mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 05:17:22 +00:00
freshness review
This commit is contained in:
Paolo Matarazzo
parent
2abc643850
commit
9f80374b38
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Take a Test in kiosk mode
|
||||
description: Learn how to configure Windows to execute the Take a Test app in kiosk mode, using Intune and provisioning packages.
|
||||
ms.date: 09/06/2024
|
||||
title: Configure Take a Test in Kiosk Mode
|
||||
description: Learn how to configure Windows to execute the Take a Test app in kiosk mode using different methods.
|
||||
ms.date: 04/07/2025
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
@ -11,10 +11,11 @@ Executing Take a Test in kiosk mode is the recommended option for high stakes as
|
||||
|
||||
The configuration of Take a Test in kiosk mode can be done using:
|
||||
|
||||
- Microsoft Intune/MDM
|
||||
- a provisioning package (PPKG)
|
||||
- Microsoft Intune
|
||||
- Configuration service provider (CSP)
|
||||
- A provisioning package (PPKG)
|
||||
- PowerShell
|
||||
- the Settings app
|
||||
- The Settings app
|
||||
|
||||
When using the Settings app, you can configure Take a Test in kiosk mode using a local account only. This option is recommended for devices that aren't managed.
|
||||
The other options allow you to configure Take a Test in kiosk mode using a local account, an account defined in the directory, or a guest account.
|
||||
@ -28,18 +29,6 @@ Follow the instructions below to configure your devices, selecting the option th
|
||||
|
||||
# [:::image type="icon" source="images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
|
||||
|
||||
You can use Intune for Education or a custom profile in Microsoft Intune:
|
||||
|
||||
- Intune for Education provides a simpler experience
|
||||
- A custom profile provides more flexibility and controls over the configuration
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Currently, the policy created in Intune for Education is applicable to Windows 10 and Windows 11 only. **It will not apply to Windows 11 SE devices.**
|
||||
>
|
||||
> If you want to configure Take a Test for Windows 11 SE devices, you must use a custom policy.
|
||||
|
||||
### Configure Take a Test from Intune for Education
|
||||
|
||||
To configure devices using Intune for Education, follow these steps:
|
||||
|
||||
1. Sign in to the <a href="https://intuneeducation.portal.azure.com/" target="_blank"><b>Intune for Education portal</b></a>
|
||||
@ -51,9 +40,9 @@ To configure devices using Intune for Education, follow these steps:
|
||||
|
||||
:::image type="content" source="./images/takeatest/intune-education-take-a-test-profile.png" alt-text="Intune for Education - creation of a Take a Test profile." lightbox="./images/takeatest/intune-education-take-a-test-profile.png" border="true":::
|
||||
|
||||
### Configure Take a Test with a custom policy
|
||||
# [:::image type="icon" source="images/icons/csp.svg"::: **CSP**](#tab/csp)
|
||||
|
||||
[!INCLUDE [intune-custom-settings-1](../../includes/configure/intune-custom-settings-1.md)]
|
||||
To configure devices using configuration service providers, use the following settings:
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
@ -65,10 +54,6 @@ To configure devices using Intune for Education, follow these steps:
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/SharedPC/KioskModeUserTileDisplayText`** </li><li>Data type: **String** </li><li> Value: **Take a Test** (or a string of your choice to display in the sing-in screen)</li>|
|
||||
| <li> OMA-URI: **`./Vendor/MSFT/SecureAssessment/LaunchURI`** </li><li>Data type: **String** </li><li> Value: **\<provide testing URL>**</li>|
|
||||
|
||||
:::image type="content" source="./images/takeatest/intune-take-a-test-custom-profile.png" alt-text="Intune portal - creation of a custom policy to configure Take a Test." lightbox="./images/takeatest/intune-take-a-test-custom-profile.png" border="true":::
|
||||
|
||||
[!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)]
|
||||
|
||||
# [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
|
||||
|
||||
To create a provisioning package, you can either use Set up School PCs or Windows Configuration Designer:
|
||||
|
||||
10
education/windows/images/icons/csp.svg
Normal file
10
education/windows/images/icons/csp.svg
Normal file
@ -0,0 +1,10 @@
|
||||
<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||||
<g clip-path="url(#clip0_461_479)">
|
||||
<path d="M9.01098 0.225006C9.67158 0.23262 10.3296 0.30894 10.9743 0.452742C11.2558 0.515517 11.4663 0.750165 11.4982 1.03677L11.6514 2.41094C11.7208 3.04188 12.2535 3.51976 12.8885 3.52043C13.0593 3.5207 13.2281 3.48515 13.3859 3.41535L14.6464 2.86161C14.9086 2.74644 15.215 2.80923 15.4106 3.01826C16.3216 3.99118 17 5.15804 17.3949 6.43103C17.4801 6.70553 17.3821 7.00383 17.1508 7.17436L16.0334 7.99795C15.7146 8.23213 15.5264 8.60401 15.5264 8.99956C15.5264 9.39502 15.7146 9.7669 16.0341 10.0016L17.1524 10.8255C17.3838 10.9959 17.4819 11.2943 17.3967 11.5689C17.002 12.8417 16.3239 14.0084 15.4135 14.9815C15.218 15.1905 14.9119 15.2535 14.6498 15.1385L13.3841 14.5841C13.0219 14.4256 12.6061 14.4488 12.2639 14.6466C11.9217 14.8443 11.694 15.1931 11.6505 15.5859L11.4983 16.96C11.4669 17.2433 11.261 17.4764 10.9836 17.5424C9.68004 17.8525 8.32185 17.8525 7.01823 17.5424C6.74092 17.4764 6.53495 17.2433 6.50356 16.96L6.35162 15.588C6.30699 15.1959 6.07891 14.8482 5.73698 14.6511C5.39506 14.454 4.97988 14.4309 4.61898 14.5885L3.35301 15.143C3.0908 15.258 2.78463 15.195 2.5891 14.9858C1.67816 14.0117 1.00007 12.8435 0.605881 11.5693C0.520975 11.2949 0.619075 10.9967 0.850366 10.8264L1.96936 10.002C2.28809 9.7678 2.47632 9.39592 2.47632 9.00046C2.47632 8.60491 2.28809 8.23303 1.96894 7.99858L0.850645 7.17557C0.619021 7.00511 0.520831 6.70661 0.606034 6.43193C1.00091 5.15894 1.67935 3.99208 2.59032 3.01916C2.78603 2.81013 3.09235 2.74734 3.35452 2.86251L4.61486 3.41615C4.97751 3.57531 5.39442 3.55127 5.73819 3.35043C6.08048 3.15189 6.30836 2.8028 6.35235 2.40988L6.50542 1.03677C6.53739 0.750021 6.74807 0.515292 7.02972 0.452652C7.67529 0.309084 8.334 0.232791 9.01098 0.225006ZM8.99973 6.29996C7.50852 6.29996 6.29973 7.5088 6.29973 9.00001C6.29973 10.4911 7.50852 11.7 8.99973 11.7C10.4909 11.7 11.6997 10.4911 11.6997 9.00001C11.6997 7.5088 10.4909 6.29996 8.99973 6.29996Z" fill="#0883D9"/>
|
||||
</g>
|
||||
<defs>
|
||||
<clipPath id="clip0_461_479">
|
||||
<rect width="18" height="18" fill="white"/>
|
||||
</clipPath>
|
||||
</defs>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.1 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 221 KiB |
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Take a Test app technical reference
|
||||
title: Take a Test App Technical Reference
|
||||
description: List of policies and settings applied by the Take a Test app.
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
ms.topic: reference
|
||||
---
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
ms.date: 09/06/2024
|
||||
title: Access Control overview
|
||||
ms.date: 04/07/2025
|
||||
title: Access Control Overview
|
||||
description: Learn about access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer.
|
||||
ms.topic: overview
|
||||
appliesto:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
title: Local Accounts
|
||||
description: Learn how to secure and manage access to the resources on a standalone or member server for services or users.
|
||||
ms.topic: concept-article
|
||||
@ -225,33 +225,33 @@ The following table shows the Group Policy and registry settings that are used t
|
||||
#### To enforce local account restrictions for remote access
|
||||
|
||||
1. Start the **Group Policy Management** Console (GPMC)
|
||||
1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, expand <*Forest*>\Domains\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, right-click **Group Policy Objects > New**
|
||||
1. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer
|
||||
1. In the details pane, right-click <**gpo\_name**>, and > **Edit**
|
||||
1. In the **New GPO** dialog box, type <**gpo_name**>, and > **OK** where *gpo_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer
|
||||
1. In the details pane, right-click <**gpo_name**>, and > **Edit**
|
||||
1. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps:
|
||||
|
||||
- Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**
|
||||
- Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**
|
||||
- Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**
|
||||
- Navigate to the **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**
|
||||
- Select **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**
|
||||
- Select **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**
|
||||
|
||||
1. Ensure that the local account restrictions are applied to network interfaces by following these steps:
|
||||
|
||||
- Navigate to *Computer Configuration\Preferences and Windows Settings*, and > **Registry**
|
||||
- Right-click **Registry**, and > **New** > **Registry Item**
|
||||
- Right-click **Registry**, and > **New** > **Registry Item**
|
||||
- In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**
|
||||
- Ensure that the **Hive** box is set to **HKEY_LOCAL_MACHINE**
|
||||
- Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`
|
||||
- Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`
|
||||
- In the **Value name** area, type `LocalAccountTokenFilterPolicy`
|
||||
- In the **Value type** box, from the drop-down list, select **REG_DWORD** to change the value
|
||||
- In the **Value data** box, ensure that the value is set to **0**
|
||||
- Verify this configuration, and > **OK**
|
||||
- Verify this configuration, and > **OK**
|
||||
|
||||
1. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following:
|
||||
|
||||
- Navigate to the `*Forest*\<Domains>\*Domain*\*OU*` path
|
||||
- Right-click the **Workstations > Link an existing GPO**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
|
||||
1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy
|
||||
1. Create links to all other OUs that contain workstations
|
||||
@ -278,23 +278,23 @@ The following table shows the Group Policy settings that are used to deny networ
|
||||
#### To deny network logon to all local administrator accounts
|
||||
|
||||
1. Start the **Group Policy Management** Console (GPMC)
|
||||
1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, right-click **Group Policy Objects**, and > **New**
|
||||
1. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer
|
||||
1. In the details pane, right-click <**gpo\_name**>, and > **Edit**
|
||||
1. In the console tree, expand <*Forest*>\Domains\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, right-click **Group Policy Objects**, and > **New**
|
||||
1. In the **New GPO** dialog box, type <**gpo_name**>, and then > **OK** where *gpo_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer
|
||||
1. In the details pane, right-click <**gpo_name**>, and > **Edit**
|
||||
1. Configure the user rights to deny network logons for administrative local accounts as follows:
|
||||
1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment**
|
||||
1. Navigate to the Computer Configuration\Windows Settings\Security Settings\, and > **User Rights Assignment**
|
||||
1. Double-click **Deny access to this computer from the network**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows:
|
||||
1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment**
|
||||
1. Navigate to Computer Configuration\Policies\Windows Settings and Local Policies, and then select **User Rights Assignment**
|
||||
1. Double-click **Deny log on through Remote Desktop Services**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Link the GPO to the first **Workstations** OU as follows:
|
||||
|
||||
- Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path
|
||||
- Right-click the **Workstations** OU, and > **Link an existing GPO**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
- Navigate to the <*Forest*>\Domains\<*Domain*>\OU path
|
||||
- Right-click the **Workstations** OU, and > **Link an existing GPO**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
|
||||
1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy
|
||||
1. Create links to all other OUs that contain workstations
|
||||
|
||||
@ -1,10 +1,10 @@
|
||||
---
|
||||
title: Support for passkeys in Windows
|
||||
title: Support for Passkeys in Windows
|
||||
description: Learn about passkeys and how to use them on Windows devices.
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Deploy Virtual Smart Cards
|
||||
description: Learn about what to consider when deploying a virtual smart card authentication solution
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Deploy Virtual Smart Cards
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Evaluate Virtual Smart Card Security
|
||||
description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards.
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Evaluate Virtual Smart Card Security
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Get Started with Virtual Smart Cards - Walkthrough Guide
|
||||
description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards.
|
||||
ms.topic: get-started
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Get Started with Virtual Smart Cards: Walkthrough Guide
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Virtual Smart Card Overview
|
||||
description: Learn about virtual smart card technology for Windows.
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Virtual Smart Card Overview
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Tpmvscmgr
|
||||
description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer.
|
||||
ms.topic: reference
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Tpmvscmgr
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding and Evaluating Virtual Smart Cards
|
||||
description: Learn how smart card technology can fit into your authentication design.
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Understand and Evaluate Virtual Smart Cards
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Use Virtual Smart Cards
|
||||
description: Learn about the requirements for virtual smart cards, how to use and manage them.
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Use Virtual Smart Cards
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure Windows Firewall logging
|
||||
description: Learn how to configure Windows Firewall to log dropped packets or successful connections with CSP and group policy.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Configure Windows Firewall logging
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Manage Windows Firewall with the command line
|
||||
title: Manage Windows Firewall With the Command Line
|
||||
description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Manage Windows Firewall with the command line
|
||||
@ -53,7 +53,7 @@ netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFile
|
||||
|
||||
### Disable Windows Firewall
|
||||
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including:
|
||||
|
||||
- Start menu can stop working
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Configure firewall rules with group policy
|
||||
title: Configure Firewall Rules With Group Policy
|
||||
description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Configure rules with group policy
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Windows Firewall dynamic keywords
|
||||
title: Windows Firewall Dynamic Keywords
|
||||
description: Learn about Windows Firewall dynamic keywords and how to configure it using Windows PowerShell.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Windows Firewall dynamic keywords
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Filter origin audit log
|
||||
title: Filter Origin Audit Log
|
||||
description: Learn about Windows Firewall and filter origin audit log to troubleshoot packet drops.
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Filter origin audit log
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Hyper-V firewall
|
||||
title: Hyper-V Firewall
|
||||
description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP).
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
appliesto:
|
||||
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
|
||||
---
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Windows Firewall overview
|
||||
title: Windows Firewall Overview
|
||||
description: Learn overview information about the Windows Firewall security feature.
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Windows Firewall overview
|
||||
@ -75,7 +75,7 @@ The *public network* profile is designed with higher security in mind for public
|
||||
|
||||
## Disable Windows Firewall
|
||||
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including:
|
||||
|
||||
- Start menu can stop working
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Quarantine behavior
|
||||
title: Quarantine Behavior
|
||||
description: Learn about Windows Firewall and the quarantine feature behavior.
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Quarantine behavior
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Firewall rules
|
||||
title: Windows Firewall Rules
|
||||
description: Learn about Windows Firewall rules and design recommendations.
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
ms.topic: concept-article
|
||||
---
|
||||
|
||||
@ -21,7 +21,7 @@ In many cases, allowing specific types of inbound traffic is required for applic
|
||||
|
||||
Because of 1 and 2, when designing a set of policies, you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow.
|
||||
|
||||
Outbound rules follow the same precedence behaviors.
|
||||
Outbound rules follow the same precedence behaviors.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described.
|
||||
@ -33,12 +33,12 @@ When first installed, network applications and services issue a *listen call* sp
|
||||
:::row:::
|
||||
:::column span="2":::
|
||||
If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network:
|
||||
|
||||
|
||||
- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic
|
||||
- If the user isn't a local admin and they are prompted, block rules are created. It doesn't matter what option is selected
|
||||
|
||||
To disable the notification prompt, you can use the [command line](/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line) or the **Windows Firewall with Advanced Security** console
|
||||
|
||||
|
||||
:::column-end:::
|
||||
:::column span="2":::
|
||||
:::image type="content" source="images/uac.png" alt-text="Screenshot showing the User Account Control (UAC) prompt to allow Microsoft Teams." border="false":::
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Firewall tools
|
||||
title: Windows Firewall Tools
|
||||
description: Learn about the available tools to configure Windows Firewall and firewall rules.
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
ms.topic: best-practice
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Troubleshooting UWP App Connectivity Issues in Windows Firewall
|
||||
description: Troubleshooting UWP App Connectivity Issues in Windows Firewall
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Troubleshooting UWP App Connectivity Issues
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user