti-Phishing](https://docs.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/compatibility/dd565657(v=vs.85)). ## Viewing Windows event logs for Microsoft Defender SmartScreen -Microsoft Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug login Event Viewer. +Microsoft Defender SmartScreen events appear in the Microsoft-Windows-SmartScreen/Debug log, in the Event Viewer. Windows event log for SmartScreen is disabled by default, users can use Event Viewer UI to enable the log or use the command line to enable it: From 728f0982e4e384c4c3b0086233017f8c0d52c7ef Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 20 Nov 2020 01:47:05 +0100 Subject: [PATCH 2/9] Typo correction & metadata description update As reported in issue ticket #8669 (Check Grammar), there is a typo in the following sentence: > Before you get started, see the main MIcrosoft Defender for EndpointP for Mac page for a description of prerequisites and system requirements for the current software version. The word "EndpointP" has received an unneeded letter at the end right before commit https://github.com/MicrosoftDocs/windows-itpro-docs/commit/5eb8d432da413dd0447b14e1b6763dc73dae3758 . Thanks to matambanadzo for noticing and reporting this typo. Additional change: metadata description updated from - Install Microsoft Defender ATP for Mac, using Microsoft Intune. -- to -- - Install Microsoft Defender for Endpoint for Mac, using Microsoft Intune. Closes #8669 --- .../microsoft-defender-atp/mac-install-with-intune.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md index 87c1b96104..cb1c7d7be7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune.md @@ -1,6 +1,6 @@ --- title: Intune-based deployment for Microsoft Defender ATP for Mac -description: Install Microsoft Defender ATP for Mac, using Microsoft Intune. +description: Install Microsoft Defender for Endpoint for Mac, using Microsoft Intune. keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -42,7 +42,7 @@ This topic describes how to deploy Microsoft Defender for Endpoint for Mac throu ## Prerequisites and system requirements -Before you get started, see [the main MIcrosoft Defender for EndpointP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. +Before you get started, see [the main Microsoft Defender for Endpoint for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. ## Overview From 2300d2685d03f0f95835c36f5b8bf8c505bcee40 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sat, 21 Nov 2020 11:30:56 +0530 Subject: [PATCH 3/9] fixed typo error as per the user report #8683, so I replaced grin to erin and hagens to havens. --- .../password-must-meet-complexity-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index 54140d60f7..d9e0d8d50b 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -30,7 +30,7 @@ The **Passwords must meet complexity requirements** policy setting determines wh 1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case sensitive. The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped. - The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Havens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "grin" or "hagens" as a substring anywhere in the password. + The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Havens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password. 2. The password contains characters from three of the following categories: From 41951448fa0304188a0e30cfffcced9b4e5d689b Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 23 Nov 2020 01:25:45 +0100 Subject: [PATCH 4/9] Update block-untrusted-fonts-in-enterprise.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As reported in issue ticket #8687 (Dead link to Dropping the “Untrusted Font Blocking” setting), the outdated link to blogs.technet.microsoft.com just leads to a 404 error and no proper redirect to the existing article. Thanks to KalleOlaviNiemitalo for noticing, reporting the issue and suggesting the link to the correct page. Proposed change: - replace the blogs.technet.microsoft.com URL with a working techcommunity.microsoft.com URL Whitespace changes: - add missing MarkDown indent marker compatibility spacing - normalize bullet point list spacing (from 3 down to 1) - remove any end-of-line blank space Closes #8687 --- .../block-untrusted-fonts-in-enterprise.md | 66 +++++++++---------- 1 file changed, 30 insertions(+), 36 deletions(-) diff --git a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md index 70362c9d1c..a26f59d1ed 100644 --- a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md @@ -2,7 +2,7 @@ title: Block untrusted fonts in an enterprise (Windows 10) description: To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. ms.assetid: a3354c8e-4208-4be6-bc19-56a572c361b4 -ms.reviewer: +ms.reviewer: manager: dansimp keywords: font blocking, untrusted font blocking, block fonts, untrusted fonts ms.prod: w10 @@ -19,9 +19,9 @@ ms.localizationpriority: medium **Applies to:** -- Windows 10 +- Windows 10 ->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). +> Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%/Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. @@ -31,24 +31,24 @@ Blocking untrusted fonts helps improve your network and employee protection agai ## How does this feature work? There are 3 ways to use this feature: -- **On.** Helps stop any font processed using GDI from loading outside of the `%windir%/Fonts` directory. It also turns on event logging. +- **On.** Helps stop any font processed using GDI from loading outside of the `%windir%/Fonts` directory. It also turns on event logging. -- **Audit.** Turns on event logging, but doesn’t block fonts from loading, regardless of location. The name of the apps that use untrusted fonts appear in your event log.
**Note**
If you aren’t quite ready to deploy this feature into your organization, you can run it in Audit mode to see if not loading untrusted fonts causes any usability or compatibility issues.
+- **Audit.** Turns on event logging, but doesn’t block fonts from loading, regardless of location. The name of the apps that use untrusted fonts appear in your event log.
**Note**
If you aren’t quite ready to deploy this feature into your organization, you can run it in Audit mode to see if not loading untrusted fonts causes any usability or compatibility issues.
-- **Exclude apps to load untrusted fonts.** You can exclude specific apps, allowing them to load untrusted fonts, even while this feature is turned on. For instructions, see [Fix apps having problems because of blocked fonts](#fix-apps-having-problems-because-of-blocked-fonts).
+- **Exclude apps to load untrusted fonts.** You can exclude specific apps, allowing them to load untrusted fonts, even while this feature is turned on. For instructions, see [Fix apps having problems because of blocked fonts](#fix-apps-having-problems-because-of-blocked-fonts).
## Potential reductions in functionality
After you turn this feature on, your employees might experience reduced functionality when:
-- Sending a print job to a remote printer server that uses this feature and where the spooler process hasn’t been specifically excluded. In this situation, any fonts that aren’t already available in the server’s %windir%/Fonts folder won’t be used.
+- Sending a print job to a remote printer server that uses this feature and where the spooler process hasn’t been specifically excluded. In this situation, any fonts that aren’t already available in the server’s %windir%/Fonts folder won’t be used.
-- Printing using fonts provided by the installed printer’s graphics .dll file, outside of the %windir%/Fonts folder. For more information, see [Introduction to Printer Graphics DLLs](https://go.microsoft.com/fwlink/p/?LinkId=522302).
+- Printing using fonts provided by the installed printer’s graphics .dll file, outside of the %windir%/Fonts folder. For more information, see [Introduction to Printer Graphics DLLs](https://go.microsoft.com/fwlink/p/?LinkId=522302).
-- Using first or third-party apps that use memory-based fonts.
+- Using first or third-party apps that use memory-based fonts.
-- Using Internet Explorer to look at websites that use embedded fonts. In this situation, the feature blocks the embedded font, causing the website to use a default font. However, not all fonts have all of the characters, so the website might render differently.
+- Using Internet Explorer to look at websites that use embedded fonts. In this situation, the feature blocks the embedded font, causing the website to use a default font. However, not all fonts have all of the characters, so the website might render differently.
-- Using desktop Office to look at documents with embedded fonts. In this situation, content shows up using a default font picked by Office.
+- Using desktop Office to look at documents with embedded fonts. In this situation, content shows up using a default font picked by Office.
## Turn on and use the Blocking Untrusted Fonts feature
Use Group Policy or the registry to turn this feature on, off, or to use audit mode.
@@ -58,7 +58,7 @@ Use Group Policy or the registry to turn this feature on, off, or to use audit m
2. Click **Enabled** to turn the feature on, and then click one of the following **Migitation Options**:
- - **Block untrusted fonts and log events.** Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log.
+ - **Block untrusted fonts and log events.** Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log.
- **Do not block untrusted fonts.** Turns the feature on, but doesn't block untrusted fonts nor does it log installation attempts to the event log.
@@ -73,9 +73,9 @@ To turn this feature on, off, or to use audit mode:
2. If the **MitigationOptions** key isn't there, right-click and add a new **QWORD (64-bit) Value**, renaming it to **MitigationOptions**.
-3. Right click on the **MitigationOptions** key, and then click **Modify**.
+3. Right click on the **MitigationOptions** key, and then click **Modify**.
- The **Edit QWORD (64-bit) Value** box opens.
+ The **Edit QWORD (64-bit) Value** box opens.
4. Make sure the **Base** option is **Hexadecimal**, and then update the **Value data**, making sure you keep your existing value, like in the important note below:
@@ -85,8 +85,8 @@ To turn this feature on, off, or to use audit mode:
- **To audit with this feature.** Type **3000000000000**.
- >[!Important]
- >Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*.
+ > [!Important]
+ > Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*.
5. Restart your computer.
@@ -104,27 +104,27 @@ After you turn this feature on, or start using Audit mode, you can look at your
FontType: Memory
FontPath:
Blocked: true
-
- >[!NOTE]
- >Because the **FontType** is *Memory*, there’s no associated **FontPath**.
+
+ > [!NOTE]
+ > Because the **FontType** is *Memory*, there’s no associated **FontPath**.
**Event Example 2 - Winlogon**
Winlogon.exe attempted loading a font that is restricted by font-loading policy.
FontType: File
FontPath: `\??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF`
Blocked: true
-
- >[!NOTE]
- >Because the **FontType** is *File*, there’s also an associated **FontPath**.
+
+ > [!NOTE]
+ > Because the **FontType** is *File*, there’s also an associated **FontPath**.
**Event Example 3 - Internet Explorer running in Audit mode**
Iexplore.exe attempted loading a font that is restricted by font-loading policy.
FontType: Memory
FontPath:
Blocked: false
-
- >[!NOTE]
- >In Audit mode, the problem is recorded, but the font isn’t blocked.
+
+ > [!NOTE]
+ > In Audit mode, the problem is recorded, but the font isn’t blocked.
## Fix apps having problems because of blocked fonts
Your company may still need apps that are having problems because of blocked fonts, so we suggest that you first run this feature in Audit mode to determine which fonts are causing the problems.
@@ -133,21 +133,15 @@ After you figure out the problematic fonts, you can try to fix your apps in 2 wa
**To fix your apps by installing the problematic fonts (recommended)**
-- On each computer with the app installed, right-click on the font name and click **Install**.
The font should automatically install into your `%windir%/Fonts` directory. If it doesn’t, you’ll need to manually copy the font files into the **Fonts** directory and run the installation from there. +- On each computer with the app installed, right-click on the font name and click **Install**.
The font should automatically install into your `%windir%/Fonts` directory. If it doesn’t, you’ll need to manually copy the font files into the **Fonts** directory and run the installation from there.
**To fix your apps by excluding processes**
-1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ Kn1p_A@e*1I|5
zf{mRldNzx?T2|B1%2|bDzu!b$ZaHI l(9+5X
zr^v7?*UfOc$?R!l>}?3=sr~VXqWsjVYtKu=KY+UJ4-G-zv{Qy`D9SNrAKYba;p!LV
zUe|GXXyq_r9)%z3Ue~cWO` ipV~uZx&c_#SZ@PBPW!&mH5N
z6O}JQ^vW0Zwx^mlFt!?#-(kyyQC;Io+SR;a*RZ0pH`AJK1 $fF@P_MHy)n4J5vTpwod~WyPzK?KYk7L)%vRXRE?X@qT==^GHR+=>cfXh
zhpGI_pSm37kR0HIzcBrMyMID-K8#sn?hIfo->(d1=}-aPPs)`UdJeY@@u)3zy@y cyLo-z6EC$ZKWi
z6ZhCK^u+YM8e9Nip^|0?W12-8e5;qi!x+REB7SEMAGwg@Evn&Z3B&&Vbt77t%{0)j
z*s+yGFdJfriEJd5I3)>uCu$6TkKUwE>=v1G86?I^J^t3h58vUkKKFpd-iJ)djeL6F
z*** BfRw6;mP8WSErScK_B*4s}ijAAf}Za%%BXMKqIqhK~eIdzFLZAMHwx
z`hKx{U{_5?Uan-T_B8b**N??8udED*S|~3O8iZ=UwXQe_yTS?55xr0mMNmCURFW)U
za-Kx=d{^{J-e%EaSklGIF`YdnNh4yvjKU1^aY0y>c=o7z*SYS5DWh87SWerL;}+t%
z(>
For example, if you want to exclude Microsoft Word processes, you’d use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`.
+1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
For example, if you want to exclude Microsoft Word processes, you’d use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`.
+
+2. Add any additional processes that need to be excluded here, and then turn the Blocking untrusted fonts feature on, using the steps in the [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature) section of this topic.
-2. Add any additional processes that need to be excluded here, and then turn the Blocking untrusted fonts feature on, using the steps in the [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature) section of this topic.
-
## Related content
-- [Dropping the “Untrusted Font Blocking” setting](https://blogs.technet.microsoft.com/secguide/2017/06/15/dropping-the-untrusted-font-blocking-setting/)
-
-
-
-
-
-
+- [Dropping the “Untrusted Font Blocking” setting](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/dropping-the-quot-untrusted-font-blocking-quot-setting/ba-p/701068/)
From 3ce9d29020d43cec8f85f734293c61e7d4e54453 Mon Sep 17 00:00:00 2001
From: Alekhya Jupudi
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`
+> [!NOTE]
+> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
+> Example:
+> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`
+> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`
+
3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet:
`Get-Service -Name windefend`
From 7183c615911842a6dd96b8a45b1f1030c3691f25 Mon Sep 17 00:00:00 2001
From: alons8 <61512160+alons8@users.noreply.github.com>
Date: Thu, 26 Nov 2020 14:55:45 +0200
Subject: [PATCH 6/9] Update indicator-certificates.md
Adjusting the requirements for specific encoding based certificates types.
---
.../microsoft-defender-atp/indicator-certificates.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md
index feab52dd1a..6948f7a392 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates.md
@@ -43,7 +43,7 @@ It's important to understand the following requirements prior to creating indica
- The Antimalware client version must be 4.18.1901.x or later.
- Supported on machines on Windows 10, version 1703 or later, Windows server 2016 and 2019.
- The virus and threat protection definitions must be up-to-date.
-- This feature currently supports entering .CER or .PEM file extensions.
+- This feature currently supports entering .CER or .PEM (Base64 ASCII) encoding based certificates.
>[!IMPORTANT]
> - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it's trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities').
From 26c6086ffb1ba016c80bc6abb4203b5d51bc07bb Mon Sep 17 00:00:00 2001
From: Sunayana Singh uAp(lkZJjonwF-5H|6-KnA1;Grd{RtncEd1De$37M@80pv$w6@LT53r2Vj
z&qJJf+qJ!d+U*f8fj?6e3T80Q9G8;I`4Ks1^GUF!Fp)8}BE5-Z2{by#gL4HdOZy>Z
zYx3o60*%tSuYXHQ{d`R8z0i-wQK8@~gDgOkcbf?wYbAdqd}NDBU@DDc**qbt{4gxR
zBvNqg=o$2nm~2dp#m$S$8#^af*17%E7EN~qGeWq3{Mz|)UmGS#`=U{EQIyy^Uzo9{
zj(98)v#sT|zN#QfTWIJB;rikEkKwKfj3%Z9*?dvCp8Xd ax6c-gm&~gsZ@+;kOidAVvNQ$!*h}V;!8KO3?1^{{woevO7vR7xI)g}Hv
z_TIazsqSkV#e&>|hy_GJzzzg~TWQio1O%iLdQp*1Kq0gQg2FAR2&fQHdJjF)5(tFY
zQCjGsC84*FgdRd5Iq_GX=ZtYaz&pk}&i*4K8A
_Jmkhvc+UQyp^)T*LvGo=;^EM|SD&Z};Q_r=q0zD!#o9ddN<#%{q0(-|*V#^?
z)pkC)*H8SM