mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge pull request #678 from MicrosoftDocs/public
Public to master 7/12
This commit is contained in:
Dani Halfin
GitHub
commit
a8ad6384e4
@ -16,9 +16,6 @@ manager: dansimp
|
||||
|
||||
Welcome to the latest Insider Preview builds for HoloLens! It’s simple to get started and provide valuable feedback for our next major operating system update for HoloLens.
|
||||
|
||||
|
||||
|
||||
<span id="get-insider" />
|
||||
## How do I install the Insider builds?
|
||||
|
||||
On a device running the Windows 10 April 2018 Update, go to <strong>Settings -> Update & Security -> Windows Insider Program</strong> and select <strong>Get started</strong>. Link the account you used to register as a Windows Insider.
|
||||
|
||||
@ -51,11 +51,12 @@ The following table lists the SQL Server versions that the App-V Management data
|
||||
|
||||
|SQL Server version|Service pack|System architecture|
|
||||
|---|---|---|
|
||||
|Microsoft SQL Server 2017||32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2016|SP2|32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2014||32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2012|SP2|32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit|
|
||||
|
||||
|
||||
### Publishing server operating system requirements
|
||||
|
||||
The App-V Publishing server can be installed on a server that runs Windows Server 2008 R2 with SP1 or later.
|
||||
@ -86,6 +87,8 @@ The following table lists the SQL Server versions that are supported for the App
|
||||
|
||||
|SQL Server version|Service pack|System architecture|
|
||||
|---|---|---|
|
||||
|Microsoft SQL Server 2017||32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2016|SP2|32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2014||32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2012|SP2|32-bit or 64-bit|
|
||||
|Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit|
|
||||
|
||||
@ -42,7 +42,7 @@ The name of the folder in which you store the mandatory profile must use the cor
|
||||
| Windows 8 | Windows Server 2012 | v3 |
|
||||
| Windows 8.1 | Windows Server 2012 R2 | v4 |
|
||||
| Windows 10, versions 1507 and 1511 | N/A | v5 |
|
||||
| Windows 10, versions 1607, 1703, 1709, 1803, and 1809 | Windows Server 2016 | v6 |
|
||||
| Windows 10, versions 1607, 1703, 1709, 1803, 1809 and 1903 | Windows Server 2016 and Windows Server 2019 | v6 |
|
||||
|
||||
For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198).
|
||||
|
||||
@ -150,6 +150,8 @@ When a user is configured with a mandatory profile, Windows 10 starts as though
|
||||
| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled |  |  |  |  |
|
||||
| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled |  |  |  |  |
|
||||
|
||||
> [!Note]
|
||||
> The Group Policy settings above can be applied in Windows 10 Professional edition.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1567,10 +1567,10 @@ GP Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
@ -1587,6 +1587,10 @@ GP Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
> [!WARNING]
|
||||
> Starting in Windows 10, version 1803, this policy is deprecated.
|
||||
|
||||
Microsoft network server: Amount of idle time required before suspending a session
|
||||
|
||||
This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity.
|
||||
|
||||
@ -51,7 +51,7 @@ In **ConfigADMXInstalledPolicy**, you provide a policy setting and value for tha
|
||||
|
||||
## ConfigOperations
|
||||
|
||||
Use **ConfigOperations** to import an ADXM file or policies from an ADMX file.
|
||||
Use **ConfigOperations** to import an ADMX file or policies from an ADMX file.
|
||||
|
||||
1. Enter an app name, and then click **Add**.
|
||||
|
||||
@ -72,8 +72,8 @@ Use **ConfigOperations** to import an ADXM file or policies from an ADMX file.
|
||||
|
||||
5. Repeat for each ADMX, or set of ADMX policies, that you want to add, and then configure [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) for each one.
|
||||
|
||||
<span id="convert"/>
|
||||
|
||||
<span id="convert" />
|
||||
## Convert multi-line to single line
|
||||
|
||||
Use the following PowerShell cmdlet to remove carriage returns and line feeds from a multi-line file to create a single-line file that you can paste in **AdmxFileUid**.
|
||||
|
||||
@ -399,7 +399,55 @@ DISKPART> list disk
|
||||
In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is formatted using GPT.
|
||||
|
||||
|
||||
## Known issue
|
||||
|
||||
### MBR2GPT.exe cannot run in Windows PE
|
||||
|
||||
When you start a Windows 10, version 1903-based computer in the Windows Preinstallation Environment (Windows PE), you encounter the following issues:
|
||||
|
||||
**Issue 1** When you run the MBR2GPT.exe command, the process exits without converting the drive.
|
||||
|
||||
**Issue 2** When you manually run the MBR2GPT.exe command in a Command Prompt window, there is no output from the tool.
|
||||
|
||||
**Issue 3** When MBR2GPT.exe runs inside an imaging process such as a System Center Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781.
|
||||
|
||||
#### Cause
|
||||
|
||||
This issue occurs because in Windows 10, version 1903 and later versions, MBR2GPT.exe requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later.
|
||||
|
||||
#### Workaround
|
||||
|
||||
To fix this issue, mount the Windows PE image (WIM), copy the missing file from the [Windows 10, version 1903 Assessment and Development Kit (ADK)](https://go.microsoft.com/fwlink/?linkid=2086042) source, and then commit the changes to the WIM. To do this, follow these steps:
|
||||
|
||||
1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image).
|
||||
|
||||
2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM.
|
||||
|
||||
For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window:
|
||||
|
||||
**Command 1:**
|
||||
```cmd
|
||||
copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgnet*.*" "C:\WinPE_Mount\Windows\System32"
|
||||
```
|
||||
This command copies three files:
|
||||
|
||||
* ReAgent.admx
|
||||
* ReAgent.dll
|
||||
* ReAgent.xml
|
||||
|
||||
**Command 2:**
|
||||
```cmd
|
||||
copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgnet*.*" "C:\WinPE_Mount\Windows\System32\En-Us"
|
||||
```
|
||||
This command copies two files:
|
||||
* ReAgent.adml
|
||||
* ReAgent.dll.mui
|
||||
|
||||
>![Note]
|
||||
>If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language.
|
||||
|
||||
3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image).
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -220,7 +220,7 @@ The following are quick-reference tables of the supported policy values for Wind
|
||||
|
||||
| GPO Key | Key type | Value |
|
||||
| --- | --- | --- |
|
||||
| BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)</br>32: systems take Feature Updates for the Current Branch for Business (CBB)</br>Note: Other value or absent: receive all applicable updates (CB) |
|
||||
| BranchReadinessLevel | REG_DWORD | 2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)</br> 4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)</br> 8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)</br> 16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel </br>32: systems take Feature Updates from Semi-annual Channel </br>Note: Other value or absent: receive all applicable updates |
|
||||
| DeferQualityUpdates | REG_DWORD | 1: defer quality updates</br>Other value or absent: don’t defer quality updates |
|
||||
| DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days |
|
||||
| PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates</br>Other value or absent: don’t pause quality updates |
|
||||
@ -234,7 +234,7 @@ The following are quick-reference tables of the supported policy values for Wind
|
||||
|
||||
| MDM Key | Key type | Value |
|
||||
| --- | --- | --- |
|
||||
| BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)</br>32: systems take Feature Updates for the Current Branch for Business (CBB)</br>Note: Other value or absent: receive all applicable updates (CB) |
|
||||
| BranchReadinessLevel | REG_DWORD |2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)</br> 4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)</br> 8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)</br> 16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel </br>32: systems take Feature Updates from Semi-annual Channel </br>Note: Other value or absent: receive all applicable updates |
|
||||
| DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days |
|
||||
| PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates</br>Other value or absent: don’t pause quality updates |
|
||||
| DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: defer feature updates by given days |
|
||||
|
||||
@ -141,7 +141,7 @@ You can use the Upgrade Readiness deployment script to automate and verify your
|
||||
|
||||
See the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) topic for information about obtaining and running the script, and for a description of the error codes that can be displayed. See ["Understanding connectivity scenarios and the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog for a summary of setting the ClientProxy for the script, which will enable the script properly check for diagnostic data endpoint connectivity.
|
||||
|
||||
After data is sent from devices to Microsoft, it generally takes 48-56 hours for the data to populate in Windows Analytics. The compatibility update takes several minutes to run. If the update does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Windows Analytics. For this reason, you can expect most of your devices to be populated in Windows Analytics in about 1-2 weeks after deploying the update and configuration to user computers. As described in the Windows Analytics blog post ["You can now check on the status of your computers within hours of running the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/), you can verify that devices have successfully connected to the service within a few hours. Most of those devices should start to show up in the Windows Analytics console within a few days.
|
||||
After data is sent from devices to Microsoft, it generally takes 48-56 hours for the data to populate in Windows Analytics. The compatibility update takes several minutes to run. If the update does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Windows Analytics. For this reason, you can expect most of your devices to be populated in Windows Analytics within 1-2 days after deploying the update and configuration to user computers. As described in the Windows Analytics blog post ["You can now check on the status of your computers within hours of running the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/), you can verify that devices have successfully connected to the service within a few hours. Most of those devices should start to show up in the Windows Analytics console within a few days.
|
||||
|
||||
## Deploy additional optional settings
|
||||
|
||||
|
||||
@ -212,7 +212,7 @@ See the following examples.
|
||||
- Click **Next**.
|
||||
|
||||
>[!NOTE]
|
||||
>The Autopilot for existing devices task sequence will result in an Azure Active Directory Domain (AAD) joined device. The User State Migration Toolkit (USMT) does not support AAD joined devices.
|
||||
>The Autopilot for existing devices task sequence will result in an Azure Active Directory Domain (AAD) joined device. The User State Migration Toolkit (USMT) does not support AAD joined or hybrid AAD joined devices.
|
||||
|
||||
7. On the Include Updates page, choose one of the three available options. This selection is optional.
|
||||
8. On the Install applications page, add applications if desired. This is optional.
|
||||
|
||||
@ -1142,7 +1142,7 @@ To turn off **Let apps access my call history**:
|
||||
|
||||
### <a href="" id="bkmk-priv-email"></a>18.11 Email
|
||||
|
||||
In the **Email** area, you can choose which apps have can access and send email.
|
||||
In the **Email** area, you can choose which apps have access and can send email.
|
||||
|
||||
To turn off **Let apps access and send email**:
|
||||
|
||||
|
||||
@ -70,7 +70,9 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in
|
||||
- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC.
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won't work as expected.
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
|
||||
> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/en-us/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI.
|
||||
|
||||
## Discrete, Integrated or Firmware TPM?
|
||||
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Fileless threats
|
||||
ms.reviewer:
|
||||
description: Learn about fileless threats, its categories, and how it runs
|
||||
keywords: fileless, amsi, behavior monitoring, memory scanning, boot sector protection, security, malware, Windows Defender ATP, antivirus, AV, Microsoft Defender ATP
|
||||
description: Learn about the categories of fileless threats and malware that "live off the land"
|
||||
keywords: fileless, fileless malware, living off the land, lolbins, amsi, behavior monitoring, memory scanning, boot sector protection, security, malware, Windows Defender ATP, antivirus, AV, Microsoft Defender ATP, next generation protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: secure
|
||||
ms.sitesec: library
|
||||
@ -18,9 +18,9 @@ search.appverid: met150
|
||||
|
||||
# Fileless threats
|
||||
|
||||
What exactly is a fileless threat? The term "fileless" suggests that a threat that does not come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no generally accepted definition. The term is used broadly; it's also used to describe malware families that do rely on files to operate.
|
||||
What exactly are fileless threats? The term "fileless" suggests that a threat does not come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no generally accepted definition for fileless malware. The term is used broadly; it's also used to describe malware families that do rely on files to operate.
|
||||
|
||||
Given that attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, or information theft, some parts of the attack chain may be fileless, while others may involve the filesystem in some form or another.
|
||||
Given that attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, or information theft, some parts of the attack chain may be fileless, while others may involve the filesystem in some form.
|
||||
|
||||
For clarity, fileless threats are grouped into different categories.
|
||||
|
||||
|
||||
@ -57,7 +57,7 @@ The following steps are required to enable this integration:
|
||||
|
||||
### Before you begin
|
||||
Review the following details to verify minimum system requirements:
|
||||
- Install the [February monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598)
|
||||
- Install the [February 2018 monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598)
|
||||
|
||||
>[!NOTE]
|
||||
>Only applicable for Windows 7 SP1 Enterprise and Windows 7 SP1 Pro.
|
||||
|
||||
@ -305,7 +305,7 @@ At the level of each organizational unit in the Active Directory hierarchy, one,
|
||||
|
||||
This order means that the local Group Policy Object is processed first, and Group Policy Objects that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites the earlier Group Policy Objects.
|
||||
|
||||
This is the default processing order and administrators can specify exceptions to this order. A Group Policy Object that is linked to a site, domain, or organizational unit (not a local Group Policy Object) can be set to **Enforced** with respect to that site, domain, or organizational unit, so that none of its policy settings can be overridden. At any site, domain, or organizational unit, you can mark Group Policy inheritance selectively as **Block Inheritance**. Group Policy Object links that are set to **Enforced** are always applied, however, and they cannot be blocked.
|
||||
This is the default processing order and administrators can specify exceptions to this order. A Group Policy Object that is linked to a site, domain, or organizational unit (not a local Group Policy Object) can be set to **Enforced** with respect to that site, domain, or organizational unit, so that none of its policy settings can be overridden. At any site, domain, or organizational unit, you can mark Group Policy inheritance selectively as **Block Inheritance**. Group Policy Object links that are set to **Enforced** are always applied, however, and they cannot be blocked. For more information see [Group Policy Basics – Part 2: Understanding Which GPOs to Apply](https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/15/group-policy-basics-part-2-understanding-which-gpos-to-apply/).
|
||||
|
||||
### <a href="" id="bkmk-secpolprocessing"></a>Security settings policy processing
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ Download the installation and onboarding packages from Windows Defender Security
|
||||
Extract the contents of the .zip files:
|
||||
|
||||
```bash
|
||||
mavel-macmini:Downloads test$ ls -l
|
||||
ls -l
|
||||
total 721152
|
||||
-rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip
|
||||
-rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg
|
||||
@ -92,7 +92,7 @@ If you did not enable Microsoft's driver during installation, then the applicati
|
||||
You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available:
|
||||
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ mdatp --health
|
||||
mdatp --health
|
||||
...
|
||||
realTimeProtectionAvailable : false
|
||||
realTimeProtectionEnabled : true
|
||||
@ -112,7 +112,7 @@ In this case, you need to perform the following steps to enable Real-Time Protec
|
||||
|
||||
1. In Terminal, attempt to install the driver. (The operation will fail)
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ sudo kextutil /Library/Extensions/wdavkext.kext
|
||||
sudo kextutil /Library/Extensions/wdavkext.kext
|
||||
Kext rejected due to system policy: <OSKext 0x7fc34d528390 [0x7fffa74aa8e0]> { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" }
|
||||
Kext rejected due to system policy: <OSKext 0x7fc34d528390 [0x7fffa74aa8e0]> { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" }
|
||||
Diagnostics for /Library/Extensions/wdavkext.kext:
|
||||
@ -125,13 +125,13 @@ In this case, you need to perform the following steps to enable Real-Time Protec
|
||||
4. In Terminal, install the driver again. This time the operation will succeed:
|
||||
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ sudo kextutil /Library/Extensions/wdavkext.kext
|
||||
sudo kextutil /Library/Extensions/wdavkext.kext
|
||||
```
|
||||
|
||||
The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available:
|
||||
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ mdatp --health
|
||||
mdatp --health
|
||||
...
|
||||
realTimeProtectionAvailable : true
|
||||
realTimeProtectionEnabled : true
|
||||
@ -145,20 +145,20 @@ realTimeProtectionEnabled : true
|
||||
The client machine is not associated with orgId. Note that the *orgId* attribute is blank.
|
||||
|
||||
```bash
|
||||
mavel-mojave:wdavconfig testuser$ mdatp --health orgId
|
||||
mdatp --health orgId
|
||||
```
|
||||
|
||||
2. Install the configuration file on a client machine:
|
||||
|
||||
```bash
|
||||
mavel-mojave:wdavconfig testuser$ python WindowsDefenderATPOnboarding.py
|
||||
python WindowsDefenderATPOnboarding.py
|
||||
Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password)
|
||||
```
|
||||
|
||||
3. Verify that the machine is now associated with your organization and reports a valid *orgId*:
|
||||
|
||||
```bash
|
||||
mavel-mojave:wdavconfig testuser$ mdatp --health orgId
|
||||
mdatp --health orgId
|
||||
E6875323-A6C0-4C60-87AD-114BBE7439B8
|
||||
```
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ If you can reproduce a problem, please increase the logging level, run the syste
|
||||
1. Increase logging level:
|
||||
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ mdatp --log-level verbose
|
||||
mdatp --log-level verbose
|
||||
Creating connection to daemon
|
||||
Connection established
|
||||
Operation succeeded
|
||||
@ -39,19 +39,18 @@ If you can reproduce a problem, please increase the logging level, run the syste
|
||||
|
||||
2. Reproduce the problem
|
||||
|
||||
3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The command will print out location with generated zip file.
|
||||
3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds.
|
||||
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ mdatp --diagnostic --create
|
||||
mdatp --diagnostic --create
|
||||
Creating connection to daemon
|
||||
Connection established
|
||||
"/Library/Application Support/Microsoft/Defender/wdavdiag/d85e7032-adf8-434a-95aa-ad1d450b9a2f.zip"
|
||||
```
|
||||
|
||||
4. Restore logging level:
|
||||
|
||||
```bash
|
||||
mavel-mojave:~ testuser$ mdatp --log-level info
|
||||
mdatp --log-level info
|
||||
Creating connection to daemon
|
||||
Connection established
|
||||
Operation succeeded
|
||||
|
||||
@ -64,7 +64,7 @@ Microsoft Defender ATP can discover a proxy server by using the following discov
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs.
|
||||
|
||||
To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) and [https://cdn.x.cp.wd.microsoft.com/ping]([https://cdn.x.cp.wd.microsoft.com/ping) in a browser.
|
||||
To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) and [https://cdn.x.cp.wd.microsoft.com/ping](https://cdn.x.cp.wd.microsoft.com/ping) in a browser.
|
||||
|
||||
If you prefer the command line, you can also check the connection by running the following command in Terminal:
|
||||
|
||||
|
||||
@ -14,6 +14,9 @@ author: dansimp
|
||||
ms.date: 05/17/2018
|
||||
---
|
||||
|
||||
> [!NOTE]
|
||||
> For WDAC enhancements see [Delivering major enhancements in Windows Defender Application Control with the Windows 10 May 2019 Update](https://www.microsoft.com/security/blog/2019/07/01/).
|
||||
|
||||
# Deploy Windows Defender Application Control policies by using Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -45,6 +45,19 @@ Triggered rules display a notification on the device. You can [customize the not
|
||||
|
||||
For information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
|
||||
## Review attack surface reduction events in the Microsoft Security Center
|
||||
|
||||
Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios.
|
||||
|
||||
You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how controlled folder access settings could affect your environment.
|
||||
|
||||
Here is an example query:
|
||||
|
||||
```
|
||||
MiscEvents
|
||||
| where ActionType startswith 'Asr'
|
||||
```
|
||||
|
||||
## Review attack surface reduction events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to view events that are created when attack surface reduction rules fire:
|
||||
@ -147,7 +160,7 @@ GUID: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
|
||||
|
||||
Malware often uses JavaScript and VBScript scripts to launch other malicious apps.
|
||||
|
||||
Malware written in JavaScript or VBS often acts as a downloader to fetch and launch additional native payload from the Internet. This rule prevents scripts from launching downloaded content, helping to prevent malicious use of the scripts to spread malware and infect machines. This isn't a common line-of-business use, but line-of-business applications sometimes use scripts to download and launch installers. You can exclude scripts so they're allowed to run.
|
||||
Malware written in JavaScript or VBS often acts as a downloader to fetch and launch additional native payload from the Internet. This rule prevents scripts from launching downloaded content, helping to prevent malicious use of the scripts to spread malware and infect machines. This isn't a common line-of-business use, but line-of-business applications sometimes use scripts to download and launch installers.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>File and folder exclusions don't apply to this attack surface reduction rule.
|
||||
|
||||
@ -227,7 +227,7 @@ Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThun
|
||||
Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available
|
||||
Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available
|
||||
Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available
|
||||
Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available
|
||||
Validate heap integrity | System and app-level | TerminateOnError | Audit not available
|
||||
Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode
|
||||
Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad
|
||||
Block remote images | App-level only | BlockRemoteImages | Audit not available
|
||||
|
||||
@ -45,6 +45,19 @@ Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](http
|
||||
>[!WARNING]
|
||||
>Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
|
||||
|
||||
## Review exploit protection events in the Microsoft Security Center
|
||||
|
||||
Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios.
|
||||
|
||||
You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how exploit protection settings could affect your environment.
|
||||
|
||||
Here is an example query:
|
||||
|
||||
```
|
||||
MiscEvents
|
||||
| where ActionType startswith 'ExploitGuard' and ActionType !contains 'NetworkProtection'
|
||||
```
|
||||
|
||||
## Review exploit protection events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app:
|
||||
|
||||
@ -51,6 +51,13 @@ Microsoft Defender ATP provides detailed reporting into events and blocks as par
|
||||
|
||||
You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how network protection settings would affect your environment if they were enabled.
|
||||
|
||||
Here is an example query
|
||||
|
||||
```
|
||||
MiscEvents
|
||||
| where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked')
|
||||
```
|
||||
|
||||
## Review network protection events in Windows Event Viewer
|
||||
|
||||
You can review the Windows event log to see events that are created when network protection blocks (or audits) access to a malicious IP or domain:
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user