mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 22:33:41 +00:00
Merge branch 'master' into dansimp-metadata2
This commit is contained in:
Daniel Simpson
GitHub
@ -65,7 +65,7 @@ Detailed Tracking security policy settings and audit events can be used to monit
|
||||
- [Audit Process Termination](audit-process-termination.md)
|
||||
- [Audit RPC Events](audit-rpc-events.md)
|
||||
- [Audit Credential Validation](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation)
|
||||
> **Note:** For more information, see [Security Monitoring](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/)
|
||||
- [Audit Token Right Adjusted](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted)
|
||||
|
||||
## DS Access
|
||||
|
||||
|
||||
@ -0,0 +1,27 @@
|
||||
---
|
||||
title: Audit Token Right Adjusted (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Token Right Adjusted, which determines whether the operating system generates audit events when specific changes are made to the privileges of a token.
|
||||
---
|
||||
|
||||
# Audit Token Right Adjusted
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token.
|
||||
|
||||
For more information, see [Security Monitoring: A Possible New Way to Detect Privilege Escalation](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/).
|
||||
|
||||
| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments |
|
||||
|-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.<br>However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).<br>If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.<br>However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).<br>If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.<br>However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).<br>If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
|
||||
**Events List:**
|
||||
|
||||
- [4703](event-4703.md)(S): A user right was adjusted.
|
||||
|
||||
**Event volume**: High.
|
||||
@ -24,35 +24,46 @@ By default Windows firewall won't prevent a port from being listened by an appli
|
||||
|
||||
You can add your own filters using the WFP APIs to block listen to reproduce this event: <https://msdn.microsoft.com/library/aa364046(v=vs.85).aspx>.
|
||||
|
||||
There is no event example in this document.
|
||||
|
||||
***Subcategory:*** [Audit Filtering Platform Connection](audit-filtering-platform-connection.md)
|
||||
|
||||
***Event Schema:***
|
||||
***Event Description:***
|
||||
|
||||
*The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.*
|
||||
This event generates every time the [Windows Filtering Platform](https://docs.microsoft.com/windows/win32/fwp/windows-filtering-platform-start-page) blocks an application or service from listening on a port for incoming connections.
|
||||
|
||||
*Application Information:*
|
||||
<br clear="all">
|
||||
|
||||
> *Process ID:%1*
|
||||
>
|
||||
> *Application Name:%2*
|
||||
|
||||
*Network Information:*
|
||||
|
||||
> *Source Address:%3*
|
||||
>
|
||||
> *Source Port:%4*
|
||||
>
|
||||
> *Protocol:%5*
|
||||
|
||||
*Filter Information:*
|
||||
|
||||
> *Filter Run-Time ID:%6*
|
||||
>
|
||||
> *Layer Name:%7*
|
||||
>
|
||||
> *Layer Run-Time ID:%8*
|
||||
***Event XML:***
|
||||
```xml
|
||||
<Event
|
||||
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
<System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
<EventID>5155</EventID>
|
||||
<Version>0</Version>
|
||||
<Level>0</Level>
|
||||
<Task>12810</Task>
|
||||
<Opcode>0</Opcode>
|
||||
<Keywords>0x8010000000000000</Keywords>
|
||||
<TimeCreated SystemTime="2019-04-18T03:49:08.507780900Z" />
|
||||
<EventRecordID>42196</EventRecordID>
|
||||
<Correlation />
|
||||
<Execution ProcessID="4" ThreadID="2788" />
|
||||
<Channel>Security</Channel>
|
||||
<Computer>NATHAN-AGENT2</Computer>
|
||||
<Security />
|
||||
</System>
|
||||
<EventData>
|
||||
<Data Name="ProcessId">2628</Data>
|
||||
<Data Name="Application">\device\harddiskvolume2\users\test\desktop\netcat\nc.exe</Data>
|
||||
<Data Name="SourceAddress">0.0.0.0</Data>
|
||||
<Data Name="SourcePort">5555</Data>
|
||||
<Data Name="Protocol">6</Data>
|
||||
<Data Name="FilterRTID">84576</Data>
|
||||
<Data Name="LayerName">%%14609</Data>
|
||||
<Data Name="LayerRTID">40</Data>
|
||||
</EventData>
|
||||
</Event>
|
||||
```
|
||||
|
||||
***Required Server Roles:*** None.
|
||||
|
||||
@ -60,6 +71,76 @@ There is no event example in this document.
|
||||
|
||||
***Event Versions:*** 0.
|
||||
|
||||
***Field Descriptions:***
|
||||
|
||||
**Application Information**:
|
||||
|
||||
- **Process ID** \[Type = Pointer\]: Hexadecimal Process ID (PID) of the process which was permitted to bind to the local port. The PID is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
|
||||
|
||||
<img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" />
|
||||
|
||||
If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager.
|
||||
|
||||
You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**.
|
||||
|
||||
<!-- -->
|
||||
|
||||
- **Application Name** \[Type = UnicodeString\]**:** Full path and the name of the executable for the process.
|
||||
|
||||
Logical disk is displayed in the format \\device\\harddiskvolume\#. You can get all local volume numbers by using the **diskpart** utility. The command to get volume numbers using diskpart is “**list volume**”:
|
||||
|
||||
<img src="images/diskpart.png" alt="DiskPart illustration" width="786" height="246" />
|
||||
|
||||
**Network Information:**
|
||||
|
||||
- **Source Address** \[Type = UnicodeString\]**:** The local IP address of the computer running the application.
|
||||
|
||||
- IPv4 Address
|
||||
|
||||
- IPv6 Address
|
||||
|
||||
- :: - all IP addresses in IPv6 format
|
||||
|
||||
- 0.0.0.0 - all IP addresses in IPv4 format
|
||||
|
||||
- 127.0.0.1 , ::1 - localhost
|
||||
|
||||
- **Source Port** \[Type = UnicodeString\]**:** The port number used by the application.
|
||||
|
||||
- **Protocol** \[Type = UInt32\]: the protocol number being used.
|
||||
|
||||
| Service | Protocol Number |
|
||||
|----------------------------------------------------|-----------------|
|
||||
| Internet Control Message Protocol (ICMP) | 1 |
|
||||
| Transmission Control Protocol (TCP) | 6 |
|
||||
| User Datagram Protocol (UDP) | 17 |
|
||||
| General Routing Encapsulation (PPTP data over GRE) | 47 |
|
||||
| Authentication Header (AH) IPSec | 51 |
|
||||
| Encapsulation Security Payload (ESP) IPSec | 50 |
|
||||
| Exterior Gateway Protocol (EGP) | 8 |
|
||||
| Gateway-Gateway Protocol (GGP) | 3 |
|
||||
| Host Monitoring Protocol (HMP) | 20 |
|
||||
| Internet Group Management Protocol (IGMP) | 88 |
|
||||
| MIT Remote Virtual Disk (RVD) | 66 |
|
||||
| OSPF Open Shortest Path First | 89 |
|
||||
| PARC Universal Packet Protocol (PUP) | 12 |
|
||||
| Reliable Datagram Protocol (RDP) | 27 |
|
||||
| Reservation Protocol (RSVP) QoS | 46 |
|
||||
|
||||
**Filter Information:**
|
||||
|
||||
- **Filter Run-Time ID** \[Type = UInt64\]: A unique filter ID which blocks the application from binding to the port. By default, Windows firewall won't prevent a port from binding to an application, and if this application doesn’t match any filters, you will get a 0 value in this field.
|
||||
|
||||
To find a specific Windows Filtering Platform filter by ID, you need to execute the following command: **netsh wfp show filters**. As a result of this command, a **filters.xml** file will be generated. You need to open this file and find the specific substring with the required filter ID (**<filterId>**), for example:
|
||||
|
||||
<img src="images/filters-xml-file.png" alt="Filters.xml file illustration" width="840" height="176" />
|
||||
|
||||
- **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name.
|
||||
|
||||
- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, you need to execute the following command: **netsh wfp show state**. As result of this command, a **wfpstate.xml** file will be generated. You need to open this file and find the specific substring with the required layer ID (**<layerId>**), for example:
|
||||
|
||||
<img src="images/wfpstate-xml.png" alt="Wfpstate xml illustration" width="1563" height="780" />
|
||||
|
||||
## Security Monitoring Recommendations
|
||||
|
||||
- If you use Windows Filtering Platform APIs to block application or services from listening on a port, then you can use this event for troubleshooting and monitoring.
|
||||
|
||||
@ -274,9 +274,12 @@ B. If you experience software or device malfunction after using the above proced
|
||||
|
||||
C. If you experience a critical error during boot or your system is unstable after using the above procedure to turn on HVCI, you can recover using the Windows Recovery Environment (Windows RE). To boot to Windows RE, see [Windows RE Technical Reference](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). After logging in to Windows RE, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device.
|
||||
|
||||
## How to turn off HVCI on the Windows 10 Fall Creators Update
|
||||
## How to turn off HVCI
|
||||
|
||||
1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity.
|
||||
1. Run the following command from an elevated prompt to set the HVCI registry key to off
|
||||
```ini
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
|
||||
```
|
||||
2. Restart the device.
|
||||
3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed.
|
||||
|
||||
|
||||
@ -61,6 +61,6 @@ We recommend:
|
||||
|
||||
* Educate your employees so they can identify social engineering and spear-phishing attacks.
|
||||
|
||||
* [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). It can stop ransomware from encrypting files and holding the files for ransom.
|
||||
* [Controlled folder access](../microsoft-defender-atp/controlled-folders.md). It can stop ransomware from encrypting files and holding the files for ransom.
|
||||
|
||||
For more general tips, see [prevent malware infection](prevent-malware-infection.md).
|
||||
|
||||
@ -40,7 +40,7 @@ Entities are the starting point for Automated investigations. When an alert cont
|
||||
>- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/en-us/help/4493464/windows-10-update-kb4493464)) or later
|
||||
>- Later versions of Windows 10
|
||||
|
||||
The alerts start by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view.
|
||||
The Automated investigation starts by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view.
|
||||
|
||||
### Details of an Automated investigation
|
||||
|
||||
@ -85,4 +85,4 @@ The default machine group is configured for semi-automatic remediation. This mea
|
||||
When a pending action is approved, the entity is then remediated and this new state is reflected in the **Entities** tab of the investigation.
|
||||
|
||||
## Related topic
|
||||
- [Learn about the automated investigations dashboard](manage-auto-investigation.md)
|
||||
- [Learn about the automated investigations dashboard](manage-auto-investigation.md)
|
||||
|
||||
@ -55,7 +55,7 @@ For more information about disabling local list merging, see [Prevent or allow u
|
||||
> If controlled folder access is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Security app after a restart of the device.
|
||||
> If the feature is set to **Audit mode** with any of those tools, the Windows Security app will show the state as **Off**.
|
||||
|
||||
>If you are protecting user profile data, we recommend that the user profile should be on the default Windows installation drive.
|
||||
> If you are protecting user profile data, we recommend that the user profile should be on the default Windows installation drive.
|
||||
|
||||
## Intune
|
||||
|
||||
@ -63,7 +63,7 @@ For more information about disabling local list merging, see [Prevent or allow u
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**.
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Enable**.
|
||||
1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.
|
||||
|
||||
|
||||
|
||||
@ -67,7 +67,8 @@ Machines with similar tags can be handy when you need to apply contextual action
|
||||
Use the following registry key entry to add a tag on a machine:
|
||||
|
||||
- Registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\`
|
||||
- Registry key value (string): Group
|
||||
- Registry key name: `Group`
|
||||
- Registry key value (REG_SZ): `Name of the tag you want to set`
|
||||
|
||||
>[!NOTE]
|
||||
>The device tag is part of the machine information report that's generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report.
|
||||
|
||||
@ -23,12 +23,12 @@ ms.date: 04/11/2019
|
||||
|
||||
The cybersecurity weaknesses identified in your organization are mapped to actionable security recommendations and prioritized by their impact on the security recommendation list. Prioritized recommendation helps shorten the mean time to mitigate or remediate vulnerabilities and drive compliance.
|
||||
|
||||
Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and SCCM. It is also dynamic in the sense that when the threat landscape changes, the recommendation also changes as it continuously collect information from your environment.
|
||||
Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). It is also dynamic in the sense that when the threat landscape changes, the recommendation also changes as it continuously collect information from your environment.
|
||||
|
||||
## The basis of the security recommendation
|
||||
Each machine in the organization is scored based on three important factors: threat, likelihood to be breached, and value, to help customers to focus on the right things at the right time.
|
||||
|
||||
- Threat - Characteristics of the vulnerabilities and exploits in your organizations' devices and breach history. Based on these factors, the security recommendations shows the correponding links to active alerts, ongoing threat campaigns, and their corresponding threat analytic reports.
|
||||
- Threat - Characteristics of the vulnerabilities and exploits in your organizations' devices and breach history. Based on these factors, the security recommendations shows the corresponding links to active alerts, ongoing threat campaigns, and their corresponding threat analytic reports.
|
||||
|
||||
- Breach likelihood - Your organization's security posture and resilience against threats
|
||||
|
||||
@ -36,7 +36,8 @@ Each machine in the organization is scored based on three important factors: thr
|
||||
|
||||
|
||||
## Navigate through your security recommendations
|
||||
You can access the security recommendation from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page, to give you the context that you need as you require it.
|
||||
|
||||
You can access the security recommendation from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page, to give you the context that you need, as you require it.
|
||||
|
||||
There are security recommendations for application, operating system, network, accounts, and security controls.
|
||||
|
||||
|
||||
@ -35,14 +35,13 @@ The following table lists and explains the allowed encryption types.
|
||||
|
||||
| Encryption type | Description and version support |
|
||||
| - | - |
|
||||
| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES| by default.
|
||||
| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. |
|
||||
| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. |
|
||||
| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function<br/>Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2.|
|
||||
| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. |
|
||||
| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).<br/>Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. |
|
||||
| Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.|
|
||||
|
||||
|
||||
|
||||
### Possible values
|
||||
|
||||
|
||||
|
||||
@ -41,7 +41,7 @@ Tool|Deployment options (<a href="#fn2" id="ref2">2</a>)|Management options (net
|
||||
Microsoft Intune|[Add endpoint protection settings in Intune](https://docs.microsoft.com/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](https://docs.microsoft.com/intune/device-restrictions-configure)| [Use the Intune console to manage devices](https://docs.microsoft.com/intune/device-management)
|
||||
System Center Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][]
|
||||
Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Windows Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Windows Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][]
|
||||
PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference][] and [Update-MpSignature] [] cmdlets available in the Defender module|Use the appropriate [Get- cmdlets available in the Defender module][]
|
||||
PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference] and [Update-MpSignature] cmdlets available in the Defender module.|Use the appropriate [Get- cmdlets available in the Defender module][]
|
||||
Windows Management Instrumentation|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][]
|
||||
Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Windows Defender Antivirus events][] and add that tool as an app in AAD.
|
||||
|
||||
|
||||
@ -166,6 +166,12 @@ Once the Intune changes are propagated to the enrolled devices, you can see them
|
||||
|
||||
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
Issue: No license found
|
||||
|
||||
Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml
|
||||
|
||||
## Logging installation issues
|
||||
|
||||
For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) .
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Microsoft recommended block rules (Windows 10)
|
||||
description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Comntrol, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies.
|
||||
description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies.
|
||||
keywords: virtualization, security, malware
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -33,9 +33,17 @@ These settings, located at **Computer Configuration\Administrative Templates\Net
|
||||
|Policy name|Supported versions|Description|
|
||||
|-----------|------------------|-----------|
|
||||
|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
|
||||
|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Notes: 1) Include a full domain name in the configuration, for example **www.contoso.com**, to trust only in this literal value. 2) You may optionally use "." as a wildcard character to automatically trust subdomains on only one level of the domain hierarchy that is to the left of the dot. Configuring **".constoso.com"** will automatically trust **"local.contoso.com"**, **"shop.contoso.com"**, and all other values on the left. 3) You may optionally use ".." as a wildcard character to automatically trust subdomains on all the levels of the domain hierarchy that are to the left of the dots. Configuring **"..constoso.com"** will automatically trust **"us.shop.contoso.com"**, **"trainning.contoso.com"**, and all other values on the left. |
|
||||
|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment.|
|
||||
|
||||
|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.|
|
||||
|
||||
## Network isolation settings wildcards
|
||||
|
||||
|Value|Number of dots to the left|Meaning|
|
||||
|-----|--------------------------|-------|
|
||||
|contoso.com|0|Trust only the literal value of **contoso.com**.|
|
||||
|www.contoso.com|0|Trust only the literal value of **www.contoso.com**.|
|
||||
|.contoso.com|1|Trust any domain that ends with the text **contoso.com**. Matching sites include **spearphishingcontoso.com**, **contoso.com**, and **www.contoso.com**.|
|
||||
|..contoso.com|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include **shop.contoso.com**, **us.shop.contoso.com**, **www.us.shop.contoso.com**, but NOT **contoso.com** itself.|
|
||||
|
||||
## Application-specific settings
|
||||
These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard**, can help you to manage your company's implementation of Application Guard.
|
||||
|
||||
Reference in New Issue
Block a user