mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 15:27:22 +00:00
Merged PR 12021: 10/10 AM Publish
This commit is contained in:
Huaping Yu (Beyondsoft Consulting Inc)
commit
a9f76026e5
@ -22,7 +22,6 @@ If you have specific web sites and apps that have compatibility problems with Mi
|
||||
Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11.
|
||||
|
||||
|
||||
## Interoperability goals
|
||||
[!INCLUDE [interoperability-goals-enterprise-guidance](../includes/interoperability-goals-enterprise-guidance.md)]
|
||||
|
||||
## Enterprise guidance
|
||||
|
||||
@ -202,7 +202,7 @@ sections:
|
||||
|
||||
- href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/sync-browser-settings-gp
|
||||
|
||||
html: <p>Learn how to you can prevent the "browser" group from syncing and prevent users from turning on the the Sync your Settings toggle.</p>
|
||||
html: <p>Learn how to you can prevent the "browser" group from syncing and prevent users from turning on the Sync your Settings toggle.</p>
|
||||
|
||||
image:
|
||||
|
||||
@ -228,4 +228,4 @@ sections:
|
||||
|
||||
src: https://docs.microsoft.com/media/common/i_policy.svg
|
||||
|
||||
title: All group policies
|
||||
title: All group policies
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: edge
|
||||
ms.sitesec: library
|
||||
title: Deploy Microsoft Edge kiosk mode
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/09/2018
|
||||
ms.date: 10/10/2018
|
||||
---
|
||||
|
||||
# Deploy Microsoft Edge kiosk mode
|
||||
@ -74,15 +74,13 @@ Before you can configure Microsoft Edge kiosk mode, you must set up Microsoft Ed
|
||||
>[!NOTE]
|
||||
>For other MDM service, check with your provider for instructions.
|
||||
|
||||
- **Windows PowerShell.** Best for setting up multiple devices as a kiosk. With this method, you can set up single-app or multi-app assigned access using a PowerShell script. For details, see For details, see [Set up a kiosk or digital sign using Windows PowerShell](https://docs.microsoft.com/en-us/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-using-windows-powershell).
|
||||
|
||||
- **Windows Configuration Designer.** Best for setting up multiple kiosk devices. Download and install both the latest version of the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) and [Windows Configuration Manager](https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-install-icd#install-windows-configuration-designer-1).
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- Microsoft Edge on Windows 10, version 1809 (Professional, Enterprise, and Education).
|
||||
|
||||
- Configuration and deployment service, such as Windows PowerShell, Microsoft Intune or other MDM service, or Windows Configuration Designer. With these methods, you must have the AppUserModelID (AUMID) to set up Microsoft Edge:<p>Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge
|
||||
- Configuration and deployment service, such as Microsoft Intune or other MDM service. With these methods, you must have the AppUserModelID (AUMID) to set up Microsoft Edge:<p>Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge
|
||||
|
||||
|
||||
### Use Windows Settings
|
||||
@ -161,41 +159,6 @@ With this method, you can use Microsoft Intune or other MDM services to configur
|
||||
|
||||
**_Next steps._** Use your new kiosk. Sign in to the device using the user account that you selected to run the kiosk app.
|
||||
|
||||
### Use a provisioning package
|
||||
|
||||
With this method, you can use a provisioning package to configure Microsoft Edge kiosk mode in assigned access. After you set up the provisioning package for configuring Microsoft Edge in assigned access, you configure how Microsoft Edge behaves on a kiosk device.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If you are using a local account as a kiosk account in Intune or a provisioning package, make sure to sign into this account and then sign out before configuring the assigned access single-app kiosk.
|
||||
|
||||
1. Open Windows Configuration Designer and select **Provision Kiosk devices**.
|
||||
|
||||
2. Name your project, and click **Next**.
|
||||
|
||||
3. [Set up a kiosk](https://docs.microsoft.com/en-us/windows/configuration/kiosk-single-app#set-up-a-kiosk-using-the-kiosk-wizard-in-windows-configuration-designer).
|
||||
|
||||
4. Switch to the advanced editor and navigate to **Runtime settings \> Policies \> Browser** and set the following policies:
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **[ConfigureKioskMode](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**<p> | Configure the display mode for Microsoft Edge as a kiosk app.<p><p>**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode<p>**Data type:** Integer<p>**Allowed values:**<ul><li>**Single-app kiosk experience**<ul><li>**0** - Digital signage and interactive display</li><li>**1** - InPrivate Public browsing</li></ul></li><li>**Multi-app kiosk experience**<ul><li>**0** - Normal Microsoft Edge running in assigned access</li><li>**1** - InPrivate public browsing with other apps</li></ul></li></ul> |
|
||||
| **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**<p> | Change the time in minutes from the last user activity before Microsoft Edge kiosk mode resets to the default kiosk configuration.<p><p>**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout<p>**Data type:** Integer<p>**Allowed values:**<ul><li>**0** - No idle timer</li><li>**1-1440 (5 minutes is the default)** - Set reset on idle timer</li></ul> |
|
||||
| **[HomePages](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-homepages)**<p> | Set one or more start pages, URLs, to load when Microsoft Edge launches.<p><p>**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages<p>**Data type:** String<p>**Allowed values:**<p>Enter one or more URLs, for example,<br> \<https://www.msn.com\>\<https:/www.bing.com\> |
|
||||
| **[ConfigureHomeButton](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)**<p> | Configure how the Home Button behaves.<p><p>**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton<p>**Data type:** Integer<p> **Allowed values:**<ul><li>**0 (default)** - Not configured. Show home button, and load the default Start page.</li><li>**1** - Enabled. Show home button and load New Tab page</li><li>**2** - Enabled. Show home button & set a specific page.</li><li>**3** - Enabled. Hide the home button.</li></ul> |
|
||||
| **[SetHomeButtonURL](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)**<p> | If you set ConfigureHomeButton to 2, configure the home button URL.<p><p>**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL <p>**Data type:** String<p>**Allowed values:** Enter a URL, for example, https://www.bing.com |
|
||||
| **[SetNewTabPageURL](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)**<p> | Set a custom URL for the New Tab page.<p><p>**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL <p>**Data type:** String<p>**Allowed values:** Enter a URL, for example, https://www.msn.com |
|
||||
---
|
||||
|
||||
5. After you’ve configured the Microsoft Edge kiosk mode policies, including any of the related policies, it’s time to [build the package](https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-create-package#build-package).
|
||||
|
||||
6. Click **Finish**.<p>The wizard closes and takes you back to the Customizations page.
|
||||
|
||||
7. [Apply the provisioning package](https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-apply-package) to the device, which you can do during the first-run experience (out-of-box experience or OOBE) and after (runtime).
|
||||
|
||||
**_Congratulations!_** You’ve finished creating your provisioning package for Microsoft Edge kiosk mode.
|
||||
|
||||
**_Next steps._** Use your new kiosk. Sign in to the device using the user account that you selected to run the kiosk app.
|
||||
|
||||
---
|
||||
|
||||
## Microsoft Edge kiosk mode policies
|
||||
@ -302,7 +265,6 @@ Use any of the Microsoft Edge policies listed below to enhance the kiosk experie
|
||||
|
||||
- **[AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/en-us/windows/client-management/mdm/assignedaccess-csp):** The AssignedAccess configuration service provider (CSP) sets the device to run in kiosk mode. Once the CSP has executed, then the next user login associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration.
|
||||
|
||||
- **[Create a provisioning page for Windows 10](https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-create-package):** Learn to use Windows Configuration Designer (WCD) to create a provisioning package (.ppkg) for configuring devices running Windows 10. The WCD wizard options provide a simple interface to configure desktop, mobile, and kiosk device settings.
|
||||
|
||||
---
|
||||
|
||||
@ -330,6 +292,7 @@ In the following table, we show you the features available in both Microsoft Edg
|
||||
| End session button |  | <p>*In Microsoft Intune, you must create a custom URI to enable. Dedicated UI configuration targeted for 1808.* |
|
||||
| Reset on inactivity |  |  |
|
||||
| Internet Explorer integration (Enterprise Mode site list) | <p>*Multi-app mode only* |  |
|
||||
| Available in Microsoft Store |  |  |
|
||||
---
|
||||
|
||||
**\*Windows Defender Firewall**<p>
|
||||
|
||||
@ -24,9 +24,9 @@ Use the following procedure to configure the App-V 5.0 client configuration.
|
||||
|
||||
`$config = Get-AppvClientConfiguration`
|
||||
|
||||
`Set-AppcClientConfiguration $config`
|
||||
`Set-AppvClientConfiguration $config`
|
||||
|
||||
`Set-AppcClientConfiguration –Name1 MyConfig –Name2 “xyz”`
|
||||
`Set-AppvClientConfiguration –AutoLoad 2`
|
||||
|
||||
**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
|
||||
|
||||
|
||||
@ -24,9 +24,9 @@ Use the following procedure to configure the App-V 5.1 client configuration.
|
||||
|
||||
`$config = Get-AppvClientConfiguration`
|
||||
|
||||
`Set-AppcClientConfiguration $config`
|
||||
`Set-AppvClientConfiguration $config`
|
||||
|
||||
`Set-AppcClientConfiguration –Name1 MyConfig –Name2 “xyz”`
|
||||
`Set-AppvClientConfiguration –AutoLoad 2`
|
||||
|
||||
**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
|
||||
|
||||
|
||||
@ -51,7 +51,7 @@ After installing Microsoft BitLocker Administration and Monitoring (MBAM) with C
|
||||
|
||||
To view the configuration baselines with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Compliance Settings**, **Configuration Baselines**.
|
||||
|
||||
5. Use the Configuration Manager console to confirm that that the following new configuration items are displayed:
|
||||
5. Use the Configuration Manager console to confirm that the following new configuration items are displayed:
|
||||
|
||||
- BitLocker Fixed Data Drives Protection
|
||||
|
||||
|
||||
@ -90,7 +90,7 @@ The following image shows the ClientCertificateInstall configuration service pro
|
||||
<p style="margin-left: 20px">Supported operations are Get, Add, and Replace.
|
||||
|
||||
<a href="" id="clientcertificateinstall-pfxcertinstall-uniqueid-pfxcertpasswordencryptiontype"></a>**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionType**
|
||||
<p style="margin-left: 20px">Optional. Used to specify whtether the PFX certificate password is encrypted with the MDM certificate by the MDM server.
|
||||
<p style="margin-left: 20px">Optional. Used to specify whether the PFX certificate password is encrypted with the MDM certificate by the MDM server.
|
||||
|
||||
<p style="margin-left: 20px">The data type is int. Valid values:
|
||||
|
||||
|
||||
@ -2744,11 +2744,15 @@ The following list shows the configuration service providers supported in Window
|
||||
- [DMAcc CSP](dmacc-csp.md)
|
||||
- [DMClient CSP](dmclient-csp.md)
|
||||
- [EnterpriseAppManagement CSP](enterpriseappmanagement-csp.md)
|
||||
- [HealthAttestation CSP](healthattestation-csp.md)
|
||||
- [Policy CSP](policy-configuration-service-provider.md)
|
||||
- [Provisioning CSP (Provisioning only)](provisioning-csp.md)
|
||||
- [Reboot CSP](reboot-csp.md)
|
||||
- [RemoteWipe CSP](remotewipe-csp.md) 1
|
||||
- [RootCATrustedCertificates CSP](rootcacertificates-csp.md)
|
||||
- [Update CSP](update-csp.md)
|
||||
- [VPNv2 CSP](vpnv2-csp.md)
|
||||
- [WiFi CSP](wifi-csp.md)
|
||||
|
||||
|
||||
Footnotes:
|
||||
- 1 - Added in Windows 10, version 1809
|
||||
|
||||
@ -1055,7 +1055,7 @@ If you choose to completely wipe a device when lost or when an employee leaves t
|
||||
|
||||
A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system.
|
||||
|
||||
**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process.
|
||||
**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process.
|
||||
|
||||
**Settings for personal or corporate device retirement**
|
||||
- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system)
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 06/19/2018
|
||||
|
||||
- Windows 10
|
||||
|
||||
> **Looking for consumer information?** See [Customize the Start menu](https://windows.microsoft.com/windows-10/getstarted-see-whats-on-the-menu)
|
||||
> **Looking for consumer information?** [See what's on the Start menu](https://support.microsoft.com/help/17195/windows-10-see-whats-on-the-menu)
|
||||
|
||||
Organizations might want to deploy a customized Start and taskbar configuration to devices running Windows 10 Pro, Enterprise, or Education. A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default.
|
||||
|
||||
|
||||
@ -57,7 +57,7 @@ Clicking the header of the Frequently Crashing Devices blade opens a reliability
|
||||
Notice the filters in the left pane; they allow you to filter the crash rate shown to a particular operating system version, device model, or other parameter.
|
||||
|
||||
>[!NOTE]
|
||||
>Use caution when interpreting results filtered by model or operating system version. This is very useful for troubleshooting, but might not be accurate for *comparisons* because the crashes displayed could be of different types. The overall goal for working with crash data is to ensure that most devices have the same driver versions and that that version has a low crash rate.
|
||||
>Use caution when interpreting results filtered by model or operating system version. This is very useful for troubleshooting, but might not be accurate for *comparisons* because the crashes displayed could be of different types. The overall goal for working with crash data is to ensure that most devices have the same driver versions and that the version has a low crash rate.
|
||||
|
||||
>[!TIP]
|
||||
>Once you've applied a filter (for example setting OSVERSION=1607) you will see the query in the text box change to append the filter (for example, with “(OSVERSION=1607)”). To undo the filter, remove that part of the query in the text box and click the search button to the right of the text box to run the adjusted query.”
|
||||
|
||||
@ -53,7 +53,7 @@ To enable data sharing, configure your proxy server to whitelist the following e
|
||||
| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. |
|
||||
| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER); required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. |
|
||||
| `https://oca.telemetry.microsoft.com` | Online Crash Analysis; required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. |
|
||||
| `https://login.live.com` | This end-point is required by Device Health to ensure data integrity and provides a more reliable device identity for all Windows Analtyics solutions on Windows 10. Those who wish to disable end-user MSA access should do so by applying [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) rather than blocking this end-point. |
|
||||
| `https://login.live.com` | This end-point is required by Device Health to ensure data integrity and provides a more reliable device identity for all Windows Analytics solutions on Windows 10. Those who wish to disable end-user MSA access should do so by applying [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) rather than blocking this end-point. |
|
||||
| `https://www.msftncsi.com` | Windows Error Reporting (WER); required for Device Health to check connectivity. |
|
||||
| `https://www.msftconnecttest.com` | Windows Error Reporting (WER); required for Device Health to check connectivity. |
|
||||
|
||||
|
||||
@ -334,7 +334,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
|
||||
|
||||
This event indicates Indicates that the DecisionApplicationFile object is no longer present.
|
||||
This event indicates that the DecisionApplicationFile object is no longer present.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -670,7 +670,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
|
||||
|
||||
This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -4388,7 +4388,7 @@ The following fields are available:
|
||||
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
|
||||
- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
|
||||
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
|
||||
@ -9,7 +9,7 @@ ms.pagetype: security
|
||||
localizationpriority: high
|
||||
author: brianlic-msft
|
||||
ms.author: brianlic
|
||||
ms.date: 09/10/2018
|
||||
ms.date: 10/10/2018
|
||||
---
|
||||
|
||||
|
||||
@ -28,6 +28,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
|
||||
@ -76,9 +77,9 @@ The following fields are available:
|
||||
- **SystemProcessorNx** The count of the number of this particular object type present on this device.
|
||||
- **SystemProcessorPrefetchW** The count of SystemProcessorPrefetchW objects present on this machine.
|
||||
- **SystemProcessorSse2** The count of SystemProcessorSse2 objects present on this machine.
|
||||
- **SystemTouch** The count of SystemTouch objects present on this machine.
|
||||
- **SystemTouch** The count of the number of this particular object type present on this device.
|
||||
- **SystemWim** The count of SystemWim objects present on this machine.
|
||||
- **SystemWindowsActivationStatus** The count of SystemWindowsActivationStatus objects present on this machine.
|
||||
- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device.
|
||||
- **SystemWlan** The count of the number of this particular object type present on this device.
|
||||
- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device.
|
||||
@ -358,7 +359,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
|
||||
|
||||
This event indicates Indicates that the DecisionApplicationFile object is no longer present.
|
||||
This event indicates that the DecisionApplicationFile object is no longer present.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -705,7 +706,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
|
||||
|
||||
This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1544,14 +1545,14 @@ This event provides information on about security settings used to help keep Win
|
||||
The following fields are available:
|
||||
|
||||
- **AvailableSecurityProperties** This field helps to enumerate and report state on the relevant security properties for Device Guard.
|
||||
- **CGRunning** Credential Guard isolates and hardens key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This field tells if Credential Guard is running.
|
||||
- **CGRunning** Is Credential Guard running?
|
||||
- **DGState** This field summarizes the Device Guard state.
|
||||
- **HVCIRunning** Is HVCI running?
|
||||
- **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest.
|
||||
- **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host.
|
||||
- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
|
||||
- **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting.
|
||||
- **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running.
|
||||
- **SecureBootCapable** Is this device capable of running Secure Boot?
|
||||
- **VBSState** Is virtualization-based security enabled, disabled, or running?
|
||||
|
||||
|
||||
### Census.Speech
|
||||
@ -2956,6 +2957,19 @@ The following fields are available:
|
||||
|
||||
## Sediment events
|
||||
|
||||
### Microsoft.Windows.Sediment.Info.DetailedState
|
||||
|
||||
This event is sent when detailed state information is needed from an update trial run.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Data** Data relevant to the state, such as what percent of disk space the directory takes up.
|
||||
- **Id** Identifies the trial being run, such as a disk related trial.
|
||||
- **ReleaseVer** The version of the component.
|
||||
- **State** The state of the reporting data from the trial, such as the top-level directory analysis.
|
||||
- **Time** The time the event was fired.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.UrlState
|
||||
|
||||
This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL.
|
||||
@ -3579,14 +3593,14 @@ The following fields are available:
|
||||
- **BIOSVendor** The vendor of the BIOS.
|
||||
- **BiosVersion** The version of the BIOS.
|
||||
- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
|
||||
- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
|
||||
- **BundleRepeatFailFlag** Indicates whether this particular update bundle previously failed to install.
|
||||
- **BundleRevisionNumber** Identifies the revision number of the content bundle.
|
||||
- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
|
||||
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
|
||||
- **ClientVersion** The version number of the software distribution client.
|
||||
- **CSIErrorType** The stage of CBS installation where it failed.
|
||||
- **CurrentMobileOperator** Mobile operator that device is currently connected to.
|
||||
- **DeviceModel** What is the device model.
|
||||
- **CurrentMobileOperator** The mobile operator to which the device is currently connected.
|
||||
- **DeviceModel** The device model.
|
||||
- **DriverPingBack** Contains information about the previous driver and system state.
|
||||
- **EventInstanceID** A globally unique identifier for event instance.
|
||||
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
|
||||
@ -3602,21 +3616,21 @@ The following fields are available:
|
||||
- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
|
||||
- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
|
||||
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
|
||||
- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
|
||||
- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
|
||||
- **IsFirmware** Is this update a firmware update?
|
||||
- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
|
||||
- **IsDependentSet** Indicates whether the driver is part of a larger System Hardware/Firmware update.
|
||||
- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process.
|
||||
- **IsFirmware** Indicates whether this update is a firmware update.
|
||||
- **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart.
|
||||
- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
|
||||
- **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device.
|
||||
- **MergedUpdate** Was the OS update and a BSP update merged for installation?
|
||||
- **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation.
|
||||
- **MsiAction** The stage of MSI installation where it failed.
|
||||
- **MsiProductCode** The unique identifier of the MSI installer.
|
||||
- **PackageFullName** The package name of the content being installed.
|
||||
- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
|
||||
- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
|
||||
- **QualityUpdatePause** Are quality OS updates paused on the device?
|
||||
- **ProcessName** The process name of the caller who initiated API calls, in the event that CallerApplicationName was not provided.
|
||||
- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
|
||||
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
|
||||
- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
|
||||
- **RepeatFailFlag** Indicates whether this specific piece of content previously failed to install.
|
||||
- **RevisionNumber** The revision number of this specific piece of content.
|
||||
- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
|
||||
- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
|
||||
@ -3626,8 +3640,8 @@ The following fields are available:
|
||||
- **SystemBIOSMinorRelease** Minor version of the BIOS.
|
||||
- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
|
||||
- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
|
||||
- **TransactionCode** The ID which represents a given MSI installation
|
||||
- **UpdateId** Unique update ID
|
||||
- **TransactionCode** The ID that represents a given MSI installation.
|
||||
- **UpdateId** Unique update ID.
|
||||
- **UpdateID** An identifier associated with the specific piece of content.
|
||||
- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
|
||||
- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
|
||||
@ -3995,7 +4009,7 @@ The following fields are available:
|
||||
- **ScenarioId** Indicates the update scenario.
|
||||
- **SessionId** Unique value for each update attempt.
|
||||
- **SetupMode** Mode of setup to be launched.
|
||||
- **UpdateId** Unique ID for each update.
|
||||
- **UpdateId** Unique ID for each Update.
|
||||
- **UserSession** Indicates whether install was invoked by user actions.
|
||||
|
||||
|
||||
@ -4014,7 +4028,7 @@ The following fields are available:
|
||||
- **CV** Correlation vector.
|
||||
- **DetectorVersion** Most recently run detector version for the current campaign.
|
||||
- **GlobalEventCounter** Client side counter that indicates the ordering of events sent by this user.
|
||||
- **key1** Interaction data for the UI
|
||||
- **key1** UI interaction data
|
||||
- **key10** UI interaction data
|
||||
- **key11** UI interaction data
|
||||
- **key12** UI interaction data
|
||||
@ -4025,7 +4039,7 @@ The following fields are available:
|
||||
- **key17** UI interaction data
|
||||
- **key18** UI interaction data
|
||||
- **key19** UI interaction data
|
||||
- **key2** Interaction data for the UI
|
||||
- **key2** UI interaction data
|
||||
- **key20** UI interaction data
|
||||
- **key21** Interaction data for the UI
|
||||
- **key22** UI interaction data
|
||||
@ -4036,13 +4050,13 @@ The following fields are available:
|
||||
- **key27** UI interaction data
|
||||
- **key28** UI interaction data
|
||||
- **key29** UI interaction data
|
||||
- **key3** Interaction data for the UI
|
||||
- **key3** UI interaction data
|
||||
- **key30** UI interaction data
|
||||
- **key4** Interaction data for the UI
|
||||
- **key4** UI interaction data
|
||||
- **key5** UI interaction data
|
||||
- **key6** UI interaction data
|
||||
- **key7** Interaction data for the UI
|
||||
- **key8** Interaction data for the UI
|
||||
- **key7** UI interaction data
|
||||
- **key8** UI interaction data
|
||||
- **key9** UI interaction data
|
||||
- **PackageVersion** Current package version of the update notification.
|
||||
- **schema** UI interaction type.
|
||||
@ -4194,9 +4208,9 @@ The following fields are available:
|
||||
- **Setup360Extended** Detailed information about the phase or action when the potential failure occurred.
|
||||
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
|
||||
- **TestId** A string to uniquely identify a group of events.
|
||||
- **WuId** Windows Update client ID.
|
||||
|
||||
@ -4352,7 +4366,7 @@ The following fields are available:
|
||||
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
|
||||
- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
|
||||
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
@ -4388,17 +4402,17 @@ This event provides the results from the WaaSMedic engine
|
||||
The following fields are available:
|
||||
|
||||
- **detectionSummary** Result of each applicable detection that was run.
|
||||
- **featureAssessmentImpact** WaaS Assessment impact for feature updates.
|
||||
- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
|
||||
- **hrEngineResult** Indicates the WaaSMedic engine operation error codes
|
||||
- **insufficientSessions** Device not eligible for diagnostics.
|
||||
- **isManaged** Device is managed for updates.
|
||||
- **isWUConnected** Device is connected to Windows Update.
|
||||
- **noMoreActions** No more applicable diagnostics.
|
||||
- **qualityAssessmentImpact** WaaS Assessment impact for quality updates.
|
||||
- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
|
||||
- **isManaged** Indicates the device is managed for updates
|
||||
- **isWUConnected** Indicates the device is connected to Windows Update
|
||||
- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
|
||||
- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
|
||||
- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on.
|
||||
- **usingBackupFeatureAssessment** Relying on backup feature assessment.
|
||||
- **usingBackupQualityAssessment** Relying on backup quality assessment.
|
||||
- **versionString** Version of the WaaSMedic engine.
|
||||
- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client
|
||||
- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client
|
||||
- **versionString** Installed version of the WaaSMedic engine
|
||||
|
||||
|
||||
## Windows Store events
|
||||
@ -4667,9 +4681,9 @@ FulfillmentComplete event is fired at the end of an app install or update. We us
|
||||
The following fields are available:
|
||||
|
||||
- **FailedRetry** Tells us if the retry for an install or update was successful or not.
|
||||
- **HResult** Resulting HResult error/success code of this call
|
||||
- **PFN** Package Family Name of the app that being installed or updated
|
||||
- **ProductId** Product Id of the app that is being updated or installed
|
||||
- **HResult** The HResult code of the operation.
|
||||
- **PFN** The Package Family Name of the app that is being installed or updated.
|
||||
- **ProductId** The product ID of the app that is being updated or installed.
|
||||
|
||||
|
||||
### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
|
||||
@ -5028,14 +5042,14 @@ This event collects information regarding the install phase of the new device ma
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **errorCode** The error code returned for the current install phase
|
||||
- **flightId** The unique identifier for each flight
|
||||
- **objectId** Unique value for each Update Agent mode
|
||||
- **relatedCV** Correlation vector value generated from the latest scan
|
||||
- **result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
|
||||
- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
|
||||
- **sessionId** Unique value for each Update Agent mode attempt
|
||||
- **updateId** Unique ID for each update
|
||||
- **errorCode** The error code returned for the current install phase.
|
||||
- **flightId** Unique ID for each flight.
|
||||
- **objectId** Unique value for each diagnostics session.
|
||||
- **relatedCV** Correlation vector value generated from the latest USO scan.
|
||||
- **result** Outcome of the install phase of the update.
|
||||
- **scenarioId** Indicates the update scenario.
|
||||
- **sessionId** Unique value for each update session.
|
||||
- **updateId** Unique ID for each Update.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
|
||||
@ -5108,7 +5122,7 @@ The following fields are available:
|
||||
- **interactive** Indicates whether the session was user initiated.
|
||||
- **revisionNumber** Update revision number.
|
||||
- **updateId** Update ID.
|
||||
- **updateScenarioType** Device ID
|
||||
- **updateScenarioType** Update Session type
|
||||
- **wuDeviceid** Device ID
|
||||
|
||||
|
||||
|
||||
@ -369,7 +369,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
|
||||
|
||||
This event indicates Indicates that the DecisionApplicationFile object is no longer present.
|
||||
This event indicates that the DecisionApplicationFile object is no longer present.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -701,7 +701,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
|
||||
|
||||
This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -4538,7 +4538,7 @@ The following fields are available:
|
||||
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
|
||||
- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
|
||||
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
|
||||
@ -666,7 +666,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
|
||||
|
||||
This event indicates Indicates that the DecisionApplicationFile object is no longer present.
|
||||
This event indicates that the DecisionApplicationFile object is no longer present.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1013,7 +1013,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
|
||||
|
||||
This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
@ -123,7 +123,7 @@ This setting determines whether a device shows notifications about Windows diagn
|
||||
|
||||
### Configure telemetry opt-in setting user interface
|
||||
|
||||
This setting determines whether people can change their own Windows diagnostic data level in in *Start > Settings > Privacy > Diagnostics & feedback*.
|
||||
This setting determines whether people can change their own Windows diagnostic data level in *Start > Settings > Privacy > Diagnostics & feedback*.
|
||||
|
||||
#### Group Policy
|
||||
|
||||
|
||||
@ -131,7 +131,7 @@ In the Windows 10, version 1703, the PIN complexity Group Policy settings have m
|
||||
## Review
|
||||
|
||||
Before you continue with the deployment, validate your deployment progress by reviewing the following items:
|
||||
* Confirm you authored Group Policy settings using the latest ADMX/ADML files (from the Widows 10 Creators Editions)
|
||||
* Confirm you authored Group Policy settings using the latest ADMX/ADML files (from the Windows 10 Creators Editions)
|
||||
* Confirm you configured the Enable Windows Hello for Business to the scope that matches your deployment (Computer vs. User)
|
||||
* Confirm you configure the Use Certificate enrollment for on-premises authentication policy setting.
|
||||
* Confirm you configure automatic certificate enrollment to the scope that matches your deployment (Computer vs. User)
|
||||
|
||||
@ -104,7 +104,7 @@ In the Windows 10, version 1703, the PIN complexity Group Policy settings have m
|
||||
## Review
|
||||
|
||||
Before you continue with the deployment, validate your deployment progress by reviewing the following items:
|
||||
* Confirm you authored Group Policy settings using the latest ADMX/ADML files (from the Widows 10 Creators Editions)
|
||||
* Confirm you authored Group Policy settings using the latest ADMX/ADML files (from the Windows 10 Creators Editions)
|
||||
* Confirm you configured the Enable Windows Hello for Business to the scope that matches your deployment (Computer vs. User)
|
||||
* Confirm you configure the Use Certificate enrollment for on-premises authentication policy setting.
|
||||
* Confirm you configure automatic certificate enrollment to the scope that matches your deployment (Computer vs. User)
|
||||
|
||||
@ -75,7 +75,7 @@ The adoption of new authentication technology requires that identity providers a
|
||||
|
||||
Identity providers have flexibility in how they provision credentials on client devices. For example, an organization might provision only those devices that have a TPM so that the organization knows that a TPM protects the credentials. The ability to distinguish a TPM from malware acting like a TPM requires the following TPM capabilities (see Figure 1):
|
||||
|
||||
• **Endorsement key**. The TPM manufacturer can create a special key in the TPM called an *endorsement key*. An endorsement key certificate, signed by the manufacturer, says that the endorsement key is present in a TPM that that manufacturer made. Solutions can use the certificate with the TPM containing the endorsement key to confirm a scenario really involves a TPM from a specific TPM manufacturer (instead of malware acting like a TPM.
|
||||
• **Endorsement key**. The TPM manufacturer can create a special key in the TPM called an *endorsement key*. An endorsement key certificate, signed by the manufacturer, says that the endorsement key is present in a TPM that the manufacturer made. Solutions can use the certificate with the TPM containing the endorsement key to confirm a scenario really involves a TPM from a specific TPM manufacturer (instead of malware acting like a TPM.
|
||||
|
||||
• **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios.
|
||||
|
||||
|
||||
@ -40,7 +40,7 @@ It is also important to keep the following in mind:
|
||||
|
||||
* Use [Microsoft Edge](https://www.microsoft.com/windows/microsoft-edge) when browsing the internet. It blocks known support scam sites using Windows Defender SmartScreen (which is also used by Internet Explorer). Furthermore, Microsoft Edge can stop pop-up dialogue loops used by these sites.
|
||||
|
||||
* Enable Enable [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It detects and removes known support scam malware.
|
||||
* Enable [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It detects and removes known support scam malware.
|
||||
|
||||
## What to do if information has been given to a tech support person
|
||||
|
||||
@ -60,4 +60,4 @@ Help Microsoft stop scammers, whether they claim to be from Microsoft or from an
|
||||
|
||||
**www.microsoft.com/reportascam**
|
||||
|
||||
You can also report any **unsafe website** that you suspect is a phishing website or contains malicious content directly to Microsoft by filling out a [Report an unsafe site form](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site) or using built in web browser functionality.
|
||||
You can also report any **unsafe website** that you suspect is a phishing website or contains malicious content directly to Microsoft by filling out a [Report an unsafe site form](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site) or using built in web browser functionality.
|
||||
|
||||
@ -84,11 +84,11 @@ A user who is assigned this user right could increase the scheduling priority of
|
||||
|
||||
### Countermeasure
|
||||
|
||||
Verify that only Administrators and and Window Manager/Window Manager Group have the **Increase scheduling priority** user right assigned to them.
|
||||
Verify that only Administrators and Window Manager/Window Manager Group have the **Increase scheduling priority** user right assigned to them.
|
||||
|
||||
### Potential impact
|
||||
|
||||
None. Restricting the **Increase scheduling priority** user right to members of the Administrators group and and Window Manager/Window Manager Group is the default configuration.
|
||||
None. Restricting the **Increase scheduling priority** user right to members of the Administrators group and Window Manager/Window Manager Group is the default configuration.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 09/03/2018
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to take the following configuration steps to enable the managed security service provider (MSSP) integration.
|
||||
|
||||
@ -58,7 +58,7 @@ This action is taken by the MSSP. It allows MSSPs to fetch alerts using APIs.
|
||||
|
||||
>[!NOTE]
|
||||
> These set of steps are directed towards the MSSP customer. <br>
|
||||
> Access to the portal can can only be done by the MSSP customer.
|
||||
> Access to the portal can only be done by the MSSP customer.
|
||||
|
||||
As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Windows Defender Security Center.
|
||||
|
||||
@ -269,7 +269,7 @@ You'll need to have **Manage portal system settings** permission to whitelist th
|
||||
|
||||
You can now download the relevant configuration file for your SIEM and connect to the Windows Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
- In the ArcSight configuration file / Splunk Authentication Properties file – you will have to write your application key manually by settings the secret value.
|
||||
- In the ArcSight configuration file / Splunk Authentication Properties file you will have to write your application key manually by settings the secret value.
|
||||
- Instead of acquiring a refresh token in the portal, use the script from the previous step to acquire a refresh token (or acquire it by other means).
|
||||
|
||||
## Fetch alerts from MSSP customer's tenant using APIs
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 10/07/2018
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
Retrieves a map of of CVE's to KB's and CVE details.
|
||||
Retrieves a map of CVE's to KB's and CVE details.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 09/03/2018
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
The Widows Defender ATP endpoint detection and response capabilities provides near real-time actionable advance attacks detections, enables security analysts to effectively prioritize alerts, unfold the full scope of a breach and take response actions to remediate the threat.
|
||||
The Windows Defender ATP endpoint detection and response capabilities provides near real-time actionable advance attacks detections, enables security analysts to effectively prioritize alerts, unfold the full scope of a breach and take response actions to remediate the threat.
|
||||
|
||||
|
||||
When a threat is detected, alerts are be created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats.
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
---
|
||||
title: Windows Platform Common Criteria Certification
|
||||
title: Common Criteria Certifications
|
||||
description: This topic details how Microsoft supports the Common Criteria certification program.
|
||||
ms.prod: w10
|
||||
ms.localizationpriority: medium
|
||||
ms.author: daniha
|
||||
author: danihalfin
|
||||
ms.date: 04/03/2018
|
||||
ms.date: 10/8/2018
|
||||
---
|
||||
|
||||
# Windows Platform Common Criteria Certification
|
||||
# Common Criteria Certifications
|
||||
|
||||
Microsoft is committed to optimizing the security of its products and services. As part of that commitment, Microsoft supports the Common Criteria certification program, continues to ensure that products incorporate the features and functions required by relevant Common Criteria protection profiles, and completes Common Criteria certifications of Microsoft Windows products.
|
||||
|
||||
@ -18,7 +18,8 @@ Microsoft is committed to optimizing the security of its products and services.
|
||||
|
||||
The Security Target describes security functionality and assurance measures used to evaluate Windows.
|
||||
|
||||
- [Microsoft Window 10 (Creators Update)](http://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf)
|
||||
- [Microsoft Windows 10 (Fall Creators Update)](http://download.microsoft.com/download/B/6/A/B6A5EC2C-6351-4FB9-8FF1-643D4BD5BE6E/Windows%2010%201709%20GP%20OS%20Security%20Target.pdf)
|
||||
- [Microsoft Windows 10 (Creators Update)](http://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf)
|
||||
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](http://download.microsoft.com/download/1/c/3/1c3b5ab0-e064-4350-a31f-48312180d9b5/st_vid10823-st.pdf)
|
||||
- [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](http://download.microsoft.com/download/1/5/e/15eee6d3-f2a8-4441-8cb1-ce8c2ab91c24/windows%2010%20anniversary%20update%20mdf%20security%20target%20-%20public%20\(april%203%202017\).docx)
|
||||
- [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](http://download.microsoft.com/download/f/8/c/f8c1c2a4-719c-48ae-942f-9fd3ce5b238f/windows%2010%20au%20and%20server%202016%20gp%20os%20security%20target%20-%20public%20\(december%202%202016\)%20\(clean\).docx)
|
||||
@ -52,7 +53,9 @@ These documents describe how to configure Windows to replicate the configuration
|
||||
|
||||
**Windows 10, Windows 10 Mobile, Windows Server 2016, Windows Server 2012 R2**
|
||||
|
||||
- [Microsoft Window 10 (Creators Update)](http://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf)
|
||||
|
||||
- [Microsoft Windows 10 (Fall Creators Update)](http://download.microsoft.com/download/5/D/2/5D26F473-0FCE-4AC4-9065-6AEC0FE5B693/Windows%2010%201709%20GP%20OS%20Administrative%20Guide.pdf)
|
||||
- [Microsoft Windows 10 (Creators Update)](http://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf)
|
||||
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](http://download.microsoft.com/download/d/c/4/dc40b5c8-49c2-4587-8a04-ab3b81eb6fc4/st_vid10823-agd.pdf)
|
||||
- [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](http://download.microsoft.com/download/4/c/1/4c1f4ea4-2d66-4232-a0f5-925b2bc763bc/windows%2010%20au%20operational%20guidance%20\(16%20mar%202017\)\(clean\).docx)
|
||||
- [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](http://download.microsoft.com/download/b/5/2/b52e9081-05c6-4895-91a3-732bfa0eb4da/windows%2010%20au%20and%20server%202016%20gp%20os%20operational%20guidance%20\(final\).docx)
|
||||
@ -127,7 +130,8 @@ These documents describe how to configure Windows to replicate the configuration
|
||||
|
||||
An Evaluation Technical Report (ETR) is a report submitted to the Common Criteria certification authority for how Windows complies with the claims made in the Security Target. A Certification / Validation Report provides the results of the evaluation by the validation team.
|
||||
|
||||
- [Microsoft Window 10 (Creators Update)](http://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf)
|
||||
- [Microsoft Windows 10 (Fall Creators Update)](http://download.microsoft.com/download/2/C/2/2C20D013-0610-4047-B2FA-516819DFAE0A/Windows%2010%201709%20GP%20OS%20Certification%20Report.pdf)
|
||||
- [Microsoft Windows 10 (Creators Update)](http://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf)
|
||||
- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](http://download.microsoft.com/download/a/3/3/a336f881-4ac9-4c79-8202-95289f86bb7a/st_vid10823-vr.pdf)
|
||||
- [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](http://download.microsoft.com/download/f/2/f/f2f7176e-34f4-4ab0-993c-6606d207bb3c/st_vid10752-vr.pdf)
|
||||
- [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](http://download.microsoft.com/download/5/4/8/548cc06e-c671-4502-bebf-20d38e49b731/2016-36-inf-1779.pdf)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user