From 6ce23052b2d4e691196c87292501eda9e5640bda Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 7 Jul 2020 07:29:32 -0700 Subject: [PATCH 01/27] Update windows-10-mobile-and-mdm.md rebrand: Basic Mobility and Security for Microsoft 365 --- windows/client-management/windows-10-mobile-and-mdm.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index 7017e40876..da21428185 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -12,7 +12,7 @@ ms.sitesec: library ms.pagetype: mobile, devices, security ms.localizationpriority: medium author: dansimp -ms.date: 01/26/2019 +ms.date: ms.topic: article --- @@ -187,10 +187,10 @@ Azure AD is a cloud-based directory service that provides identity and access ma **Mobile Device Management** Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. -Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. +Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. ->**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). +>**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. +In addition, Microsoft recently added MDM capabilities powered by Intune to Microsoft 365, called Basic Mobility and Security for Microsoft 365. Basic Mobility and Security for Microsoft 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. Basic Mobility and Security for Microsoft 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information, see [Overview of Basic Mobility and Security for Microsoft 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). **Cloud services** On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect diagnostic and usage data. Windows 10 Mobile enables organizations to manage how devices consume these cloud services. From 98a3f2a8d8c69ea904f08d36dd2d6e50112b87b1 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 7 Jul 2020 14:21:28 -0700 Subject: [PATCH 02/27] Update windows-10-mobile-and-mdm.md --- windows/client-management/windows-10-mobile-and-mdm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index da21428185..b454b505e8 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -186,7 +186,7 @@ For both personal and corporate deployment scenarios, an MDM system is the essen Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. **Mobile Device Management** -Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Microsoft 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. >**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. From 51c4e2756359d920b5e33845138a6e70d7fdac70 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 14 Jul 2020 17:47:24 -0700 Subject: [PATCH 03/27] Added common mistakes section --- ...exclusions-microsoft-defender-antivirus.md | 118 ++++++++++++++++++ 1 file changed, 118 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 17b4284fa0..21244a7d3c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -564,6 +564,124 @@ If you do not have Internet access, you can create your own EICAR test file by w You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. +## Common mistakes to avoid when configuring exclusion lists +This section describes some common mistakes that you should avoid making when adding exclusions to Microsoft Defender Antivirus scans. + +### Excluding certain trusted items +If you trust a file, file type, folder, or a process, you can add that to the exclusion list for Microsoft Defender Antivirus scans. However, there are certain items that you should not exclude from scanning even though you trust them. + +The following lists provide the , including: +- Paths +- File extension +- Processes + +### Paths not to be excluded +The following table provides the paths that you should not add in the exclusion list: + +| File path | Comments | +|-----------| --------- | +|- %systemdrive%
- C:
- C:\
- C:\* | | +|- %ProgramFiles%\Java
- C:\Program Files\Java | | +|- %ProgramFiles%\Contoso\
- C:\Program Files\Contoso\ | It’s common to see applications and/or services have documentation to open up the whole folder and subfolders. | +|- %ProgramFiles(x86)%\Contoso\
- C:\Program Files (x86)\Contoso\ | It’s common to see applications and/or services have documentation to open up the whole folder and subfolders. | +|- C:\Temp
- C:\Temp\
- C:\Temp\* | | +|- C:\Users\
- C:\Users\* | | +|C:\Users\\AppData\Local\Temp\ | | +|C:\Users\\AppData\LocalLow\Temp\ | | +|C:\Users\\AppData\Roaming\Temp\ | | +|- %Windir%\Prefetch
- C:\Windows\Prefetch
- C:\Windows\Prefetch\
- C:\Windows\Prefetch\* | | +|- %Windir%\System32\Spool
- C:\Windows\System32\Spool | | +|C:\Windows\System32\CatRoot2 | | +|- %Windir%\Temp
- C:\Windows\Temp
- C:\Windows\Temp\
- C:\Windows\Temp\* | | + +### File extensions that should not be excluded +The following is the list of file extensions that you should not add to the exclusion list: + +- .7zip +- .bat +- .bin +- .cab +- .cmd +- .com +- .cpl +- .dll +- .exe +- .fla +- .gif +- .gz +- .hta +- .inf +- .java +- .jar +- .job +- .jpeg +- .jpg +- .js +- .ko +- .ko.gz +- .msi +- .ocx +- .png +- .ps1 +- .py +- .rar +- .reg +- .scr +- .sys +- .tar +- .tmp +- .url +- .vbe +- .vbs +- .wsf +- .zip + +### Processes that should not be excluded +The following is the list of processes that should not be added to the exclusion list: +- AcroRd32.exe +- bitsadmin.exe +- excel.exe +- iexplore.exe +- java.exe +- outlook.exe +- psexec.exe +- powerpnt.exe +- powershell.exe +- schtasks.exe +- svchost.exe +- wmic.exe +- winword.exe +- wuauclt.exe +- addinprocess.exe +- addinprocess32.exe +- addinutil.exe +- bash.exe +- bginfo.exe[1] +- cdb.exe +- csi.exe +- dbghost.exe +- dbgsvc.exe +- dnx.exe +- fsi.exe +- fsiAnyCpu.exe +- kd.exe +- ntkd.exe +- lxssmanager.dll +- msbuild.exe[2] +- mshta.exe +- ntsd.exe +- rcsi.exe +- system.management.automation.dll +- windbg.exe + +### Using only the file name in the exclusion list +It is possible that a malware is named exactly same as the file that you trust and want to exclude from scanning. In such cases, to avoid excluding the malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude `Filename.exe` from scanning, use the complete path to the file, such as `C:\program files\contoso\Filename.exe`. + +### On Server workloads, using a single exclusion for multiple exceptions + +Do not include every single application/service into just ‘1’ exclusion. You don’t want to include exceptions for IIS on your SQL server, or File Server, etc. You should split different application/service workloads to multiple exceptions. + + ## Related topics - [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) From dc0e82669b0ef1e10a5520081f87ce4de11c0ac0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 15 Jul 2020 16:51:32 -0700 Subject: [PATCH 04/27] more updates --- ...exclusions-microsoft-defender-antivirus.md | 36 ++++++++----------- ...emediation-microsoft-defender-antivirus.md | 4 +-- 2 files changed, 17 insertions(+), 23 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 21244a7d3c..e203735345 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -199,9 +199,9 @@ The following table describes how the wildcards can be used and provides some ex -### System environmental variables +### System environment variables -The following table lists and describes the system account environmental variables. +The following table lists and describes the system account environment variables. @@ -564,21 +564,17 @@ If you do not have Internet access, you can create your own EICAR test file by w You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. -## Common mistakes to avoid when configuring exclusion lists -This section describes some common mistakes that you should avoid making when adding exclusions to Microsoft Defender Antivirus scans. +## Common mistakes to avoid when defining exclusions +This section describes some common mistakes that you should avoid making when defining exclusions for Microsoft Defender Antivirus scans. ### Excluding certain trusted items If you trust a file, file type, folder, or a process, you can add that to the exclusion list for Microsoft Defender Antivirus scans. However, there are certain items that you should not exclude from scanning even though you trust them. -The following lists provide the , including: -- Paths -- File extension -- Processes +The following lists contain the items that you should not add as exclusions. -### Paths not to be excluded -The following table provides the paths that you should not add in the exclusion list: +**Do not add exclusions for the following folder locations:** -| File path | Comments | +| Folder location | Comments | |-----------| --------- | |- %systemdrive%
- C:
- C:\
- C:\* | | |- %ProgramFiles%\Java
- C:\Program Files\Java | | @@ -594,9 +590,7 @@ The following table provides the paths that you should not add in the exclusion |C:\Windows\System32\CatRoot2 | | |- %Windir%\Temp
- C:\Windows\Temp
- C:\Windows\Temp\
- C:\Windows\Temp\* | | -### File extensions that should not be excluded -The following is the list of file extensions that you should not add to the exclusion list: - +**Do not add exclusions for the following file extensions:** - .7zip - .bat - .bin @@ -636,8 +630,7 @@ The following is the list of file extensions that you should not add to the excl - .wsf - .zip -### Processes that should not be excluded -The following is the list of processes that should not be added to the exclusion list: +**Do not add exclusions for the following processes:** - AcroRd32.exe - bitsadmin.exe - excel.exe @@ -674,13 +667,14 @@ The following is the list of processes that should not be added to the exclusion - system.management.automation.dll - windbg.exe -### Using only the file name in the exclusion list -It is possible that a malware is named exactly same as the file that you trust and want to exclude from scanning. In such cases, to avoid excluding the malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude `Filename.exe` from scanning, use the complete path to the file, such as `C:\program files\contoso\Filename.exe`. +### Using just the file name in the exclusion list +It is possible that the name of a malware is same as the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. -### On Server workloads, using a single exclusion for multiple exceptions - -Do not include every single application/service into just ‘1’ exclusion. You don’t want to include exceptions for IIS on your SQL server, or File Server, etc. You should split different application/service workloads to multiple exceptions. +### Using a single exclusion for multiple exceptions on Server workloads +Do not include every application or service into a single exclusion. You don’t want to include exceptions for IIS on your SQL server, or File Server, etc. You should split different application and service workloads into multiple exceptions. +### Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists +Microsoft Defender Antivirus Service runs as a Local System account, which means it gets information from the "system" environment variable instead of the "user" environment variable. Therefore, you must use "system" environment variables when defining Microsoft Defender Antivirus folder or process exclusions. See the table under [System environment variables](#system-environment-variables) for a complete list of system account environment variables. ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md index f8ac6071ef..65400ddb8c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md @@ -54,9 +54,9 @@ Threats | Specify threats upon which default action should not be taken when det > [!IMPORTANT] > Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. ->

+> > If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). ->

+> > To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md). Also see [Configure remediation-required scheduled full Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md#remed) for more remediation-related settings. From ee4cd4131bfe4740f4ba3f7798d1f115adc0c297 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 15 Jul 2020 17:25:44 -0700 Subject: [PATCH 05/27] updates --- ...ion-file-exclusions-microsoft-defender-antivirus.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index e203735345..714afa6ea3 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -570,8 +570,6 @@ This section describes some common mistakes that you should avoid making when de ### Excluding certain trusted items If you trust a file, file type, folder, or a process, you can add that to the exclusion list for Microsoft Defender Antivirus scans. However, there are certain items that you should not exclude from scanning even though you trust them. -The following lists contain the items that you should not add as exclusions. - **Do not add exclusions for the following folder locations:** | Folder location | Comments | @@ -668,13 +666,13 @@ The following lists contain the items that you should not add as exclusions. - windbg.exe ### Using just the file name in the exclusion list -It is possible that the name of a malware is same as the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. +A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. -### Using a single exclusion for multiple exceptions on Server workloads -Do not include every application or service into a single exclusion. You don’t want to include exceptions for IIS on your SQL server, or File Server, etc. You should split different application and service workloads into multiple exceptions. +### Using a single exclusion for multiple server workloads +Do not add every application or service into a single exclusion. For example, do not add exclusions for IIS to your SQL server or File server exclusions. On server workloads, split different application and service workloads into multiple exclusions. ### Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists -Microsoft Defender Antivirus Service runs as a Local System account, which means it gets information from the "system" environment variable instead of the "user" environment variable. Therefore, you must use "system" environment variables when defining Microsoft Defender Antivirus folder or process exclusions. See the table under [System environment variables](#system-environment-variables) for a complete list of system account environment variables. +Microsoft Defender Antivirus Service runs as a Local System account, which means it gets information from the system environment variable instead of the user environment variable. Environment variable usage as a wildcard is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](#system-environment-variables) for a complete list of system account environment variables. ## Related topics From 7181c128e79a0076192bf1af452d3c1baea06b9d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 16 Jul 2020 17:48:52 -0700 Subject: [PATCH 06/27] Converted common mistakes topic to a new topic --- ...n-mistakes-microsoft-defender-antivirus.md | 148 ++++++++++++++++++ 1 file changed, 148 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..c4e8740b49 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -0,0 +1,148 @@ +--- +title: Common mistakes to avoid when defining exclusions +description: Avoid common mistakes when defining exclusions for Microsoft Defender Antivirus scans. +keywords: exclusions, files, extension, file type, folder name, file name, scans +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +--- + +# Common mistakes to avoid when defining exclusions +This article describes some common mistakes that you should avoid when defining exclusions for Microsoft Defender Antivirus scans. + +## Excluding certain trusted items +There are certain file, file type, folder, or a process that you should not exclude from scanning even though you trust them. Refer to the following section for items that you should not exclude from scanning. + +**Do not add exclusions for the following folder locations:** + +- %systemdrive% +- C: +- C:\ +- C:\* +- %ProgramFiles%\Java +- C:\Program Files\Java +- %ProgramFiles%\Contoso\ +- C:\Program Files\Contoso\ +- %ProgramFiles(x86)%\Contoso\ +- C:\Program Files (x86)\Contoso\ +- C:\Temp +- C:\Temp\ +- C:\Temp\* +- C:\Users\ +- C:\Users\* +- C:\Users\\AppData\Local\Temp\ +- C:\Users\\AppData\LocalLow\Temp\ +- C:\Users\\AppData\Roaming\Temp\ +- %Windir%\Prefetch +- C:\Windows\Prefetch +- C:\Windows\Prefetch\ +- C:\Windows\Prefetch\* +- %Windir%\System32\Spool +- C:\Windows\System32\Spool +- C:\Windows\System32\CatRoot2 +- %Windir%\Temp +- C:\Windows\Temp +- C:\Windows\Temp\ +- C:\Windows\Temp\* + +**Do not add exclusions for the following file extensions:** +- .7zip +- .bat +- .bin +- .cab +- .cmd +- .com +- .cpl +- .dll +- .exe +- .fla +- .gif +- .gz +- .hta +- .inf +- .java +- .jar +- .job +- .jpeg +- .jpg +- .js +- .ko +- .ko.gz +- .msi +- .ocx +- .png +- .ps1 +- .py +- .rar +- .reg +- .scr +- .sys +- .tar +- .tmp +- .url +- .vbe +- .vbs +- .wsf +- .zip + +**Do not add exclusions for the following processes:** +- AcroRd32.exe +- bitsadmin.exe +- excel.exe +- iexplore.exe +- java.exe +- outlook.exe +- psexec.exe +- powerpnt.exe +- powershell.exe +- schtasks.exe +- svchost.exe +- wmic.exe +- winword.exe +- wuauclt.exe +- addinprocess.exe +- addinprocess32.exe +- addinutil.exe +- bash.exe +- bginfo.exe[1] +- cdb.exe +- csi.exe +- dbghost.exe +- dbgsvc.exe +- dnx.exe +- fsi.exe +- fsiAnyCpu.exe +- kd.exe +- ntkd.exe +- lxssmanager.dll +- msbuild.exe[2] +- mshta.exe +- ntsd.exe +- rcsi.exe +- system.management.automation.dll +- windbg.exe + +## Using just the file name in the exclusion list +A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. + +## Using a single exclusion for multiple server workloads +Do not use a single exclusion list to define exclusions for multiple server workloads. On Server workloads, split the different application or service workloads into multiple exceptions. For example, create separate exclusion lists for workloads on IIS Server and File Server. + +## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists +Microsoft Defender Antivirus Service runs as a Local System account, which means it gets information from the system environment variable instead of the user environment variable. Environment variable usage as a wildcard is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system account environment variables. + +## Related topics + +- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) From 48fc020bf4460f73cadfc0e48a4d44ce19cddc6b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 Jul 2020 09:49:42 -0700 Subject: [PATCH 07/27] more updates --- windows/security/threat-protection/TOC.md | 2 +- ...lusion-mistakes-microsoft-defender-antivirus.md | 14 +++++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 666cf8cb70..8285168070 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -153,7 +153,7 @@ ####### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md) ####### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) ####### [Configure antivirus exclusions Windows Server 2016](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md) - +####### [Common mistakes when defining exclusions](microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md) ###### [Configure scanning antivirus options](microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md) ###### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) ###### [Configure scheduled scans](microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md index c4e8740b49..f0cac112ec 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -17,10 +17,13 @@ manager: dansimp --- # Common mistakes to avoid when defining exclusions -This article describes some common mistakes that you should avoid when defining exclusions for Microsoft Defender Antivirus scans. +You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable. +See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) for more information. + +This article describes some common mistakes that you should avoid when defining exclusions from Microsoft Defender Antivirus scans. ## Excluding certain trusted items -There are certain file, file type, folder, or a process that you should not exclude from scanning even though you trust them. Refer to the following section for items that you should not exclude from scanning. +There are certain files, file types, folders, or processes that you should not exclude from scanning even though you trust them to be not malicious. Refer to the following section for items that you should not exclude from scanning. **Do not add exclusions for the following folder locations:** @@ -134,11 +137,12 @@ There are certain file, file type, folder, or a process that you should not excl ## Using just the file name in the exclusion list A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. -## Using a single exclusion for multiple server workloads -Do not use a single exclusion list to define exclusions for multiple server workloads. On Server workloads, split the different application or service workloads into multiple exceptions. For example, create separate exclusion lists for workloads on IIS Server and File Server. +## Using a single exclusion list for multiple server workloads +Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload. ## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists -Microsoft Defender Antivirus Service runs as a Local System account, which means it gets information from the system environment variable instead of the user environment variable. Environment variable usage as a wildcard is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system account environment variables. +Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. +See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. ## Related topics From 9efb1f53f6fd72723a8bccf107e4cb494cfafeb7 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 Jul 2020 09:50:38 -0700 Subject: [PATCH 08/27] Removed common mistake section --- ...exclusions-microsoft-defender-antivirus.md | 110 ------------------ 1 file changed, 110 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 714afa6ea3..30f77a7b34 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -564,116 +564,6 @@ If you do not have Internet access, you can create your own EICAR test file by w You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. -## Common mistakes to avoid when defining exclusions -This section describes some common mistakes that you should avoid making when defining exclusions for Microsoft Defender Antivirus scans. - -### Excluding certain trusted items -If you trust a file, file type, folder, or a process, you can add that to the exclusion list for Microsoft Defender Antivirus scans. However, there are certain items that you should not exclude from scanning even though you trust them. - -**Do not add exclusions for the following folder locations:** - -| Folder location | Comments | -|-----------| --------- | -|- %systemdrive%
- C:
- C:\
- C:\* | | -|- %ProgramFiles%\Java
- C:\Program Files\Java | | -|- %ProgramFiles%\Contoso\
- C:\Program Files\Contoso\ | It’s common to see applications and/or services have documentation to open up the whole folder and subfolders. | -|- %ProgramFiles(x86)%\Contoso\
- C:\Program Files (x86)\Contoso\ | It’s common to see applications and/or services have documentation to open up the whole folder and subfolders. | -|- C:\Temp
- C:\Temp\
- C:\Temp\* | | -|- C:\Users\
- C:\Users\* | | -|C:\Users\\AppData\Local\Temp\ | | -|C:\Users\\AppData\LocalLow\Temp\ | | -|C:\Users\\AppData\Roaming\Temp\ | | -|- %Windir%\Prefetch
- C:\Windows\Prefetch
- C:\Windows\Prefetch\
- C:\Windows\Prefetch\* | | -|- %Windir%\System32\Spool
- C:\Windows\System32\Spool | | -|C:\Windows\System32\CatRoot2 | | -|- %Windir%\Temp
- C:\Windows\Temp
- C:\Windows\Temp\
- C:\Windows\Temp\* | | - -**Do not add exclusions for the following file extensions:** -- .7zip -- .bat -- .bin -- .cab -- .cmd -- .com -- .cpl -- .dll -- .exe -- .fla -- .gif -- .gz -- .hta -- .inf -- .java -- .jar -- .job -- .jpeg -- .jpg -- .js -- .ko -- .ko.gz -- .msi -- .ocx -- .png -- .ps1 -- .py -- .rar -- .reg -- .scr -- .sys -- .tar -- .tmp -- .url -- .vbe -- .vbs -- .wsf -- .zip - -**Do not add exclusions for the following processes:** -- AcroRd32.exe -- bitsadmin.exe -- excel.exe -- iexplore.exe -- java.exe -- outlook.exe -- psexec.exe -- powerpnt.exe -- powershell.exe -- schtasks.exe -- svchost.exe -- wmic.exe -- winword.exe -- wuauclt.exe -- addinprocess.exe -- addinprocess32.exe -- addinutil.exe -- bash.exe -- bginfo.exe[1] -- cdb.exe -- csi.exe -- dbghost.exe -- dbgsvc.exe -- dnx.exe -- fsi.exe -- fsiAnyCpu.exe -- kd.exe -- ntkd.exe -- lxssmanager.dll -- msbuild.exe[2] -- mshta.exe -- ntsd.exe -- rcsi.exe -- system.management.automation.dll -- windbg.exe - -### Using just the file name in the exclusion list -A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. - -### Using a single exclusion for multiple server workloads -Do not add every application or service into a single exclusion. For example, do not add exclusions for IIS to your SQL server or File server exclusions. On server workloads, split different application and service workloads into multiple exclusions. - -### Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists -Microsoft Defender Antivirus Service runs as a Local System account, which means it gets information from the system environment variable instead of the user environment variable. Environment variable usage as a wildcard is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](#system-environment-variables) for a complete list of system account environment variables. - ## Related topics - [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) From 79baae28c712a7b439bba1e47ffecdab837d73ff Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sun, 19 Jul 2020 13:21:52 +0500 Subject: [PATCH 09/27] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 9ee5965970..c8c5577f4f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -391,7 +391,7 @@ This rule was introduced in: - [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) - [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909) -Intune name: Block persistence through WMI event subscription +Intune name: Not yet available Configuration Manager name: Not yet available From f219a4b8706d2b1d8ec9d0932fd231e7d5ee58e3 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 20 Jul 2020 13:07:00 -0700 Subject: [PATCH 10/27] more updates --- ...sion-mistakes-microsoft-defender-antivirus.md | 5 ++++- ...re-exclusions-microsoft-defender-antivirus.md | 16 +++++++++++++--- ...le-exclusions-microsoft-defender-antivirus.md | 1 + ...le-exclusions-microsoft-defender-antivirus.md | 1 + 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md index f0cac112ec..bbdf9fc0e5 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -20,7 +20,7 @@ manager: dansimp You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) for more information. -This article describes some common mistakes that you should avoid when defining exclusions from Microsoft Defender Antivirus scans. +Also, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. ## Excluding certain trusted items There are certain files, file types, folders, or processes that you should not exclude from scanning even though you trust them to be not malicious. Refer to the following section for items that you should not exclude from scanning. @@ -97,6 +97,9 @@ There are certain files, file types, folders, or processes that you should not e - .wsf - .zip +>[!NOTE] +> You can chose to exclude file types, such as .gif, .jpg, .jpeg, .png if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. + **Do not add exclusions for the following processes:** - AcroRd32.exe - bitsadmin.exe diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md index 78dd9f20a7..d0b737f37f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md @@ -25,13 +25,23 @@ manager: dansimp You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender Antivirus scans. Such exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection. ->[!WARNING] ->Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. +## Recommendations for defining exclusions +Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. +The following is a list of recommendations that you should keep in mind when defining exclusions: +- Exclusions are technically a protection gap—always consider additional mitigations when defining exclusions. Additional mitigations could be as simple as making sure the excluded location has the appropriate access-control lists (ACLs), audit policy, is processed by an up-to-date software, etc. +- Review the exclusions periodically. Re-check and re-enforce the mitigations as part of the review process. +- Ideally, avoid defining proactive exclusions. For instance, don't exclude something just because you think it might be a problem in the future. Use exclusions only for specific issues—mostly around performance, or sometimes around application compatibility that exclusions could mitigate. +- Audit the exclusion list changes. The security admin should preserve enough context around why a certain exclusion was added. You should be able to provide answer with specific reasoning as to why a certain path was excluded. + +## Configure and validate exclusions + +To configure and validate exclusions, see the following: - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from scans that have been opened by a specific process. ## Related articles -[Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md) \ No newline at end of file +- [Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 30f77a7b34..a474f7f68a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -569,3 +569,4 @@ You can also copy the string into a blank text file and attempt to save it with - [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) - [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index ffe624dd8e..8ded21f66b 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -194,5 +194,6 @@ See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](u - [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) - [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) - [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) From 482523084fefada52d322b5f651e94d4c4b00b52 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 20 Jul 2020 13:48:50 -0700 Subject: [PATCH 11/27] Added xrefs --- ...tension-file-exclusions-microsoft-defender-antivirus.md | 2 +- ...-opened-file-exclusions-microsoft-defender-antivirus.md | 2 +- ...igure-server-exclusions-microsoft-defender-antivirus.md | 7 ++----- 3 files changed, 4 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index a474f7f68a..5074fb8a80 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -32,7 +32,7 @@ You can exclude certain files from Microsoft Defender Antivirus scans by modifyi > [!NOTE] > Automatic exclusions apply only to Windows Server 2016 and above. The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default. -This article describes how to configure exclusion lists for the files and folders. +This article describes how to configure exclusion lists for the files and folders. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. Exclusion | Examples | Exclusion list ---|---|--- diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 8ded21f66b..9fb92406dc 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -22,7 +22,7 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans. +You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. This topic describes how to configure exclusion lists for the following: diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md index 59e059aeb5..3365f5ccee 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md @@ -43,7 +43,7 @@ In addition to server role-defined automatic exclusions, you can add or remove c ## Opt out of automatic exclusions -In Windows Server 2016 and 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles. +In Windows Server 2016 and 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. > [!WARNING] > Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles. @@ -401,11 +401,8 @@ This section lists the folder exclusions that are delivered automatically when y ## Related articles - [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) - - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) - - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) - +- - [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) - [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) - - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) From 6d0221cf1d103751d91bb52485ad6a74b6336ff9 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Mon, 20 Jul 2020 14:59:13 -0700 Subject: [PATCH 12/27] Update policy-csps-supported-by-surface-hub.md Opening PR to update CSPs for Surface Hub. Draft in progress. --- .../mdm/policy-csps-supported-by-surface-hub.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index ec48042286..29329bc947 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -9,11 +9,15 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 07/18/2019 +ms.date: 07/21/2020 --- # Policy CSPs supported by Microsoft Surface Hub + +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) - [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) - [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) From 26742ce6442d5d8ad4fc44cef06cc93ddaf2445e Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 11:28:51 -0700 Subject: [PATCH 13/27] Update policy-csps-supported-by-surface-hub.md --- .../policy-csps-supported-by-surface-hub.md | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index 29329bc947..5f0354a75a 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -17,7 +17,7 @@ ms.date: 07/21/2020 - [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) - [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) -- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) - [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) - [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) @@ -65,6 +65,7 @@ ms.date: 07/21/2020 - [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) - [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) - [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [RestrictedGroups/ConfigureGroupMembership](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-restrictedgroups) - [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging) - [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess) - [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel) @@ -76,7 +77,24 @@ ms.date: 07/21/2020 - [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) - [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) - [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) +- [Wifi/AllowInternetSharing]policy-csp-wifi#wifi-allowinternetsharing) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi#wifi-allowmanualwificonfiguration) +- [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) - [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) +- [Wifi/AllowWiFiDirect](policy-csp-wifi#wifi-allowwifidirect) +[WirelessDisplay/AllowMdnsAdvertisement]( +policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsadvertisement) +[WirelessDisplay/AllowMdnsDiscovery]( +policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsdiscovery) +[WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc) +[WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure) +[WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc) +[WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure) +[WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver]( +policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) +[WirelessDisplay/RequirePinForPairing]( +policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing) + ## Related topics From b2558c1907385336a9506b4c288589cc68def11d Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 12:10:44 -0700 Subject: [PATCH 14/27] Update configuration-service-provider-reference.md Adds Surface Hub CSPs supported in Windows 10 2020 Team Update Preview Build --- .../mdm/configuration-service-provider-reference.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 59751b300b..81d5779e45 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2744,8 +2744,10 @@ The following list shows the CSPs supported in HoloLens devices: ## CSPs supported in Microsoft Surface Hub +- [Accounts CSP](accounts-csp)9 **Note:** Support in Surface Hub is limited to **Domain\ComputerName**. - [AccountManagement CSP](accountmanagement-csp.md) - [APPLICATION CSP](application-csp.md) +- [Bitlocker-csp](bitlocker-csp)9 - [CertificateStore CSP](certificatestore-csp.md) - [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) - [Defender CSP](defender-csp.md) @@ -2757,18 +2759,21 @@ The following list shows the CSPs supported in HoloLens devices: - [DMAcc CSP](dmacc-csp.md) - [DMClient CSP](dmclient-csp.md) - [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +- [Firewall-csp](firewall-csp)9 - [HealthAttestation CSP](healthattestation-csp.md) - [NetworkQoSPolicy CSP](networkqospolicy-csp.md) - [NodeCache CSP](nodecache-csp.md) - [PassportForWork CSP](passportforwork-csp.md) - [Policy CSP](policy-configuration-service-provider.md) - [Reboot CSP](reboot-csp.md) -- [RemoteWipe CSP](remotewipe-csp.md) +- [RemoteWipe CSP](remotewipe-csp.md)9 - [Reporting CSP](reporting-csp.md) - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [SurfaceHub CSP](surfacehub-csp.md) - [UEFI CSP](uefi-csp.md) +- [Wifi-csp](wifi-csp)9 - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) +- [Wirednetwork-csp](wirednetwork-csp)9 ## CSPs supported in Windows 10 IoT Core @@ -2807,3 +2812,4 @@ The following list shows the CSPs supported in HoloLens devices: - 6 - Added in Windows 10, version 1903. - 7 - Added in Windows 10, version 1909. - 8 - Added in Windows 10, version 2004. +- 9 - Added in Windows 10 Team 2020 Update From c20759c4ac030f5ba1fb83be929dea48a2d54314 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 12:23:22 -0700 Subject: [PATCH 15/27] Update policy-csps-supported-by-surface-hub.md corrects links --- .../policy-csps-supported-by-surface-hub.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index 5f0354a75a..7143291c4b 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -77,22 +77,22 @@ ms.date: 07/21/2020 - [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) - [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) - [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) -- [Wifi/AllowInternetSharing]policy-csp-wifi#wifi-allowinternetsharing) +- [Wifi/AllowInternetSharing](policy-csp-wifi#wifi-allowinternetsharing) - [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi#wifi-allowmanualwificonfiguration) - [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) - [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) - [Wifi/AllowWiFiDirect](policy-csp-wifi#wifi-allowwifidirect) -[WirelessDisplay/AllowMdnsAdvertisement]( +- [WirelessDisplay/AllowMdnsAdvertisement]( policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsadvertisement) -[WirelessDisplay/AllowMdnsDiscovery]( +- [WirelessDisplay/AllowMdnsDiscovery]( policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsdiscovery) -[WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc) -[WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure) -[WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc) -[WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure) -[WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver]( +- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc) +- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure) +- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure) +- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver]( policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) -[WirelessDisplay/RequirePinForPairing]( +- [WirelessDisplay/RequirePinForPairing]( policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing) From a98cd5275447d4dfab1a3fee873bc4032a47026e Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 13:39:02 -0700 Subject: [PATCH 16/27] Update policy-csps-supported-by-surface-hub.md --- .../mdm/policy-csps-supported-by-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index 7143291c4b..71afc212d8 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -15,7 +15,7 @@ ms.date: 07/21/2020 # Policy CSPs supported by Microsoft Surface Hub -- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) - [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) - [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) From 08dbe9828aef0a32033d673f0e532d9a742c91a5 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 14:01:20 -0700 Subject: [PATCH 17/27] Update policy-csps-supported-by-surface-hub.md --- .../mdm/policy-csps-supported-by-surface-hub.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index 71afc212d8..b32eded81d 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -9,14 +9,14 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 07/21/2020 +ms.date: 07/22/2020 --- # Policy CSPs supported by Microsoft Surface Hub - [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) - [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) - [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) From 1c1d6d63459d9fe76e3116a98cfe905494b7cd5d Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 15:05:03 -0700 Subject: [PATCH 18/27] Update policy-csps-supported-by-surface-hub.md --- .../mdm/policy-csps-supported-by-surface-hub.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index b32eded81d..a9afda6609 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -15,8 +15,8 @@ ms.date: 07/22/2020 # Policy CSPs supported by Microsoft Surface Hub -- [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) +-[ApplicationManagement/AllowAppStoreAutoUpdate] (https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) - [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) - [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) @@ -65,7 +65,7 @@ ms.date: 07/22/2020 - [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) - [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) - [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [RestrictedGroups/ConfigureGroupMembership](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-restrictedgroups) +- [RestrictedGroups/ConfigureGroupMembership](https://docs.microsoft.com/windows/client-management/https://docs.microsoft.com/windows/client-management/mdm/policy-csp-restrictedgroups) - [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging) - [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess) - [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel) @@ -79,7 +79,7 @@ ms.date: 07/22/2020 - [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) - [Wifi/AllowInternetSharing](policy-csp-wifi#wifi-allowinternetsharing) - [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi#wifi-allowmanualwificonfiguration) -- [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) +- [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) - [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) - [Wifi/AllowWiFiDirect](policy-csp-wifi#wifi-allowwifidirect) - [WirelessDisplay/AllowMdnsAdvertisement]( From ff56184cdfc87a3e7d1532b52cba65cfeb6a2689 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 15:30:32 -0700 Subject: [PATCH 19/27] Update policy-csps-supported-by-surface-hub.md corrects links --- .../policy-csps-supported-by-surface-hub.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index a9afda6609..bf80772c59 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -77,23 +77,23 @@ ms.date: 07/22/2020 - [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) - [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) - [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) -- [Wifi/AllowInternetSharing](policy-csp-wifi#wifi-allowinternetsharing) +- [Wifi/AllowInternetSharing](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowinternetsharing) - [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi#wifi-allowmanualwificonfiguration) -- [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) -- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) -- [Wifi/AllowWiFiDirect](policy-csp-wifi#wifi-allowwifidirect) -- [WirelessDisplay/AllowMdnsAdvertisement]( +- [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) +- [WiFi/AllowWiFiHotSpotReporting](https://docs.microsoft.com/windows/client-management/policy-csp-wifi.md#wifi-allowwifihotspotreporting) +- [Wifi/AllowWiFiDirect](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowwifidirect) +- [WirelessDisplay/AllowMdnsAdvertisement](https://docs.microsoft.com/windows/client-management/ policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsadvertisement) - [WirelessDisplay/AllowMdnsDiscovery]( policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsdiscovery) -- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc) +- [WirelessDisplay/AllowProjectionFromPC](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc) - [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure) -- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc) -- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure) +- [WirelessDisplay/AllowProjectionToPC](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure) - [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver]( -policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) +https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) - [WirelessDisplay/RequirePinForPairing]( -policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing) +https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing) ## Related topics From 72d752e7661e6dc8931500c817da4a8571af30eb Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 15:31:42 -0700 Subject: [PATCH 20/27] Update policy-csps-supported-by-surface-hub.md --- .../mdm/policy-csps-supported-by-surface-hub.md | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index bf80772c59..1bad51c8b3 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -78,22 +78,18 @@ ms.date: 07/22/2020 - [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) - [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) - [Wifi/AllowInternetSharing](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowinternetsharing) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi#wifi-allowmanualwificonfiguration) +- [Wifi/AllowManualWiFiConfiguration](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowmanualwificonfiguration) - [Wifi/AllowWiFi](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-wifi#wifi-allowwifi) - [WiFi/AllowWiFiHotSpotReporting](https://docs.microsoft.com/windows/client-management/policy-csp-wifi.md#wifi-allowwifihotspotreporting) - [Wifi/AllowWiFiDirect](https://docs.microsoft.com/windows/client-management/policy-csp-wifi#wifi-allowwifidirect) -- [WirelessDisplay/AllowMdnsAdvertisement](https://docs.microsoft.com/windows/client-management/ -policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsadvertisement) -- [WirelessDisplay/AllowMdnsDiscovery]( -policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsdiscovery) +- [WirelessDisplay/AllowMdnsAdvertisement](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsadvertisement) +- [WirelessDisplay/AllowMdnsDiscovery](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowmdnsdiscovery) - [WirelessDisplay/AllowProjectionFromPC](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompc) -- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure) +- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectionfrompcoverinfrastructure) - [WirelessDisplay/AllowProjectionToPC](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopc) - [WirelessDisplay/AllowProjectionToPCOverInfrastructure](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowprojectiontopcoverinfrastructure) -- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver]( -https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) -- [WirelessDisplay/RequirePinForPairing]( -https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing) +- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) +- [WirelessDisplay/RequirePinForPairing](https://docs.microsoft.com/windows/client-management/policy-csp-wirelessdisplay#wirelessdisplay-requirepinforpairing) ## Related topics From a9cc1de4c52ccc391df167601dc77618b7df571a Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 21 Jul 2020 16:05:20 -0700 Subject: [PATCH 21/27] wannacry redirect --- .openpublishing.redirection.json | Bin 2578186 -> 2578156 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 712426afd2db3669cecd0b503309d35bfed71e2e..29d82ddb1ccee127e5ed78e3360921b3741c35b7 100644 GIT binary patch delta 255 zcmWN@JxfAi7{>AY_T}+tS*D$`7hlS1aqxvgN5_J;8rp)EAOhRkMB;&;fAmXXB@R*}OR@+e>(J~pt4BDS!N9qginGAgKI5BsR$0Ec0;I4Y0- E0r8=7^Z)<= delta 178 zcmWN=ISRs16hKj)(eFHuag5`7g18PV7hv%qkV;grF^z?tR>H5e$O>GDt(A@U!1>%F z3Gb0?RWzZFCN=di``6+9Tc0jZv$0Fpxr*I=WhH?h8>X3ImO18GV38%3Sz(nm*4bc_ cEw Date: Tue, 21 Jul 2020 17:27:51 -0700 Subject: [PATCH 22/27] Applied "> [!NOTE]" --- windows/client-management/windows-10-mobile-and-mdm.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index 30f7e1220e..e8a8cb2a19 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -191,7 +191,8 @@ Azure AD is a cloud-based directory service that provides identity and access ma Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Microsoft 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. ->**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. +> [!NOTE] +> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. In addition, Microsoft recently added MDM capabilities powered by Intune to Microsoft 365, called Basic Mobility and Security for Microsoft 365. Basic Mobility and Security for Microsoft 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. Basic Mobility and Security for Microsoft 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information, see [Overview of Basic Mobility and Security for Microsoft 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). **Cloud services** From efb707359c10c2f6b4ec0415ce0a0818b6e8030b Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 19:45:38 -0700 Subject: [PATCH 23/27] Update policy-csps-supported-by-surface-hub.md --- .../mdm/policy-csps-supported-by-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index 1bad51c8b3..bb3bcc976c 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -15,7 +15,7 @@ ms.date: 07/22/2020 # Policy CSPs supported by Microsoft Surface Hub --[ApplicationManagement/AllowAppStoreAutoUpdate] (https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) - [ApplicationManagement/AllowDeveloperUnlock](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) - [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) From 195785081e6be0e3ac582d2fb982947280042b53 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 21:29:12 -0700 Subject: [PATCH 24/27] Update policy-csps-supported-by-surface-hub.md --- .../mdm/policy-csps-supported-by-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md index bb3bcc976c..f265b57c4e 100644 --- a/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policy-csps-supported-by-surface-hub.md @@ -17,7 +17,7 @@ ms.date: 07/22/2020 - [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) - [ApplicationManagement/AllowDeveloperUnlock](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) -- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts#accounts-allowmicrosoftaccountconnection) +- [Accounts/AllowMicrosoftAccountConnection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection) - [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) - [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) - [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) From 2c71dab7fca0e89e47468c733b8c43c9bb42f727 Mon Sep 17 00:00:00 2001 From: John Kaiser <35939694+CoveMiner@users.noreply.github.com> Date: Tue, 21 Jul 2020 21:51:56 -0700 Subject: [PATCH 25/27] Update configuration-service-provider-reference.md --- .../mdm/configuration-service-provider-reference.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 81d5779e45..9648c1ff7b 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2744,10 +2744,10 @@ The following list shows the CSPs supported in HoloLens devices: ## CSPs supported in Microsoft Surface Hub -- [Accounts CSP](accounts-csp)9 **Note:** Support in Surface Hub is limited to **Domain\ComputerName**. +- [Accounts CSP](accounts-csp.md)9 **Note:** Support in Surface Hub is limited to **Domain\ComputerName**. - [AccountManagement CSP](accountmanagement-csp.md) - [APPLICATION CSP](application-csp.md) -- [Bitlocker-csp](bitlocker-csp)9 +- [Bitlocker-csp](bitlocker-csp.md)9 - [CertificateStore CSP](certificatestore-csp.md) - [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) - [Defender CSP](defender-csp.md) @@ -2759,7 +2759,7 @@ The following list shows the CSPs supported in HoloLens devices: - [DMAcc CSP](dmacc-csp.md) - [DMClient CSP](dmclient-csp.md) - [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) -- [Firewall-csp](firewall-csp)9 +- [Firewall-csp](firewall-csp.md)9 - [HealthAttestation CSP](healthattestation-csp.md) - [NetworkQoSPolicy CSP](networkqospolicy-csp.md) - [NodeCache CSP](nodecache-csp.md) @@ -2771,9 +2771,9 @@ The following list shows the CSPs supported in HoloLens devices: - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [SurfaceHub CSP](surfacehub-csp.md) - [UEFI CSP](uefi-csp.md) -- [Wifi-csp](wifi-csp)9 +- [Wifi-csp](wifi-csp.md)9 - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) -- [Wirednetwork-csp](wirednetwork-csp)9 +- [Wirednetwork-csp](wirednetwork-csp.md)9 ## CSPs supported in Windows 10 IoT Core From 645c0bdc510a8919f5b5a156b7422e354d18efd1 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 22 Jul 2020 08:06:02 -0700 Subject: [PATCH 26/27] pencil edits --- .../microsoft-defender-atp/attack-surface-reduction.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 67a5b7958e..dde4d8932b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -113,7 +113,7 @@ The following sections describe each of the 15 attack surface reduction rules. T This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: - Executable files (such as .exe, .dll, or .scr) -- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +- Script files (such as a PowerShell .ps, Visual Basic .vbs, or JavaScript .js file) This rule was introduced in: - [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) @@ -327,7 +327,7 @@ GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c` With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include: * Executable files (such as .exe, .dll, or .scr) -* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +* Script files (such as a PowerShell .ps, Visual Basic .vbs, or JavaScript .js file) This rule was introduced in: - [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) From 7ac6604793a392c9c96f49c5252b1e75d0f8c786 Mon Sep 17 00:00:00 2001 From: Manika Dhiman Date: Wed, 22 Jul 2020 08:19:34 -0700 Subject: [PATCH 27/27] Update configure-server-exclusions-microsoft-defender-antivirus.md Removed an extra bullet --- .../configure-server-exclusions-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md index 3365f5ccee..756e4191f5 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md @@ -403,6 +403,6 @@ This section lists the folder exclusions that are delivered automatically when y - [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) -- - [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) - [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)