freshness review

This commit is contained in:
Paolo Matarazzo 2025-04-07 11:30:24 -04:00
parent 2abc643850
commit 9f80374b38
25 changed files with 79 additions and 84 deletions

View File

@ -1,7 +1,7 @@
--- ---
title: Configure Take a Test in kiosk mode title: Configure Take a Test in Kiosk Mode
description: Learn how to configure Windows to execute the Take a Test app in kiosk mode, using Intune and provisioning packages. description: Learn how to configure Windows to execute the Take a Test app in kiosk mode using different methods.
ms.date: 09/06/2024 ms.date: 04/07/2025
ms.topic: how-to ms.topic: how-to
--- ---
@ -11,10 +11,11 @@ Executing Take a Test in kiosk mode is the recommended option for high stakes as
The configuration of Take a Test in kiosk mode can be done using: The configuration of Take a Test in kiosk mode can be done using:
- Microsoft Intune/MDM - Microsoft Intune
- a provisioning package (PPKG) - Configuration service provider (CSP)
- A provisioning package (PPKG)
- PowerShell - PowerShell
- the Settings app - The Settings app
When using the Settings app, you can configure Take a Test in kiosk mode using a local account only. This option is recommended for devices that aren't managed. When using the Settings app, you can configure Take a Test in kiosk mode using a local account only. This option is recommended for devices that aren't managed.
The other options allow you to configure Take a Test in kiosk mode using a local account, an account defined in the directory, or a guest account. The other options allow you to configure Take a Test in kiosk mode using a local account, an account defined in the directory, or a guest account.
@ -28,18 +29,6 @@ Follow the instructions below to configure your devices, selecting the option th
# [:::image type="icon" source="images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) # [:::image type="icon" source="images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
You can use Intune for Education or a custom profile in Microsoft Intune:
- Intune for Education provides a simpler experience
- A custom profile provides more flexibility and controls over the configuration
> [!IMPORTANT]
> Currently, the policy created in Intune for Education is applicable to Windows 10 and Windows 11 only. **It will not apply to Windows 11 SE devices.**
>
> If you want to configure Take a Test for Windows 11 SE devices, you must use a custom policy.
### Configure Take a Test from Intune for Education
To configure devices using Intune for Education, follow these steps: To configure devices using Intune for Education, follow these steps:
1. Sign in to the <a href="https://intuneeducation.portal.azure.com/" target="_blank"><b>Intune for Education portal</b></a> 1. Sign in to the <a href="https://intuneeducation.portal.azure.com/" target="_blank"><b>Intune for Education portal</b></a>
@ -51,9 +40,9 @@ To configure devices using Intune for Education, follow these steps:
:::image type="content" source="./images/takeatest/intune-education-take-a-test-profile.png" alt-text="Intune for Education - creation of a Take a Test profile." lightbox="./images/takeatest/intune-education-take-a-test-profile.png" border="true"::: :::image type="content" source="./images/takeatest/intune-education-take-a-test-profile.png" alt-text="Intune for Education - creation of a Take a Test profile." lightbox="./images/takeatest/intune-education-take-a-test-profile.png" border="true":::
### Configure Take a Test with a custom policy # [:::image type="icon" source="images/icons/csp.svg"::: **CSP**](#tab/csp)
[!INCLUDE [intune-custom-settings-1](../../includes/configure/intune-custom-settings-1.md)] To configure devices using configuration service providers, use the following settings:
| Setting | | Setting |
|--------| |--------|
@ -65,10 +54,6 @@ To configure devices using Intune for Education, follow these steps:
| <li> OMA-URI: **`./Vendor/MSFT/SharedPC/KioskModeUserTileDisplayText`** </li><li>Data type: **String** </li><li> Value: **Take a Test** (or a string of your choice to display in the sing-in screen)</li>| | <li> OMA-URI: **`./Vendor/MSFT/SharedPC/KioskModeUserTileDisplayText`** </li><li>Data type: **String** </li><li> Value: **Take a Test** (or a string of your choice to display in the sing-in screen)</li>|
| <li> OMA-URI: **`./Vendor/MSFT/SecureAssessment/LaunchURI`** </li><li>Data type: **String** </li><li> Value: **\<provide testing URL>**</li>| | <li> OMA-URI: **`./Vendor/MSFT/SecureAssessment/LaunchURI`** </li><li>Data type: **String** </li><li> Value: **\<provide testing URL>**</li>|
:::image type="content" source="./images/takeatest/intune-take-a-test-custom-profile.png" alt-text="Intune portal - creation of a custom policy to configure Take a Test." lightbox="./images/takeatest/intune-take-a-test-custom-profile.png" border="true":::
[!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)]
# [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) # [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
To create a provisioning package, you can either use Set up School PCs or Windows Configuration Designer: To create a provisioning package, you can either use Set up School PCs or Windows Configuration Designer:

View File

@ -0,0 +1,10 @@
<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
<g clip-path="url(#clip0_461_479)">
<path d="M9.01098 0.225006C9.67158 0.23262 10.3296 0.30894 10.9743 0.452742C11.2558 0.515517 11.4663 0.750165 11.4982 1.03677L11.6514 2.41094C11.7208 3.04188 12.2535 3.51976 12.8885 3.52043C13.0593 3.5207 13.2281 3.48515 13.3859 3.41535L14.6464 2.86161C14.9086 2.74644 15.215 2.80923 15.4106 3.01826C16.3216 3.99118 17 5.15804 17.3949 6.43103C17.4801 6.70553 17.3821 7.00383 17.1508 7.17436L16.0334 7.99795C15.7146 8.23213 15.5264 8.60401 15.5264 8.99956C15.5264 9.39502 15.7146 9.7669 16.0341 10.0016L17.1524 10.8255C17.3838 10.9959 17.4819 11.2943 17.3967 11.5689C17.002 12.8417 16.3239 14.0084 15.4135 14.9815C15.218 15.1905 14.9119 15.2535 14.6498 15.1385L13.3841 14.5841C13.0219 14.4256 12.6061 14.4488 12.2639 14.6466C11.9217 14.8443 11.694 15.1931 11.6505 15.5859L11.4983 16.96C11.4669 17.2433 11.261 17.4764 10.9836 17.5424C9.68004 17.8525 8.32185 17.8525 7.01823 17.5424C6.74092 17.4764 6.53495 17.2433 6.50356 16.96L6.35162 15.588C6.30699 15.1959 6.07891 14.8482 5.73698 14.6511C5.39506 14.454 4.97988 14.4309 4.61898 14.5885L3.35301 15.143C3.0908 15.258 2.78463 15.195 2.5891 14.9858C1.67816 14.0117 1.00007 12.8435 0.605881 11.5693C0.520975 11.2949 0.619075 10.9967 0.850366 10.8264L1.96936 10.002C2.28809 9.7678 2.47632 9.39592 2.47632 9.00046C2.47632 8.60491 2.28809 8.23303 1.96894 7.99858L0.850645 7.17557C0.619021 7.00511 0.520831 6.70661 0.606034 6.43193C1.00091 5.15894 1.67935 3.99208 2.59032 3.01916C2.78603 2.81013 3.09235 2.74734 3.35452 2.86251L4.61486 3.41615C4.97751 3.57531 5.39442 3.55127 5.73819 3.35043C6.08048 3.15189 6.30836 2.8028 6.35235 2.40988L6.50542 1.03677C6.53739 0.750021 6.74807 0.515292 7.02972 0.452652C7.67529 0.309084 8.334 0.232791 9.01098 0.225006ZM8.99973 6.29996C7.50852 6.29996 6.29973 7.5088 6.29973 9.00001C6.29973 10.4911 7.50852 11.7 8.99973 11.7C10.4909 11.7 11.6997 10.4911 11.6997 9.00001C11.6997 7.5088 10.4909 6.29996 8.99973 6.29996Z" fill="#0883D9"/>
</g>
<defs>
<clipPath id="clip0_461_479">
<rect width="18" height="18" fill="white"/>
</clipPath>
</defs>
</svg>

After

Width:  |  Height:  |  Size: 2.1 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 221 KiB

View File

@ -1,7 +1,7 @@
--- ---
title: Take a Test app technical reference title: Take a Test App Technical Reference
description: List of policies and settings applied by the Take a Test app. description: List of policies and settings applied by the Take a Test app.
ms.date: 09/06/2024 ms.date: 04/07/2025
ms.topic: reference ms.topic: reference
--- ---

View File

@ -1,6 +1,6 @@
--- ---
ms.date: 09/06/2024 ms.date: 04/07/2025
title: Access Control overview title: Access Control Overview
description: Learn about access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. description: Learn about access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer.
ms.topic: overview ms.topic: overview
appliesto: appliesto:

View File

@ -1,5 +1,5 @@
--- ---
ms.date: 09/06/2024 ms.date: 04/07/2025
title: Local Accounts title: Local Accounts
description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. description: Learn how to secure and manage access to the resources on a standalone or member server for services or users.
ms.topic: concept-article ms.topic: concept-article
@ -225,33 +225,33 @@ The following table shows the Group Policy and registry settings that are used t
#### To enforce local account restrictions for remote access #### To enforce local account restrictions for remote access
1. Start the **Group Policy Management** Console (GPMC) 1. Start the **Group Policy Management** Console (GPMC)
1. In the console tree, expand &lt;*Forest*&gt;\\Domains\\&lt;*Domain*&gt;, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO) 1. In the console tree, expand <*Forest*>\Domains\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
1. In the console tree, right-click **Group Policy Objects > New** 1. In the console tree, right-click **Group Policy Objects > New**
1. In the **New GPO** dialog box, type &lt;**gpo\_name**&gt;, and &gt; **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer 1. In the **New GPO** dialog box, type <**gpo_name**>, and > **OK** where *gpo_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer
1. In the details pane, right-click &lt;**gpo\_name**&gt;, and &gt; **Edit** 1. In the details pane, right-click <**gpo_name**>, and > **Edit**
1. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: 1. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps:
- Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and &gt; **Security Options** - Navigate to the **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**
- Double-click **User Account Control: Run all administrators in Admin Approval Mode** &gt; **Enabled** &gt; **OK** - Select **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**
- Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** &gt; **Enabled** &gt; **OK** - Select **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**
1. Ensure that the local account restrictions are applied to network interfaces by following these steps: 1. Ensure that the local account restrictions are applied to network interfaces by following these steps:
- Navigate to *Computer Configuration\Preferences and Windows Settings*, and > **Registry** - Navigate to *Computer Configuration\Preferences and Windows Settings*, and > **Registry**
- Right-click **Registry**, and &gt; **New** &gt; **Registry Item** - Right-click **Registry**, and > **New** > **Registry Item**
- In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace** - In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**
- Ensure that the **Hive** box is set to **HKEY_LOCAL_MACHINE** - Ensure that the **Hive** box is set to **HKEY_LOCAL_MACHINE**
- Select (**…**), browse to the following location for **Key Path** &gt; **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System` - Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`
- In the **Value name** area, type `LocalAccountTokenFilterPolicy` - In the **Value name** area, type `LocalAccountTokenFilterPolicy`
- In the **Value type** box, from the drop-down list, select **REG_DWORD** to change the value - In the **Value type** box, from the drop-down list, select **REG_DWORD** to change the value
- In the **Value data** box, ensure that the value is set to **0** - In the **Value data** box, ensure that the value is set to **0**
- Verify this configuration, and &gt; **OK** - Verify this configuration, and > **OK**
1. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: 1. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following:
- Navigate to the `*Forest*\<Domains>\*Domain*\*OU*` path - Navigate to the `*Forest*\<Domains>\*Domain*\*OU*` path
- Right-click the **Workstations > Link an existing GPO** - Right-click the **Workstations > Link an existing GPO**
- Select the GPO that you created, and &gt; **OK** - Select the GPO that you created, and > **OK**
1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy 1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy
1. Create links to all other OUs that contain workstations 1. Create links to all other OUs that contain workstations
@ -278,23 +278,23 @@ The following table shows the Group Policy settings that are used to deny networ
#### To deny network logon to all local administrator accounts #### To deny network logon to all local administrator accounts
1. Start the **Group Policy Management** Console (GPMC) 1. Start the **Group Policy Management** Console (GPMC)
1. In the console tree, expand &lt;*Forest*&gt;\\Domains\\&lt;*Domain*&gt;, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO) 1. In the console tree, expand <*Forest*>\Domains\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
1. In the console tree, right-click **Group Policy Objects**, and &gt; **New** 1. In the console tree, right-click **Group Policy Objects**, and > **New**
1. In the **New GPO** dialog box, type &lt;**gpo\_name**&gt;, and then &gt; **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer 1. In the **New GPO** dialog box, type <**gpo_name**>, and then > **OK** where *gpo_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer
1. In the details pane, right-click &lt;**gpo\_name**&gt;, and &gt; **Edit** 1. In the details pane, right-click <**gpo_name**>, and > **Edit**
1. Configure the user rights to deny network logons for administrative local accounts as follows: 1. Configure the user rights to deny network logons for administrative local accounts as follows:
1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and &gt; **User Rights Assignment** 1. Navigate to the Computer Configuration\Windows Settings\Security Settings\, and > **User Rights Assignment**
1. Double-click **Deny access to this computer from the network** 1. Double-click **Deny access to this computer from the network**
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and &gt; **OK** 1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
1. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows: 1. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows:
1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment** 1. Navigate to Computer Configuration\Policies\Windows Settings and Local Policies, and then select **User Rights Assignment**
1. Double-click **Deny log on through Remote Desktop Services** 1. Double-click **Deny log on through Remote Desktop Services**
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and &gt; **OK** 1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
1. Link the GPO to the first **Workstations** OU as follows: 1. Link the GPO to the first **Workstations** OU as follows:
- Navigate to the &lt;*Forest*&gt;\\Domains\\&lt;*Domain*&gt;\\OU path - Navigate to the <*Forest*>\Domains\<*Domain*>\OU path
- Right-click the **Workstations** OU, and &gt; **Link an existing GPO** - Right-click the **Workstations** OU, and > **Link an existing GPO**
- Select the GPO that you created, and &gt; **OK** - Select the GPO that you created, and > **OK**
1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy 1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy
1. Create links to all other OUs that contain workstations 1. Create links to all other OUs that contain workstations

View File

@ -1,10 +1,10 @@
--- ---
title: Support for passkeys in Windows title: Support for Passkeys in Windows
description: Learn about passkeys and how to use them on Windows devices. description: Learn about passkeys and how to use them on Windows devices.
ms.collection: ms.collection:
- tier1 - tier1
ms.topic: overview ms.topic: overview
ms.date: 09/06/2024 ms.date: 04/07/2025
appliesto: appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a> - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a> - ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>

View File

@ -2,7 +2,7 @@
title: Deploy Virtual Smart Cards title: Deploy Virtual Smart Cards
description: Learn about what to consider when deploying a virtual smart card authentication solution description: Learn about what to consider when deploying a virtual smart card authentication solution
ms.topic: concept-article ms.topic: concept-article
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Deploy Virtual Smart Cards # Deploy Virtual Smart Cards

View File

@ -2,7 +2,7 @@
title: Evaluate Virtual Smart Card Security title: Evaluate Virtual Smart Card Security
description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards. description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards.
ms.topic: concept-article ms.topic: concept-article
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Evaluate Virtual Smart Card Security # Evaluate Virtual Smart Card Security

View File

@ -2,7 +2,7 @@
title: Get Started with Virtual Smart Cards - Walkthrough Guide title: Get Started with Virtual Smart Cards - Walkthrough Guide
description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards. description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards.
ms.topic: get-started ms.topic: get-started
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Get Started with Virtual Smart Cards: Walkthrough Guide # Get Started with Virtual Smart Cards: Walkthrough Guide

View File

@ -2,7 +2,7 @@
title: Virtual Smart Card Overview title: Virtual Smart Card Overview
description: Learn about virtual smart card technology for Windows. description: Learn about virtual smart card technology for Windows.
ms.topic: overview ms.topic: overview
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Virtual Smart Card Overview # Virtual Smart Card Overview

View File

@ -2,7 +2,7 @@
title: Tpmvscmgr title: Tpmvscmgr
description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer. description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer.
ms.topic: reference ms.topic: reference
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Tpmvscmgr # Tpmvscmgr

View File

@ -2,7 +2,7 @@
title: Understanding and Evaluating Virtual Smart Cards title: Understanding and Evaluating Virtual Smart Cards
description: Learn how smart card technology can fit into your authentication design. description: Learn how smart card technology can fit into your authentication design.
ms.topic: overview ms.topic: overview
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Understand and Evaluate Virtual Smart Cards # Understand and Evaluate Virtual Smart Cards

View File

@ -2,7 +2,7 @@
title: Use Virtual Smart Cards title: Use Virtual Smart Cards
description: Learn about the requirements for virtual smart cards, how to use and manage them. description: Learn about the requirements for virtual smart cards, how to use and manage them.
ms.topic: concept-article ms.topic: concept-article
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Use Virtual Smart Cards # Use Virtual Smart Cards

View File

@ -2,7 +2,7 @@
title: Configure Windows Firewall logging title: Configure Windows Firewall logging
description: Learn how to configure Windows Firewall to log dropped packets or successful connections with CSP and group policy. description: Learn how to configure Windows Firewall to log dropped packets or successful connections with CSP and group policy.
ms.topic: how-to ms.topic: how-to
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Configure Windows Firewall logging # Configure Windows Firewall logging

View File

@ -1,8 +1,8 @@
--- ---
title: Manage Windows Firewall with the command line title: Manage Windows Firewall With the Command Line
description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh.
ms.topic: how-to ms.topic: how-to
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Manage Windows Firewall with the command line # Manage Windows Firewall with the command line
@ -53,7 +53,7 @@ netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFile
### Disable Windows Firewall ### Disable Windows Firewall
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose. Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including: If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including:
- Start menu can stop working - Start menu can stop working

View File

@ -1,8 +1,8 @@
--- ---
title: Configure firewall rules with group policy title: Configure Firewall Rules With Group Policy
description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console.
ms.topic: how-to ms.topic: how-to
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Configure rules with group policy # Configure rules with group policy

View File

@ -1,8 +1,8 @@
--- ---
title: Windows Firewall dynamic keywords title: Windows Firewall Dynamic Keywords
description: Learn about Windows Firewall dynamic keywords and how to configure it using Windows PowerShell. description: Learn about Windows Firewall dynamic keywords and how to configure it using Windows PowerShell.
ms.topic: how-to ms.topic: how-to
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Windows Firewall dynamic keywords # Windows Firewall dynamic keywords

View File

@ -1,8 +1,8 @@
--- ---
title: Filter origin audit log title: Filter Origin Audit Log
description: Learn about Windows Firewall and filter origin audit log to troubleshoot packet drops. description: Learn about Windows Firewall and filter origin audit log to troubleshoot packet drops.
ms.topic: troubleshooting ms.topic: troubleshooting
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Filter origin audit log # Filter origin audit log

View File

@ -1,8 +1,8 @@
--- ---
title: Hyper-V firewall title: Hyper-V Firewall
description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP). description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP).
ms.topic: how-to ms.topic: how-to
ms.date: 09/06/2024 ms.date: 04/07/2025
appliesto: appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a> - ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
--- ---

View File

@ -1,8 +1,8 @@
--- ---
title: Windows Firewall overview title: Windows Firewall Overview
description: Learn overview information about the Windows Firewall security feature. description: Learn overview information about the Windows Firewall security feature.
ms.topic: overview ms.topic: overview
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Windows Firewall overview # Windows Firewall overview
@ -75,7 +75,7 @@ The *public network* profile is designed with higher security in mind for public
## Disable Windows Firewall ## Disable Windows Firewall
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose. Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including: If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including:
- Start menu can stop working - Start menu can stop working

View File

@ -1,8 +1,8 @@
--- ---
title: Quarantine behavior title: Quarantine Behavior
description: Learn about Windows Firewall and the quarantine feature behavior. description: Learn about Windows Firewall and the quarantine feature behavior.
ms.topic: concept-article ms.topic: concept-article
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Quarantine behavior # Quarantine behavior

View File

@ -1,7 +1,7 @@
--- ---
title: Windows Firewall rules title: Windows Firewall Rules
description: Learn about Windows Firewall rules and design recommendations. description: Learn about Windows Firewall rules and design recommendations.
ms.date: 09/06/2024 ms.date: 04/07/2025
ms.topic: concept-article ms.topic: concept-article
--- ---
@ -21,7 +21,7 @@ In many cases, allowing specific types of inbound traffic is required for applic
Because of 1 and 2, when designing a set of policies, you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow. Because of 1 and 2, when designing a set of policies, you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow.
Outbound rules follow the same precedence behaviors. Outbound rules follow the same precedence behaviors.
> [!NOTE] > [!NOTE]
> Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described. > Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described.
@ -33,12 +33,12 @@ When first installed, network applications and services issue a *listen call* sp
:::row::: :::row:::
:::column span="2"::: :::column span="2":::
If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network: If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network:
- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic - If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic
- If the user isn't a local admin and they are prompted, block rules are created. It doesn't matter what option is selected - If the user isn't a local admin and they are prompted, block rules are created. It doesn't matter what option is selected
To disable the notification prompt, you can use the [command line](/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line) or the **Windows Firewall with Advanced Security** console To disable the notification prompt, you can use the [command line](/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line) or the **Windows Firewall with Advanced Security** console
:::column-end::: :::column-end:::
:::column span="2"::: :::column span="2":::
:::image type="content" source="images/uac.png" alt-text="Screenshot showing the User Account Control (UAC) prompt to allow Microsoft Teams." border="false"::: :::image type="content" source="images/uac.png" alt-text="Screenshot showing the User Account Control (UAC) prompt to allow Microsoft Teams." border="false":::

View File

@ -1,7 +1,7 @@
--- ---
title: Windows Firewall tools title: Windows Firewall Tools
description: Learn about the available tools to configure Windows Firewall and firewall rules. description: Learn about the available tools to configure Windows Firewall and firewall rules.
ms.date: 09/06/2024 ms.date: 04/07/2025
ms.topic: best-practice ms.topic: best-practice
--- ---

View File

@ -2,7 +2,7 @@
title: Troubleshooting UWP App Connectivity Issues in Windows Firewall title: Troubleshooting UWP App Connectivity Issues in Windows Firewall
description: Troubleshooting UWP App Connectivity Issues in Windows Firewall description: Troubleshooting UWP App Connectivity Issues in Windows Firewall
ms.topic: troubleshooting ms.topic: troubleshooting
ms.date: 09/06/2024 ms.date: 04/07/2025
--- ---
# Troubleshooting UWP App Connectivity Issues # Troubleshooting UWP App Connectivity Issues