mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-18 00:07:23 +00:00
Merge pull request #3342 from MicrosoftDocs/master
Publish 7/22/2020 10:30 AM PT
This commit is contained in:
Tina Burden
GitHub
commit
ace02c3e1a
Binary file not shown.
@ -2744,8 +2744,10 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
|
||||
## <a href="" id="surfacehubcspsupport"></a>CSPs supported in Microsoft Surface Hub
|
||||
|
||||
- [Accounts CSP](accounts-csp.md)<sup>9</sup> **Note:** Support in Surface Hub is limited to **Domain\ComputerName**.
|
||||
- [AccountManagement CSP](accountmanagement-csp.md)
|
||||
- [APPLICATION CSP](application-csp.md)
|
||||
- [Bitlocker-csp](bitlocker-csp.md)<sup>9</sup>
|
||||
- [CertificateStore CSP](certificatestore-csp.md)
|
||||
- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)
|
||||
- [Defender CSP](defender-csp.md)
|
||||
@ -2757,18 +2759,21 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
- [DMAcc CSP](dmacc-csp.md)
|
||||
- [DMClient CSP](dmclient-csp.md)
|
||||
- [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)
|
||||
- [Firewall-csp](firewall-csp.md)<sup>9</sup>
|
||||
- [HealthAttestation CSP](healthattestation-csp.md)
|
||||
- [NetworkQoSPolicy CSP](networkqospolicy-csp.md)
|
||||
- [NodeCache CSP](nodecache-csp.md)
|
||||
- [PassportForWork CSP](passportforwork-csp.md)
|
||||
- [Policy CSP](policy-configuration-service-provider.md)
|
||||
- [Reboot CSP](reboot-csp.md)
|
||||
- [RemoteWipe CSP](remotewipe-csp.md)
|
||||
- [RemoteWipe CSP](remotewipe-csp.md)<sup>9</sup>
|
||||
- [Reporting CSP](reporting-csp.md)
|
||||
- [RootCATrustedCertificates CSP](rootcacertificates-csp.md)
|
||||
- [SurfaceHub CSP](surfacehub-csp.md)
|
||||
- [UEFI CSP](uefi-csp.md)
|
||||
- [Wifi-csp](wifi-csp.md)<sup>9</sup>
|
||||
- [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md)
|
||||
- [Wirednetwork-csp](wirednetwork-csp.md)<sup>9</sup>
|
||||
|
||||
|
||||
## <a href="" id="iotcoresupport"></a>CSPs supported in Windows 10 IoT Core
|
||||
@ -2807,3 +2812,4 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
- 6 - Added in Windows 10, version 1903.
|
||||
- 7 - Added in Windows 10, version 1909.
|
||||
- 8 - Added in Windows 10, version 2004.
|
||||
- 9 - Added in Windows 10 Team 2020 Update
|
||||
|
||||
@ -9,11 +9,15 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 07/18/2019
|
||||
ms.date: 07/22/2020
|
||||
---
|
||||
|
||||
# Policy CSPs supported by Microsoft Surface Hub
|
||||
|
||||
|
||||
- [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate)
|
||||
- [ApplicationManagement/AllowDeveloperUnlock](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock)
|
||||
- [Accounts/AllowMicrosoftAccountConnection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection)
|
||||
- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera)
|
||||
- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui)
|
||||
- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy)
|
||||
@ -61,6 +65,7 @@ ms.date: 07/18/2019
|
||||
- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap)
|
||||
- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth)
|
||||
- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders)
|
||||
- [RestrictedGroups/ConfigureGroupMembership](https://docs.microsoft.com/windows/client-management/https://docs.microsoft.com/windows/client-management/mdm/policy-csp-restrictedgroups)
|
||||
- [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging)
|
||||
- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess)
|
||||
- [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel)
|
||||
@ -72,7 +77,20 @@ ms.date: 07/18/2019
|
||||
- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208)
|
||||
- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc)
|
||||
- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis)
|
||||
- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting)
|
||||
- [Wifi/AllowInternetSharing](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowinternetsharing)
|
||||
- [Wifi/AllowManualWiFiConfiguration](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowmanualwificonfiguration)
|
||||
- [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi)
|
||||
- [WiFi/AllowWiFiHotSpotReporting](https://docs.microsoft.com/windows/client-management/policy-csp-wifi.md#wifi-allowwifihotspotreporting)
|
||||
- [Wifi/AllowWiFiDirect](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowwifidirect)
|
||||
- [WirelessDisplay/AllowMdnsAdvertisement](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsadvertisement)
|
||||
- [WirelessDisplay/AllowMdnsDiscovery](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsdiscovery)
|
||||
- [WirelessDisplay/AllowProjectionFromPC](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc)
|
||||
- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure)
|
||||
- [WirelessDisplay/AllowProjectionToPC](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc)
|
||||
- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure)
|
||||
- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver)
|
||||
- [WirelessDisplay/RequirePinForPairing](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing)
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.sitesec: library
|
||||
ms.pagetype: mobile, devices, security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.date: 01/26/2019
|
||||
ms.date:
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
@ -188,12 +188,12 @@ For both personal and corporate deployment scenarios, an MDM system is the essen
|
||||
Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state.
|
||||
|
||||
**Mobile Device Management**
|
||||
Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution.
|
||||
Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account.
|
||||
Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Microsoft 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution.
|
||||
Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account.
|
||||
|
||||
> [!NOTE]
|
||||
> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365.
|
||||
In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx).
|
||||
> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365.
|
||||
In addition, Microsoft recently added MDM capabilities powered by Intune to Microsoft 365, called Basic Mobility and Security for Microsoft 365. Basic Mobility and Security for Microsoft 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. Basic Mobility and Security for Microsoft 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information, see [Overview of Basic Mobility and Security for Microsoft 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx).
|
||||
|
||||
**Cloud services**
|
||||
On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect diagnostic and usage data. Windows 10 Mobile enables organizations to manage how devices consume these cloud services.
|
||||
|
||||
@ -153,7 +153,7 @@
|
||||
####### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||
####### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||
####### [Configure antivirus exclusions Windows Server 2016](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
|
||||
####### [Common mistakes when defining exclusions](microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
###### [Configure scanning antivirus options](microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md)
|
||||
###### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md)
|
||||
###### [Configure scheduled scans](microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -0,0 +1,155 @@
|
||||
---
|
||||
title: Common mistakes to avoid when defining exclusions
|
||||
description: Avoid common mistakes when defining exclusions for Microsoft Defender Antivirus scans.
|
||||
keywords: exclusions, files, extension, file type, folder name, file name, scans
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Common mistakes to avoid when defining exclusions
|
||||
You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable.
|
||||
See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) for more information.
|
||||
|
||||
Also, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists.
|
||||
|
||||
## Excluding certain trusted items
|
||||
There are certain files, file types, folders, or processes that you should not exclude from scanning even though you trust them to be not malicious. Refer to the following section for items that you should not exclude from scanning.
|
||||
|
||||
**Do not add exclusions for the following folder locations:**
|
||||
|
||||
- %systemdrive%
|
||||
- C:
|
||||
- C:\
|
||||
- C:\*
|
||||
- %ProgramFiles%\Java
|
||||
- C:\Program Files\Java
|
||||
- %ProgramFiles%\Contoso\
|
||||
- C:\Program Files\Contoso\
|
||||
- %ProgramFiles(x86)%\Contoso\
|
||||
- C:\Program Files (x86)\Contoso\
|
||||
- C:\Temp
|
||||
- C:\Temp\
|
||||
- C:\Temp\*
|
||||
- C:\Users\
|
||||
- C:\Users\*
|
||||
- C:\Users\<UserProfileName>\AppData\Local\Temp\
|
||||
- C:\Users\<UserProfileName>\AppData\LocalLow\Temp\
|
||||
- C:\Users\<UserProfileName>\AppData\Roaming\Temp\
|
||||
- %Windir%\Prefetch
|
||||
- C:\Windows\Prefetch
|
||||
- C:\Windows\Prefetch\
|
||||
- C:\Windows\Prefetch\*
|
||||
- %Windir%\System32\Spool
|
||||
- C:\Windows\System32\Spool
|
||||
- C:\Windows\System32\CatRoot2
|
||||
- %Windir%\Temp
|
||||
- C:\Windows\Temp
|
||||
- C:\Windows\Temp\
|
||||
- C:\Windows\Temp\*
|
||||
|
||||
**Do not add exclusions for the following file extensions:**
|
||||
- .7zip
|
||||
- .bat
|
||||
- .bin
|
||||
- .cab
|
||||
- .cmd
|
||||
- .com
|
||||
- .cpl
|
||||
- .dll
|
||||
- .exe
|
||||
- .fla
|
||||
- .gif
|
||||
- .gz
|
||||
- .hta
|
||||
- .inf
|
||||
- .java
|
||||
- .jar
|
||||
- .job
|
||||
- .jpeg
|
||||
- .jpg
|
||||
- .js
|
||||
- .ko
|
||||
- .ko.gz
|
||||
- .msi
|
||||
- .ocx
|
||||
- .png
|
||||
- .ps1
|
||||
- .py
|
||||
- .rar
|
||||
- .reg
|
||||
- .scr
|
||||
- .sys
|
||||
- .tar
|
||||
- .tmp
|
||||
- .url
|
||||
- .vbe
|
||||
- .vbs
|
||||
- .wsf
|
||||
- .zip
|
||||
|
||||
>[!NOTE]
|
||||
> You can chose to exclude file types, such as .gif, .jpg, .jpeg, .png if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities.
|
||||
|
||||
**Do not add exclusions for the following processes:**
|
||||
- AcroRd32.exe
|
||||
- bitsadmin.exe
|
||||
- excel.exe
|
||||
- iexplore.exe
|
||||
- java.exe
|
||||
- outlook.exe
|
||||
- psexec.exe
|
||||
- powerpnt.exe
|
||||
- powershell.exe
|
||||
- schtasks.exe
|
||||
- svchost.exe
|
||||
- wmic.exe
|
||||
- winword.exe
|
||||
- wuauclt.exe
|
||||
- addinprocess.exe
|
||||
- addinprocess32.exe
|
||||
- addinutil.exe
|
||||
- bash.exe
|
||||
- bginfo.exe[1]
|
||||
- cdb.exe
|
||||
- csi.exe
|
||||
- dbghost.exe
|
||||
- dbgsvc.exe
|
||||
- dnx.exe
|
||||
- fsi.exe
|
||||
- fsiAnyCpu.exe
|
||||
- kd.exe
|
||||
- ntkd.exe
|
||||
- lxssmanager.dll
|
||||
- msbuild.exe[2]
|
||||
- mshta.exe
|
||||
- ntsd.exe
|
||||
- rcsi.exe
|
||||
- system.management.automation.dll
|
||||
- windbg.exe
|
||||
|
||||
## Using just the file name in the exclusion list
|
||||
A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**.
|
||||
|
||||
## Using a single exclusion list for multiple server workloads
|
||||
Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload.
|
||||
|
||||
## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists
|
||||
Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables.
|
||||
See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
@ -25,13 +25,23 @@ manager: dansimp
|
||||
|
||||
You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender Antivirus scans. Such exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection.
|
||||
|
||||
>[!WARNING]
|
||||
>Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
|
||||
## Recommendations for defining exclusions
|
||||
Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
|
||||
|
||||
The following is a list of recommendations that you should keep in mind when defining exclusions:
|
||||
- Exclusions are technically a protection gap—always consider additional mitigations when defining exclusions. Additional mitigations could be as simple as making sure the excluded location has the appropriate access-control lists (ACLs), audit policy, is processed by an up-to-date software, etc.
|
||||
- Review the exclusions periodically. Re-check and re-enforce the mitigations as part of the review process.
|
||||
- Ideally, avoid defining proactive exclusions. For instance, don't exclude something just because you think it might be a problem in the future. Use exclusions only for specific issues—mostly around performance, or sometimes around application compatibility that exclusions could mitigate.
|
||||
- Audit the exclusion list changes. The security admin should preserve enough context around why a certain exclusion was added. You should be able to provide answer with specific reasoning as to why a certain path was excluded.
|
||||
|
||||
## Configure and validate exclusions
|
||||
|
||||
To configure and validate exclusions, see the following:
|
||||
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location.
|
||||
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from scans that have been opened by a specific process.
|
||||
|
||||
## Related articles
|
||||
|
||||
[Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
@ -32,7 +32,7 @@ You can exclude certain files from Microsoft Defender Antivirus scans by modifyi
|
||||
> [!NOTE]
|
||||
> Automatic exclusions apply only to Windows Server 2016 and above. The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default.
|
||||
|
||||
This article describes how to configure exclusion lists for the files and folders.
|
||||
This article describes how to configure exclusion lists for the files and folders. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists.
|
||||
|
||||
Exclusion | Examples | Exclusion list
|
||||
---|---|---
|
||||
@ -199,9 +199,9 @@ The following table describes how the wildcards can be used and provides some ex
|
||||
|
||||
<a id="review"></a>
|
||||
|
||||
### System environmental variables
|
||||
### System environment variables
|
||||
|
||||
The following table lists and describes the system account environmental variables.
|
||||
The following table lists and describes the system account environment variables.
|
||||
|
||||
<table border="0" cellspacing="0" cellpadding="20">
|
||||
<thead>
|
||||
@ -569,3 +569,4 @@ You can also copy the string into a blank text file and attempt to save it with
|
||||
- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -22,7 +22,7 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans.
|
||||
You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists.
|
||||
|
||||
This topic describes how to configure exclusion lists for the following:
|
||||
|
||||
@ -194,5 +194,6 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u
|
||||
- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md)
|
||||
- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
@ -54,9 +54,9 @@ Threats | Specify threats upon which default action should not be taken when det
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed.
|
||||
> </p>
|
||||
>
|
||||
> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md).
|
||||
> </p>
|
||||
>
|
||||
> To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md).
|
||||
|
||||
Also see [Configure remediation-required scheduled full Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md#remed) for more remediation-related settings.
|
||||
|
||||
@ -43,7 +43,7 @@ In addition to server role-defined automatic exclusions, you can add or remove c
|
||||
|
||||
## Opt out of automatic exclusions
|
||||
|
||||
In Windows Server 2016 and 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles.
|
||||
In Windows Server 2016 and 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists.
|
||||
|
||||
> [!WARNING]
|
||||
> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles.
|
||||
@ -401,11 +401,8 @@ This section lists the folder exclusions that are delivered automatically when y
|
||||
## Related articles
|
||||
|
||||
- [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md)
|
||||
|
||||
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md)
|
||||
|
||||
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
|
||||
|
||||
- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)
|
||||
- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md)
|
||||
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
@ -113,7 +113,7 @@ The following sections describe each of the 15 attack surface reduction rules. T
|
||||
This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers:
|
||||
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
- Script files (such as a PowerShell .ps, Visual Basic .vbs, or JavaScript .js file)
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
@ -327,7 +327,7 @@ GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c`
|
||||
With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include:
|
||||
|
||||
* Executable files (such as .exe, .dll, or .scr)
|
||||
* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
* Script files (such as a PowerShell .ps, Visual Basic .vbs, or JavaScript .js file)
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
@ -391,7 +391,7 @@ This rule was introduced in:
|
||||
- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903)
|
||||
- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909)
|
||||
|
||||
Intune name: Block persistence through WMI event subscription
|
||||
Intune name: Not yet available
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user