mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
Merge remote-tracking branch 'origin/master' into atp-reorg2
This commit is contained in:
jcaparas
@ -218,7 +218,7 @@ Windows PowerShell
|
||||
|
||||
``` syntax
|
||||
New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management”
|
||||
New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management”
|
||||
New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management”
|
||||
```
|
||||
|
||||
If the group is not specified at rule creation time, the rule can be added to the rule group using dot notation in Windows PowerShell. You cannot specify the group using `Set-NetFirewallRule` since the command allows querying by rule group.
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 06/04/2018
|
||||
---
|
||||
|
||||
# Prepare your organization for BitLocker: Planning and policies
|
||||
@ -157,18 +157,13 @@ Full drive encryption means that the entire drive will be encrypted, regardless
|
||||
|
||||
## <a href="" id="bkmk-addscons"></a>Active Directory Domain Services considerations
|
||||
|
||||
BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure Group Policy settings to enable backup of BitLocker or TPM recovery information. Before configuring these settings verify that access permissions have been granted to perform the backup.
|
||||
BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure the following Group Policy setting to enable backup of BitLocker recovery information:
|
||||
|
||||
By default, domain administrators are the only users that will have access to BitLocker recovery information. When you plan your support process, define what parts of your organization need access to BitLocker recovery information. Use this information to define how the appropriate rights will be delegated in your AD DS environment.
|
||||
Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Turn on BitLocker backup to Active Directory Domain Services
|
||||
|
||||
It is a best practice to require backup of recovery information for both the TPM and BitLocker to AD DS. You can implement this practice by configuring the Group Policy settings below for your BitLocker-protected computers.
|
||||
By default, only Domain Admins have access to BitLocker recovery information, but [access can be delegated to others](https://blogs.technet.microsoft.com/craigf/2011/01/26/delegating-access-in-ad-to-bitlocker-recovery-information/).
|
||||
|
||||
| BitLocker Group Policy setting | Configuration |
|
||||
| - | - |
|
||||
| BitLocker Drive Encryption: Turn on BitLocker backup to Active Directory Domain Services| Require BitLocker backup to AD DS (Passwords and key packages)|
|
||||
| Trusted Platform Module Services: Turn on TPM backup to Active Directory Domain Services | Require TPM backup to AD DS|
|
||||
|
||||
The following recovery data will be saved for each computer object:
|
||||
The following recovery data is saved for each computer object:
|
||||
|
||||
- **Recovery password**
|
||||
|
||||
@ -178,51 +173,6 @@ The following recovery data will be saved for each computer object:
|
||||
|
||||
With this key package and the recovery password, you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged. Each key package will only work with the volume it was created on, which can be identified by the corresponding volume ID.
|
||||
|
||||
- **TPM owner authorization password hash**
|
||||
|
||||
When ownership of the TPM is taken a hash of the ownership password can be taken and stored in AD DS. This information can then be used to reset ownership of the TPM.
|
||||
|
||||
Starting in Windows 8, a change to how the TPM owner authorization value is stored in AD DS was implemented in the AD DS schema. The TPM owner authorization value is now stored in a separate object which is linked to the Computer object. This value was stored as a property in the Computer object itself for the default Windows Server 2008 R2 and later schemas.
|
||||
|
||||
To take advantage of this integration, you must upgrade your domain controllers to Windows Server 2012 or extend the Active Directory schema and configure BitLocker-specific Group Policy objects.
|
||||
|
||||
>**Note:** The account that you use to update the Active Directory schema must be a member of the Schema Admins group.
|
||||
|
||||
Windows Server 2012 domain controllers have the default schema to backup TPM owner authorization information in the separate object. If you are not upgrading your domain controller to Windows Server 2012 you need to extend the schema to support this change.
|
||||
|
||||
**To support Windows 8 and later computers that are managed by a Windows Server 2003 or Windows 2008 domain controller**
|
||||
|
||||
There are two schema extensions that you can copy down and add to your AD DS schema:
|
||||
|
||||
- **TpmSchemaExtension.ldf**
|
||||
|
||||
This schema extension brings parity with the Windows Server 2012 schema. With this change, the TPM owner authorization information is stored in a separate TPM object linked to the corresponding computer object. Only the Computer object that has created the TPM object can update it. This means that any subsequent updates to the TPM objects will not succeed in dual boot scenarios or scenarios where the computer is reimaged resulting in a new AD computer object being created. To support such scenarios, an update to the schema was created.
|
||||
|
||||
- **TpmSchemaExtensionACLChanges.ldf**
|
||||
|
||||
This schema update modifies the ACLs on the TPM object to be less restrictive so that any subsequent operating system which takes ownership of the computer object can update the owner authorization value in AD DS. However, this is less secure as any computer in the domain can now update the OwnerAuth of the TPM object (although it cannot read the OwnerAuth) and DOS attacks can be made from within the enterprise. The recommended mitigation in such a scenario is to do regular backup of TPM objects and enable auditing to track changes for these objects.
|
||||
|
||||
To download the schema extensions, see [AD DS schema extensions to support TPM backup](https://technet.microsoft.com/library/jj635854.aspx).
|
||||
|
||||
If you have a Windows Server 2012 domain controller in your environment, the schema extensions are already in place and do not need to be updated.
|
||||
|
||||
>**Caution:** To configure Group Policy objects to backup TPM and BitLocker information in AD DS at least one of the domain controllers in your forest must be running at least Windows Server 2008 R2.
|
||||
If Active Directory backup of the TPM owner authorization value is enabled in an environment without the required schema extensions, the TPM provisioning will fail and the TPM will remain in a Not Ready state for computers running Windows 8 and later.
|
||||
|
||||
**Setting the correct permissions in AD DS**
|
||||
|
||||
To initialize the TPM successfully so that you can turn on BitLocker requires that the correct permissions for the SELF account in be set in AD DS for the **ms-TPMOwnerInformation** attribute. The following steps detail setting these permissions as required by BitLocker:
|
||||
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. Select the organizational unit (OU) which contains the computer accounts that will have BitLocker turned on.
|
||||
3. Right-click the OU and click **Delegate Control** to open the **Delegation of Control** wizard.
|
||||
4. Click **Next** to go to the **Users or Groups** page and then click **Add**.
|
||||
5. In the **Select Users, Computers, or Groups** dialog box, type **SELF** as the object name and then click **OK** Once the object has been validated you will be returned to the **Users or Groups** wizard page and the SELF account will be listed. Click **Next**.
|
||||
6. On the **Tasks to Delegate** page, choose **Create a custom task to delegate** and then click **Next**.
|
||||
7. On the **Active Directory Object Type** page, choose **Only the following objects in the folder** and then check **Computer Objects** and then click **Next**.
|
||||
8. On the **Permissions** page, for **Show these permissions**, check **General**, **Property-specific**, and **Creation/deletion of specific child objects**. Scroll down the **Permissions** list and check both **Write msTPM-OwnerInformation** and **Write msTPM-TpmInformationForComputer** then click **Next**.
|
||||
9. Click **Finish** to apply the permissions settings.
|
||||
|
||||
## <a href="" id="bkmk-fipssupport"></a>FIPS support for recovery password protector
|
||||
|
||||
Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode.
|
||||
|
||||
@ -19,13 +19,13 @@ ms.date: 05/17/2018
|
||||
|
||||
You can use Microsoft Intune to configure Windows Defender Application Control (WDAC). You can configure Windows 10 client computers to only run Windows components and Microsoft Store apps, or let them also run reputable apps defined by the Intelligent Security Graph.
|
||||
|
||||
1. Open the Microsoft Intune portal and click **Device configuration** > **Profiles** > **Creae profile**.
|
||||
1. Open the Microsoft Intune portal and click **Device configuration** > **Profiles** > **Create profile**.
|
||||
|
||||
3. Type a name for the new profile, select **Windows 10 and later** as the **Platform** and **Endpoint protection** as the **Profile type**.
|
||||
|
||||
|
||||
|
||||
4. Click **Configure** > **Windows Defender Application Control**. for the following settings and then click **OK**:
|
||||
4. Click **Configure** > **Windows Defender Application Control**, choose from the following settings and then click **OK**:
|
||||
|
||||
- **Application control code intergity policies**: Select **Audit only** to log events but not block any apps from running or select **Enforce** to allow only Windows components and Store apps to run.
|
||||
- **Trust apps with good reputation**: Select **Enable** to allow reputable apps as defined by the Intelligent Security Graph to run in addition to Windows components and Store apps.
|
||||
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 04/24/2018
|
||||
ms.date: 06/01/2018
|
||||
---
|
||||
|
||||
# Advanced hunting reference in Windows Defender ATP
|
||||
@ -35,75 +35,73 @@ Use the following table to understand what the columns represent, its data type,
|
||||
|
||||
| Column name | Data type | Description
|
||||
:---|:--- |:---
|
||||
| AccountDomain | string | Domain of the account. |
|
||||
| AccountName | string | User name of the account. |
|
||||
| AccountSid | string | Security Identifier (SID) of the account. |
|
||||
| ActionType | string | Type of activity that triggered the event. |
|
||||
| AdditionalFields | string | Additional information about the event in JSON array format. |
|
||||
| AlertId | string | Unique identifier for the alert. |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine. |
|
||||
| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information. |
|
||||
| EventId | int | Unique identifier used by Event Tracing for Windows (ETW) for the event type. |
|
||||
| EventTime | datetime | Date and time when the event was recorded. |
|
||||
| EventType | string | Table where the record is stored. |
|
||||
| FileName | string | Name of the file that the recorded action was applied to. |
|
||||
| FileOriginIp | string | IP address where the file was downloaded from. |
|
||||
| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file. |
|
||||
| FileOriginUrl | string | URL where the file was downloaded from. |
|
||||
| FolderPath | string | Folder containing the file that the recorded action was applied to. |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event. |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event. |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event. |
|
||||
| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event. |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started. |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event. |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event. |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event. |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources. |
|
||||
| InitiatingProcessMd5 | string | MD5 hash of the process (image file) that initiated the event. |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started. |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event. |
|
||||
| InitiatingProcessParentName | string | Name of the parent process that spawned the process responsible for the event. |
|
||||
| InitiatingProcessSha1 | string | SHA-1 of the process (image file) that initiated the event. |
|
||||
| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available. |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event. |
|
||||
| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory. |
|
||||
| LocalIP | string | IP address assigned to the local machine used during communication. |
|
||||
| LocalPort | int | TCP port on the local machine used during communication. |
|
||||
| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format. |
|
||||
| LogonType | string | Type of logon session, specifically: <br><br> - **Interactive** - User physically interacts with the machine using the local keyboard and screen.<br> <br> - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients. <br><br> - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed. <br><br> - **Batch** - Session initiated by scheduled tasks. <br><br> - **Service** - Session initiated by services as they start. <br>
|
||||
| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine. |
|
||||
| MachineId | string | Unique identifier for the machine in the service. |
|
||||
| MD5 | string | MD5 hash of the file that the recorded action was applied to. |
|
||||
| NetworkCardIPs | string | List of all network adapters on the machine, including their MAC addresses and assigned IP addresses, in JSON array format. |
|
||||
| OSArchitecture | string | Architecture of the operating system running on the machine. |
|
||||
| OSBuild | string | Build version of the operating system running on the machine. |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| PreviousRegistryKey | string | Original registry key of the registry value before it was modified. |
|
||||
| PreviousRegistryValueData | string | Original data of the registry value before it was modified. |
|
||||
| PreviousRegistryValueName | string | Original name of the registry value before it was modified. |
|
||||
| PreviousRegistryValueType | string | Original data type of the registry value before it was modified. |
|
||||
| ProcessCommandline | string | Command line used to create the new process. |
|
||||
| ProcessCreationTime | datetime | Date and time the process was created. |
|
||||
| ProcessId | int | Process ID (PID) of the newly created process. |
|
||||
| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. |
|
||||
| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process. |
|
||||
| ProviderId | string | Unique identifier for the Event Tracing for Windows (ETW) provider that collected the event log. |
|
||||
| RegistryKey | string | Registry key that the recorded action was applied to. |
|
||||
| RegistryValueData | string | Data of the registry value that the recorded action was applied to. |
|
||||
| RegistryValueName | string | Name of the registry value that the recorded action was applied to. |
|
||||
| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to. |
|
||||
| RemoteIP | string | IP address that was being connected to. |
|
||||
| RemotePort | int | TCP port on the remote device that was being connected to. |
|
||||
| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to. |
|
||||
| ReportIndex | long | Event identifier that is unique among the same event type. |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to. |
|
||||
| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available.
|
||||
| AccountDomain | string | Domain of the account |
|
||||
| AccountName | string | User name of the account |
|
||||
| AccountSid | string | Security Identifier (SID) of the account |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| AdditionalFields | string | Additional information about the event in JSON array format |
|
||||
| AlertId | string | Unique identifier for the alert |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| EventType | string | Table where the record is stored |
|
||||
| FileName | string | Name of the file that the recorded action was applied to |
|
||||
| FileOriginIp | string | IP address where the file was downloaded from |
|
||||
| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file |
|
||||
| FileOriginUrl | string | URL where the file was downloaded from |
|
||||
| FolderPath | string | Folder containing the file that the recorded action was applied to |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources. |
|
||||
| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. |
|
||||
| InitiatingProcessMd5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessSha1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available. |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory |
|
||||
| LocalIP | string | IP address assigned to the local machine used during communication |
|
||||
| LocalPort | int | TCP port on the local machine used during communication |
|
||||
| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format |
|
||||
| LogonType | string | Type of logon session, specifically: <br><br> - **Interactive** - User physically interacts with the machine using the local keyboard and screen.<br> <br> - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients. <br><br> - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed. <br><br> - **Batch** - Session initiated by scheduled tasks. <br><br> - **Service** - Session initiated by services as they start. <br>
|
||||
| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine. |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| MD5 | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| NetworkCardIPs | string | List of all network adapters on the machine, including their MAC addresses and assigned IP addresses, in JSON array format |
|
||||
| OSArchitecture | string | Architecture of the operating system running on the machine |
|
||||
| OSBuild | string | Build version of the operating system running on the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| PreviousRegistryKey | string | Original registry key of the registry value before it was modified |
|
||||
| PreviousRegistryValueData | string | Original data of the registry value before it was modified |
|
||||
| PreviousRegistryValueName | string | Original name of the registry value before it was modified |
|
||||
| PreviousRegistryValueType | string | Original data type of the registry value before it was modified |
|
||||
| ProcessCommandline | string | Command line used to create the new process |
|
||||
| ProcessCreationTime | datetime | Date and time the process was created |
|
||||
| ProcessId | int | Process ID (PID) of the newly created process |
|
||||
| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. |
|
||||
| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| ProviderId | string | Unique identifier for the Event Tracing for Windows (ETW) provider that collected the event log |
|
||||
| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information. | |
|
||||
| RegistryKey | string | Registry key that the recorded action was applied to |
|
||||
| RegistryValueData | string | Data of the registry value that the recorded action was applied to |
|
||||
| RegistryValueName | string | Name of the registry value that the recorded action was applied to |
|
||||
| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to |
|
||||
| RemoteIP | string | IP address that was being connected to |
|
||||
| RemotePort | int | TCP port on the remote device that was being connected to |
|
||||
| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns. |
|
||||
| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. |
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
- [Advanced hunting query language best practices](/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
- [Advanced hunting query language best practices](/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 04/24/2018
|
||||
ms.date: 05/21/2018
|
||||
---
|
||||
|
||||
|
||||
@ -211,6 +211,12 @@ Check that the onboarding settings and scripts were deployed properly. Try to re
|
||||
See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>29</td>
|
||||
<td>Failed to read the offboarding parameters. Error type: %1, Error code: %2, Description: %3 </td>
|
||||
<td>This event occurs when the system can't read the offboarding parameters.</td>
|
||||
<td>Ensure the machine has Internet access, then run the entire offboarding process again.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>30</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender Antivirus. Failure code: ```variable```.</td>
|
||||
<td>Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP.</td>
|
||||
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 04/24/2018
|
||||
ms.date: 06/04/2018
|
||||
---
|
||||
|
||||
# Minimum requirements for Windows Defender ATP
|
||||
@ -43,7 +43,7 @@ Windows Defender Advanced Threat Protection requires one of the following Micros
|
||||
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
|
||||
|
||||
### Network and data storage and configuration requirements
|
||||
When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: either in a European or United States datacenter.
|
||||
When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the United Kingdom, Europe, or United States datacenter.
|
||||
|
||||
> [!NOTE]
|
||||
> - You cannot change your data storage location after the first-time setup.
|
||||
|
||||
Reference in New Issue
Block a user