From 1c9551965454538de1328d4adc2bcbc4a42659f5 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Fri, 31 Aug 2018 16:42:56 -0700 Subject: [PATCH 01/48] Made Maricia's requested changes --- ...ew-in-windows-mdm-enrollment-management.md | 25 +++++++++++++++++-- .../policy-configuration-service-provider.md | 4 +-- .../mdm/policy-csp-deviceguard.md | 4 +-- 3 files changed, 27 insertions(+), 6 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index d02371d2dc..4d798487fd 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1405,7 +1405,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • Defender/EnableLowCPUPriority
  • Defender/SignatureUpdateFallbackOrder
  • Defender/SignatureUpdateFileSharesSources
    • -
  • DeviceGuard/EnableSystemGuard
    • +
  • DeviceGuard/ConfigureSystemGuardLaunch
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • @@ -1758,6 +1758,27 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Change history in MDM documentation +## September 2018 + + ++++ + + + + + + + + + + + +
    New or updated topicDescription
    [Policy CSP - DeviceGuard](policy-csp-deviceguard.md)

    Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.

    +
    + ### August 2018 @@ -1904,7 +1925,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • Defender/EnableLowCPUPriority
  • Defender/SignatureUpdateFallbackOrder
  • Defender/SignatureUpdateFileSharesSources
    • -
  • DeviceGuard/EnableSystemGuard
    • +
  • DeviceGuard/ConfigureSystemGuardLaunch
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index f636ec9c6d..6f425c85b1 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -987,7 +987,7 @@ The following diagram shows the Policy configuration service provider in tree fo
    - DeviceGuard/EnableSystemGuard + DeviceGuard/ConfigureSystemGuardLaunch
    DeviceGuard/EnableVirtualizationBasedSecurity @@ -4324,7 +4324,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) - [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceGuard/EnableSystemGuard](./policy-csp-deviceguard.md#deviceguard-enablesystemguard) +- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) - [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) - [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) - [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index cacbb2acc6..93ab8f76b4 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -22,7 +22,7 @@ ms.date: 07/30/2018
    - DeviceGuard/EnableSystemGuard + DeviceGuard/ConfigureSystemGuardLaunch
    DeviceGuard/EnableVirtualizationBasedSecurity @@ -39,7 +39,7 @@ ms.date: 07/30/2018
    -**DeviceGuard/EnableSystemGuard** +**DeviceGuard/ConfigureSystemGuardLaunch**
    From f552239a3f2726542b2203c79a6b709722e6111d Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Wed, 12 Sep 2018 16:51:42 -0700 Subject: [PATCH 02/48] Started adding tables by request --- .../mdm/assignedaccess-csp.md | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 961f686782..af50f8bd8d 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -102,9 +102,27 @@ Note that status codes available in the Status payload correspond to a specific | 2 | KioskModeAppNotFound | | 3 | KioskModeAppActivationFailure | - Additionally, the status payload includes a profileId, which can be used by the MDM server to correlate which kiosk app caused the error. +In Windows 10, version 1810, Assigned Access runtime status supports monitoring single-app kiosk and multi-app modes. Here are the possible status codes. + +|Status|Description| +|---|---| +|Running|The AssignedAccess account (kiosk or multi-app) is running normally.| +|AppNotFound|The kiosk app isn't deployed to the machine.| +|ActivationFailed|The AssignedAccess account (kiosk or multi-app) failed to sign in.| +|AppNoResponse|The kiosk app launched successfully but is now unresponsive.| + +Note that status codes available in the Status payload correspond to a specific AssignedAccessRuntimeStatus. + +|Status code|AssignedAccessRuntimeStatus| +|---|---| +|1|Running| +|2|AppNotFound| +|3|ActivationFailed| +|4|AppNoResponse| + + Supported operation is Get. **./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** From 5fa25efaa2edf2d59e87a6acfa7a8904c36b02f7 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 13 Sep 2018 10:02:09 -0700 Subject: [PATCH 03/48] Updated change history table --- ...ew-in-windows-mdm-enrollment-management.md | 30 +++---------------- 1 file changed, 4 insertions(+), 26 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index b3972d76d7..3fe0514881 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1760,34 +1760,12 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Change history in MDM documentation -<<<<<<< HEAD -## September 2018 - -
    ---- - - - - - - - - - - - -
    New or updated topicDescription
    [Policy CSP - DeviceGuard](policy-csp-deviceguard.md)

    Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.

    -
    -======= ### September 2018 -New or updated topic | Description ---- | --- -[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT). ->>>>>>> master +|New or updated topic | Description| +|--- | ---| +|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| +|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| ### August 2018 From 01b7c0688f968e751f61d928da8f1bb9b113b7d9 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 13 Sep 2018 11:06:19 -0700 Subject: [PATCH 04/48] Added status payload fields --- windows/client-management/mdm/assignedaccess-csp.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index af50f8bd8d..edcd969a42 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -95,7 +95,6 @@ In Windows 10, version 1803, Assigned Access runtime status only supports monito Note that status codes available in the Status payload correspond to a specific KioskModeAppRuntimeStatus. - |Status code | KioskModeAppRuntimeStatus | |---------|---------| | 1 | KioskModeAppRunning | @@ -122,6 +121,10 @@ Note that status codes available in the Status payload correspond to a specific |3|ActivationFailed| |4|AppNoResponse| +Additionally, the Status payload includes the following fields: + +- profileId: can be used by the MDM server to correlate which account caused the error. +- OperationList: list of failed operations that occurred while applying the assigned access CSP, if any exist. Supported operation is Get. From 66c40d4a91f2447c23760701532ab89b444c6a48 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Thu, 13 Sep 2018 13:47:28 -0700 Subject: [PATCH 05/48] Updated DDF file to latest for name change --- .../client-management/mdm/policy-ddf-file.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index d1f0306ec9..1c14be4723 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -25635,7 +25635,7 @@ Related policy: - EnableSystemGuard + ConfigureSystemGuardLaunch @@ -27217,7 +27217,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user. + You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user. Related policy: PreventUsersFromTurningOnBrowserSyncing 0 (default) = allow syncing, 2 = disable syncing @@ -33474,7 +33474,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an AAD UPN into an Active Directory Principal. - + This parameter adds a list of domains that an Azure Active Directory joined device should attempt to contact if it is otherwise unable to resolve a UPN to a principal. @@ -33862,7 +33862,7 @@ If you disable or do not configure this policy (recommended), users will be able Notes If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. -Disabling the Administrator account can become a maintenance issue under certain circumstances. +Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. @@ -34352,7 +34352,7 @@ The options are: No Action Lock Workstation Force Logoff - Disconnect if a Remote Desktop Services session + Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. @@ -35374,7 +35374,7 @@ This policy setting controls the behavior of all User Account Control (UAC) poli The options are: -• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. +• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. • Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. @@ -44745,7 +44745,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the - Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. + Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. @@ -47064,11 +47064,11 @@ Because of these factors, users do not usually need this user right. Warning: If - - - - - + + + + + ]]> @@ -55084,7 +55084,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor 0 - You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user. + You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user. Related policy: PreventUsersFromTurningOnBrowserSyncing 0 (default) = allow syncing, 2 = disable syncing @@ -62093,7 +62093,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an AAD UPN into an Active Directory Principal. - + This parameter adds a list of domains that an Azure Active Directory joined device should attempt to contact if it is otherwise unable to resolve a UPN to a principal. @@ -62491,7 +62491,7 @@ If you disable or do not configure this policy (recommended), users will be able Notes If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. -Disabling the Administrator account can become a maintenance issue under certain circumstances. +Disabling the Administrator account can become a maintenance issue under certain circumstances. Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. @@ -63024,7 +63024,7 @@ The options are: No Action Lock Workstation Force Logoff - Disconnect if a Remote Desktop Services session + Disconnect if a Remote Desktop Services session If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. @@ -64127,7 +64127,7 @@ This policy setting controls the behavior of all User Account Control (UAC) poli The options are: -• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. +• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. • Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. @@ -74444,7 +74444,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the - Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. + Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. From f79899ac22887aded489c9c52ab21f97c0cd6c30 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 13 Sep 2018 13:51:27 -0700 Subject: [PATCH 06/48] update auto-resolve content --- ...features-windows-defender-advanced-threat-protection.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md index 28bcbdb441..ed70982064 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md @@ -22,19 +22,20 @@ ms.date: 09/06/2018 Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Windows Defender ATP with. -Turn on the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations: +Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations: ## Automated investigation When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md). ## Auto-resolve remediated alerts -You can configure the automated investigations capability to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". +For tenants created or or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you dont want to have alerts auto-resolved, youll need to manually turn off the feature. + +For tenants created prior that version, you'll need to manually turn this feature on. >[!NOTE] > - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. >- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overrite it. -If you don't want to have alerts auto-resolved, you'll need to manually turn off the feature. ## Block file This feature is only available if your organization uses Windows Defender Antivirus as the active antimalware solution and that the cloud-based protection feature is enabled. From 77187731b6f0a818971b4fe2961f9728dda5a797 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Mon, 17 Sep 2018 16:16:56 -0700 Subject: [PATCH 07/48] Editorial change --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index edcd969a42..b37c7a9b0f 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -101,7 +101,7 @@ Note that status codes available in the Status payload correspond to a specific | 2 | KioskModeAppNotFound | | 3 | KioskModeAppActivationFailure | -Additionally, the status payload includes a profileId, which can be used by the MDM server to correlate which kiosk app caused the error. +Additionally, the status payload includes a profileId that can be used by the MDM server to correlate which kiosk app caused the error. In Windows 10, version 1810, Assigned Access runtime status supports monitoring single-app kiosk and multi-app modes. Here are the possible status codes. From 3f03b55746578485eb8ebc0c6195307e2951e74a Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 18 Sep 2018 10:05:44 -0700 Subject: [PATCH 08/48] Updated XSD --- .../mdm/assignedaccess-csp.md | 31 ++++++++++++++----- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index b37c7a9b0f..53bcb99406 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1137,10 +1137,11 @@ ShellLauncherConfiguration Get - - - - + + + + + @@ -1150,19 +1151,35 @@ ShellLauncherConfiguration Get + + + + + + + + + + + + + + + + - + - + - + From 04e916d697afda27bcc91d326feecad0961c9db1 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 18 Sep 2018 13:05:13 -0700 Subject: [PATCH 09/48] edit' --- .../kernel-dma-protection-for-thunderbolt.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index fc494015d5..5d4517f58c 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: aadake -ms.date: 09/06/2018 +ms.date: 09/18/2018 --- # Kernel DMA Protection for Thunderbolt™ 3 @@ -14,6 +14,12 @@ ms.date: 09/06/2018 **Applies to** - Windows 10 +Beginning in 2013, Intel added incremental capabilities to Thunderbolt technology to reduce DMA exposure. +When the host is properly configured with these capabilities, an end user would have to first approve the Thunderbolt peripheral when initially attached to the port, approved as either **Connect Only Once** or **Connect Always**. + +Although this methodology mitigates most physical DMA attacks from un-authorized Thunderbolt devices, if a Thunderbolt device with a PCIe slot is approved as **Connect Always**, a physical “DMA attack” might still be possible given the correct hardware and physical access to a previously approved Thunderbolt device with PCIe expandability (such as PCIe slot or ExpressCard). +Although the **Connect Only Once** option does provide additional mitigation from such attacks, it places an unwelcome burden on the end user who would be required to approve the device every time it’s connected. + In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely. From 076248eecf52dfcf25900bab4aeeeafaeb896457 Mon Sep 17 00:00:00 2001 From: Heidi Lohr Date: Tue, 18 Sep 2018 13:15:38 -0700 Subject: [PATCH 10/48] Updated metadata date --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 53bcb99406..3ea9a42360 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/25/2018 +ms.date: 09/18/2018 --- # AssignedAccess CSP From f840034b2eca6e8a2c99c25aaef18f15715164fb Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 18 Sep 2018 14:55:52 -0700 Subject: [PATCH 11/48] update to machine risk description --- ...te-machines-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md index c88e3f9b5e..607b3d55e1 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 09/03/2018 +ms.date: 09/18/2018 --- # Investigate machines in the Windows Defender ATP Machines list @@ -60,7 +60,7 @@ You'll also see details such as logon types for each user account, the user grou For more information, see [Investigate user entities](investigate-user-windows-defender-advanced-threat-protection.md). **Machine risk**
    -The Machine risk tile shows the overall risk assessment of a machine. A machine's risk level is determined using the number of active alerts and their severity levels. You can influence a machine's risk level by resolving associated alerts manually or automatically and also by suppressing an alert. It's also indicators of the active threats that machines could be exposed to. +The Machine risk tile shows the overall risk assessment of a machine. A machine's risk level can be determined using the number of active alerts or by a combination of multiple risks that may increase the risk assessment and their severity levels. You can influence a machine's risk level by resolving associated alerts manually or automatically and also by suppressing an alert. It's also indicators of the active threats that machines could be exposed to. **Azure Advanced Threat Protection**
    If you have enabled the Azure ATP feature and there are alerts related to the machine, you can click on the link that will take you to the Azure ATP page where more information about the alerts are provided. From 8a5784de0b746256f21e8fffbdacca5f3e942aba Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 18 Sep 2018 15:22:24 -0700 Subject: [PATCH 12/48] update auto-resolve --- ...ed-features-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md index ed70982064..8e09877e2c 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md @@ -28,9 +28,9 @@ Use the following advanced features to get better protected from potentially mal When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md). ## Auto-resolve remediated alerts -For tenants created or or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you dont want to have alerts auto-resolved, youll need to manually turn off the feature. +For tenants created on or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you dont want to have alerts auto-resolved, youll need to manually turn off the feature. -For tenants created prior that version, you'll need to manually turn this feature on. +> [!TIP] For tenants created prior that version, you'll need to manually turn this feature on. >[!NOTE] > - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. From 061ec914d35063a499fc738eefe34ae3f86d1cf3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 18 Sep 2018 22:46:30 +0000 Subject: [PATCH 13/48] Updated advanced-features-windows-defender-advanced-threat-protection.md --- ...d-features-windows-defender-advanced-threat-protection.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md index 8e09877e2c..06bf84becb 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md @@ -28,9 +28,10 @@ Use the following advanced features to get better protected from potentially mal When you enable this feature, you'll be able to take advantage of the automated investigation and remediation features of the service. For more information, see [Automated investigations](automated-investigations-windows-defender-advanced-threat-protection.md). ## Auto-resolve remediated alerts -For tenants created on or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you dont want to have alerts auto-resolved, youll need to manually turn off the feature. +For tenants created on or after Windows 10, version 1809 the automated investigations capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don’t want to have alerts auto-resolved, you’ll need to manually turn off the feature. -> [!TIP] For tenants created prior that version, you'll need to manually turn this feature on. +>[!TIP] +>For tenants created prior that version, you'll need to manually turn this feature on. >[!NOTE] > - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. From e6ace9f86f6aaa31d5a11ce8439fcb8ef69339af Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 19 Sep 2018 15:01:58 +0000 Subject: [PATCH 14/48] Merged PR 11411: add link (SH) and add element order to Start t'shoot --- devices/surface-hub/index.md | 1 + .../windows-10-start-layout-options-and-policies.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index 8ff6d0d31f..f91b3e81bf 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -54,6 +54,7 @@ In some ways, adding your new Surface Hub is just like adding any other Microsof ## Additional resources - [Surface Hub update history](https://support.microsoft.com/help/4037666/surface-surface-hub-update-history) +- [Surface Hub help](https://support.microsoft.com/hub/4343507/surface-hub-help) - [Surface IT Pro Blog](https://blogs.technet.microsoft.com/surface/) - [Surface Playlist of videos](https://www.youtube.com/playlist?list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ) - [Microsoft Surface on Twitter](https://twitter.com/surface) diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index d51cb7fd9d..00f8037780 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -116,7 +116,7 @@ The new taskbar layout for upgrades to Windows 10, version 1607 or later, will a If your Start layout customization is not applied as expected, open **Event Viewer** and navigate to **Applications and Services Log** > **Microsoft** > **Windows** > **ShellCommon-StartLayoutPopulation** > **Operational**, and check for one of the following events: - **Event 22** is logged when the xml is malformed, meaning the specified file simply isn’t valid xml. This can occur if the file has extra spaces or unexpected characters, or if the file is not saved in the UTF8 format. -- **Event 64** is logged when the xml is valid, but has unexpected values. This can happen when the desired configuration is not understood or source is not found such as a missing or misspelled .lnk. +- **Event 64** is logged when the xml is valid, but has unexpected values. This can happen when the desired configuration is not understood, elements are not in [the required order](start-layout-xml-desktop.md#required-order), or source is not found, such as a missing or misspelled .lnk. From 0af8eccb266c6b12eb7ab82e01a1a126f06d2737 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 19 Sep 2018 10:15:01 -0700 Subject: [PATCH 15/48] added slider table --- .../how-user-account-control-works.md | 100 +++++++++++++----- 1 file changed, 71 insertions(+), 29 deletions(-) diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 6d29481a6a..4625ced951 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -7,7 +7,7 @@ ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security author: brianlic-msft -ms.date: 04/19/2017 +ms.date: 09/19/2018 --- # How User Account Control works @@ -156,37 +156,79 @@ To better understand each component, review the table below:

    Check UAC slider level

    -

    UAC has four levels of notification to choose from and a slider to use to select the notification level:

    - -

    Recommended if you often install new software or visit unfamiliar websites.

    +

    Recommended if you often install new software or visit unfamiliar websites.


  • Notify me only when programs try to make changes to my computer will:

      @@ -172,7 +172,7 @@ To better understand each component, review the table below:
    • Not notify you when you make changes to Windows settings.
    • Freeze other tasks until you respond.
    -

    Recommended if you do not often install apps or visit unfamiliar websites.

    +

    Recommended if you do not often install apps or visit unfamiliar websites.


  • Notify me only when programs try to make changes to my computer (do not dim my desktop) will:

      @@ -180,7 +180,7 @@ To better understand each component, review the table below:
    • Not notify you when you make changes to Windows settings.
    • Not freeze other tasks until you respond.
    -

    Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.

    +

    Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.


  • Never notify (Disable UAC) will: