From a658b3d194baefc173737e48c7989f5933936b8b Mon Sep 17 00:00:00 2001 From: tiburd Date: Tue, 17 Mar 2020 16:30:42 -0700 Subject: [PATCH 01/41] Edit Pass: Windows Security articles --- ...card-group-policy-and-registry-settings.md | 227 ++++++++++++------ ...-basic-audit-policy-on-a-file-or-folder.md | 35 +-- ...icies-associated-with-files-and-folders.md | 52 ++-- ...l-administrators-in-admin-approval-mode.md | 15 +- 4 files changed, 203 insertions(+), 126 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index f663299fb7..a93f2fb987 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -18,9 +18,9 @@ ms.reviewer: # Smart Card Group Policy and Registry Settings -Applies To: Windows 10, Windows Server 2016 +Applies to: Windows 10, Windows Server 2016 -This topic for the IT professional and smart card developer describes the Group Policy settings, registry key settings, local security policy settings, and credential delegation policy settings that are available for configuring smart cards. +This article for IT professionals and smart card developers describes the Group Policy settings, registry key settings, local security policy settings, and credential delegation policy settings that are available for configuring smart cards. The following sections and tables list the smart card-related Group Policy settings and registry keys that can be set on a per-computer basis. If you use domain Group Policy Objects (GPOs), you can edit and apply Group Policy settings to local or domain computers. @@ -66,21 +66,23 @@ The following sections and tables list the smart card-related Group Policy setti ## Primary Group Policy settings for smart cards -The following smart card Group Policy settings are located in Computer Configuration\\Administrative Templates\\Windows Components\\Smart Card. +The following smart card Group Policy settings are in Computer Configuration\\Administrative Templates\\Windows Components\\Smart Card. The registry keys are in the following locations: -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\Policies\\Microsoft\\Windows\\ScPnP\\EnableScPnP +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\Policies\\Microsoft\\Windows\\ScPnP\\EnableScPnP** -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SmartCardCredentialProvider +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SmartCardCredentialProvider** -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CertProp +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CertProp** -> **Note**  Smart card reader registry information is located in HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\Readers.
Smart card registry information is located in HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\SmartCards. +> [!NOTE] +> Smart card reader registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\Readers**.
+Smart card registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\SmartCards**. The following table lists the default values for these GPO settings. Variations are documented under the policy descriptions in this topic. -| **Server Type or GPO** | **Default Value** | +| **Server type or GPO** | **Default value** | |----------------------------------------------|-------------------| | Default Domain Policy | Not configured | | Default Domain Controller Policy | Not configured | @@ -91,13 +93,14 @@ The following table lists the default values for these GPO settings. Variations ### Allow certificates with no extended key usage certificate attribute -This policy setting allows certificates without an enhanced key usage (EKU) set to be used for sign in. +You can use this policy setting to allow certificates without an enhanced key usage (EKU) set to be used for sign in. -> **Note**  Enhanced key usage certificate attribute is also known as extended key usage. +> [!NOTE] +> Enhanced key usage certificate attribute is also known as extended key usage. +> +> In versions of Windows before Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. -In versions of Windows prior to Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. - -When this policy setting is enabled, certificates with the following attributes can also be used to sign in with a smart card: +When this policy setting is turned on, certificates with the following attributes can also be used to sign in with a smart card: - Certificates with no EKU @@ -105,7 +108,7 @@ When this policy setting is enabled, certificates with the following attributes - Certificates with a Client Authentication EKU -When this policy setting is disabled or not configured, only certificates that contain the smart card logon object identifier can be used to sign in with a smart card. +When this policy setting isn't turned on, only certificates that contain the smart card logon object identifier can be used to sign in with a smart card. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| @@ -116,68 +119,87 @@ When this policy setting is disabled or not configured, only certificates that c ### Allow ECC certificates to be used for logon and authentication -This policy setting allows you to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to sign in to a domain. When this setting is enabled, ECC certificates on a smart card can be used to sign in to a domain. When this setting is disabled or not configured, ECC certificates on a smart card cannot be used to sign in to a domain. +You can use this policy setting to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to sign in to a domain. + +When this setting is turned on, ECC certificates on a smart card can be used to sign in to a domain. + +When this setting isn't turned on, ECC certificates on a smart card can't be used to sign in to a domain. | **Item** | **Description** | |--------------------------------------|-------------------------------| -| Registry key | EnumerateECCCerts | +| Registry key | **EnumerateECCCerts** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | This policy setting only affects a user's ability to sign in to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting.
If you use an ECDSA key to sign in, you must also have an associated ECDH key to permit sign-in when you are not connected to the network. | +| Notes and resources | This policy setting only affects a user's ability to sign in to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, aren't affected by this policy setting.
If you use an ECDSA key to sign in, you must also have an associated ECDH key to permit sign in when you're not connected to the network. | ### Allow Integrated Unblock screen to be displayed at the time of logon -This policy setting lets you determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. +You can use this policy setting to determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. -When this setting is enabled, the integrated unblock feature is available. When this setting is disabled or not configured, the feature is not available. +When this setting is turned on, the integrated unblock feature is available. + +When this setting isn't turned on, the feature is not available. | **Item** | **Description** | |--------------------------------------|---------------------------------------------------------------------------------------------------------------| -| Registry key | AllowIntegratedUnblock | +| Registry key | **AllowIntegratedUnblock** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | To use the integrated unblock feature, the smart card must support it. Check with the hardware manufacturer to verify that the smart card supports this feature.
You can create a custom message that is displayed when the smart card is blocked by configuring the policy setting [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked). | +| Notes and resources | To use the integrated unblock feature, the smart card must support it. Check with the hardware manufacturer to verify that the smart card supports this feature.
You can create a custom message that the user sees when the smart card is blocked by configuring the policy setting [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked). | ### Allow signature keys valid for Logon -This policy setting lets you allow signature key-based certificates to be enumerated and available for sign in. When this setting is enabled, any certificates available on the smart card with a signature-only key are listed on the sign-in screen. When this setting is disabled or not configured, certificates available on the smart card with a signature-only key are not listed on the sign-in screen. +You can use this policy setting to allow signature key–based certificates to be enumerated and available for sign in. + +When this setting is turned on, any certificates that are available on the smart card with a signature-only key are listed on the sign-in screen. + +When this setting isn't turned on, certificates available on the smart card with a signature-only key aren't listed on the sign-in screen. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | AllowSignatureOnlyKeys | +| Registry key | **AllowSignatureOnlyKeys**| | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | | ### Allow time invalid certificates -This policy setting permits those certificates that are expired or not yet valid to be displayed for sign-in. +You can use this policy setting to permit certificates that are expired or not yet valid to be displayed for sign in. -Prior to Windows Vista, certificates were required to contain a valid time and to not expire. To be used, the certificate must be accepted by the domain controller. This policy setting only controls which certificates are displayed on the client computer. +> [!NOTE] +> Before Windows Vista, certificates were required to contain a valid time and to not expire. For a certificate to be used, it must be accepted by the domain controller. This policy setting only controls which certificates are displayed on the client computer. -When this setting is enabled, certificates are listed on the sign-in screen whether they have an invalid time or their time validity has expired. When this setting is disabled or not configured, certificates that are expired or not yet valid are not listed on the sign-in screen. +When this setting is turned on, certificates are listed on the sign-in screen whether they have an invalid time, or their time validity has expired. + +When this policy setting isn't turned on, certificates that are expired or not yet valid aren't listed on the sign-in screen. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | AllowTimeInvalidCertificates | +| Registry key | **AllowTimeInvalidCertificates** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | | ### Allow user name hint -This policy setting lets you determine whether an optional field is displayed during sign-in and provides a subsequent elevation process that allows users to enter their user name or user name and domain, which associates a certificate with the user. If this setting is enabled, an optional field is displayed that allows users to enter their user name or user name and domain. If this setting is disabled or not configured, the field is not displayed. +You can use this policy setting to determine whether an optional field appears during sign in and provides a subsequent elevation process where users can enter their username or username and domain, which associates a certificate with the user. + +When this policy setting is turned on, users see an optional field where they can enter their username or username and domain. + +When this policy setting isn't turned on, users don't see this optional field. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | X509HintsNeeded | +| Registry key | **X509HintsNeeded**| | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | | ### Configure root certificate clean up -This policy setting allows you to manage the cleanup behavior of root certificates. Certificates are verified by using a trust chain, and the trust anchor for the digital certificate is the Root Certification Authority (CA). A CA can issue multiple certificates with the root certificate as the top certificate of the tree structure. A private key is used to sign other certificates. This creates an inherited trustworthiness for all certificates immediately under the root certificate. When this setting is enabled, you can set the following cleanup options: +You can use this policy setting to manage the cleanup behavior of root certificates. Certificates are verified by using a trust chain, and the trust anchor for the digital certificate is the Root Certification Authority (CA). A CA can issue multiple certificates with the root certificate as the top certificate of the tree structure. A private key is used to sign other certificates. This creates an inherited trustworthiness for all certificates immediately under the root certificate. + +When this policy setting is turned on, you can set the following cleanup options: - **No cleanup**. When the user signs out or removes the smart card, the root certificates used during their session persist on the computer. @@ -185,122 +207,168 @@ This policy setting allows you to manage the cleanup behavior of root certificat - **Clean up certificates on log off**. When the user signs out of Windows, the root certificates are removed. -When this policy setting is disabled or not configured, root certificates are automatically removed when the user signs out of Windows. +When this policy setting isn't turned on, root certificates are automatically removed when the user signs out of Windows. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | RootCertificateCleanupOption | +| Registry key | **RootCertificateCleanupOption**| | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | | ### Display string when smart card is blocked -When this policy setting is enabled, you can create and manage the displayed message that the user sees when a smart card is blocked. When this setting is disabled or not configured (and the integrated unblock feature is also enabled), the system’s default message is displayed to the user when the smart card is blocked. +You can use this policy setting to change the default message that a user sees if their smart card is blocked. + +When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. + +When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system’s default message when the smart card is blocked. | **Item** | **Description** | |--------------------------------------|-------------------------| -| Registry key | IntegratedUnblockPromptString | +| Registry key | **IntegratedUnblockPromptString** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: This policy setting is only effective when the [Allow Integrated Unblock screen to be displayed at the time of logon](#allow-integrated-unblock-screen-to-be-displayed-at-the-time-of-logon) policy is enabled. | | Notes and resources | | ### Filter duplicate logon certificates -This policy setting lets you use a filtering process to configure which valid sign-in certificates are displayed. During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. +You can use this policy setting to configure which valid sign-in certificates are displayed. -Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (this is determined by their UPN). When this policy setting is enabled, filtering occurs so that the user will only see the most current valid certificates from which to select. If this setting is disabled or not configured, all the certificates are displayed to the user. +> [!NOTE] +> During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. +> +> If two certificates are issued from the same template with the same major version and they are for the same user (this is determined by their UPN), they are determined to be the same. + +When this policy setting is turned on, filtering occurs so that the user can select from only the most current valid certificates. + +If this policy setting isn't turned on, all the certificates are displayed to the user. This policy setting is applied to the computer after the [Allow time invalid certificates](#allow-time-invalid-certificates) policy setting is applied. | **Item** | **Description** | |--------------------------------------|--------------------------------------------------------------------------------------------------| -| Registry key | FilterDuplicateCerts | +| Registry key | **FilterDuplicateCerts**| | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | ### Force the reading of all certificates from the smart card -This policy setting allows you to manage how Windows reads all certificates from the smart card for sign-in. During sign in, Windows reads only the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This policy setting forces Windows to read all the certificates from the smart card. +You can use this policy setting to manage how Windows reads all certificates from the smart card for sign in. During sign in, Windows reads only the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This policy setting forces Windows to read all the certificates from the smart card. -When this policy setting is enabled, Windows attempts to read all certificates from the smart card regardless of the CSP feature set. When disabled or not configured, Windows attempts to read only the default certificate from smart cards that do not support retrieval of all certificates in a single call. Certificates other than the default are not available for sign in. +When this policy setting is turned on, Windows attempts to read all certificates from the smart card, regardless of the CSP feature set. + +When this policy isn't turned on, Windows attempts to read only the default certificate from smart cards that don't support retrieval of all certificates in a single call. Certificates other than the default aren't available for sign in. | **Item** | **Description** | |--------------------------------------|----------------------------------------------------------------------------| -| Registry key | ForceReadingAllCertificates | +| Registry key | **ForceReadingAllCertificates** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None

**Important**  Enabling this policy setting can adversely impact performance during the sign in process in certain situations. | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None

**Important**: Enabling this policy setting can adversely impact performance during the sign in process in certain situations. | | Notes and resources | Contact the smart card vendor to determine if your smart card and associated CSP support the required behavior. | ### Notify user of successful smart card driver installation -This policy setting allows you to control whether a confirmation message is displayed to the user when a smart card device driver is installed. When this policy setting is enabled, a confirmation message is displayed when a smart card device driver is installed. When this setting is disabled or not configured, a smart card device driver installation message is not displayed. +You can use this policy setting to control whether the user sees a confirmation message when a smart card device driver is installed. + +When this policy setting is turned on, the user sees a confirmation message when a smart card device driver is installed. + +When this setting isn't turned on, the user doesn't see a smart card device driver installation message. | **Item** | **Description** | |--------------------------------------|------------------------------------------------| -| Registry key | ScPnPNotification | +| Registry key | **ScPnPNotification** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | ### Prevent plaintext PINs from being returned by Credential Manager -This policy setting prevents Credential Manager from returning plaintext PINs. Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. When this policy setting is enabled, Credential Manager does not return a plaintext PIN. When this setting is disabled or not configured, plaintext PINs can be returned by Credential Manager. +You can use this policy setting to prevent Credential Manager from returning plaintext PINs. + +> [!NOTE] +> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. + +When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. + +When this setting isn't turned on, Credential Manager can return plaintext PINs. | **Item** | **Description** | |--------------------------------------|-----------------------------------------------------------------------------------| -| Registry key | DisallowPlaintextPin | +| Registry key | **DisallowPlaintextPin**| | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | If this policy setting is enabled, some smart cards may not work in computers running Windows. Consult the smart card manufacturer to determine whether this policy setting should be enabled. | +| Notes and resources | If this policy setting is enabled, some smart cards might not work in computers running Windows. Consult the smart card manufacturer to determine whether this policy setting should be enabled. | ### Reverse the subject name stored in a certificate when displaying -When this policy setting is enabled, it causes the display of the subject name to be reversed from the way it is stored in the certificate during the sign-in process. +You can use this policy setting to control the way the subject name appears during sign in. + +> [!NOTE] +> To help users distinguish one certificate from another, the user principal name (UPN) and the common name are displayed by default. For example, when this setting is enabled, if the certificate subject is CN=User1, OU=Users, DN=example, DN=com and the UPN is user1@example.com, "User1" is displayed with "user1@example.com." If the UPN is not present, the entire subject name is displayed. This setting controls the appearance of that subject name, and it might need to be adjusted for your organization. + +When this policy setting is turned on, the subject name during sign in appears reversed from the way that it's stored in the certificate. + +When this policy setting isn’t turned on, the subject name appears the same as it’s stored in the certificate. -To help users distinguish one certificate from another, the user principal name (UPN) and the common name are displayed by default. For example, when this setting is enabled, if the certificate subject is CN=User1, OU=Users, DN=example, DN=com and the UPN is user1@example.com, "User1" is displayed with "user1@example.com." If the UPN is not present, the entire subject name is displayed. This setting controls the appearance of that subject name, and it might need to be adjusted for your organization. | **Item** | **Description** | |--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | ReverseSubject | +| Registry key | **ReverseSubject** | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | | ### Turn on certificate propagation from smart card -This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted. The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. +You can use this policy setting to manage the certificate propagation that occurs when a smart card is inserted. +> [!NOTE] +> The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. -If you enable or do not configure this policy setting, certificate propagation occurs when the user inserts the smart card. When this setting is disabled, certificate propagation does not occur and the certificates will not be made available to applications such as Outlook. +When this policy setting is turned on, certificate propagation occurs when the user inserts the smart card. + +When this policy setting is turned off, certificate propagation doesn't occur, and the certificates aren't available to applications, like Outlook. | **Item** | **Description** | |--------------------------------------|----------------| -| Registry key | CertPropEnabled | +| Registry key | **CertPropEnabled**| | Default values | No changes per operating system versions
Enabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: This policy setting must be enabled to allow the [Turn on root certificate propagation from smart card](#turn-on-root-certificate-propagation-from-smart-card) setting to work when it is enabled. | | Notes and resources | | ### Turn on root certificate propagation from smart card -This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted. The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. When this policy setting is enabled or not configured, root certificate propagation occurs when the user inserts the smart card. +You can use this policy setting to manage the root certificate propagation that occurs when a smart card is inserted. + +> [!NOTE] +> The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. + +When this policy setting is turned on, root certificate propagation occurs when the user inserts the smart card. + +When this policy setting isn’t turned on, root certificate propagation doesn’t occur when the user inserts the smart card. | **Item** | **Description** | |--------------------------------------|---------------------------------------------------------------------------------------------------------| -| Registry key | EnableRootCertificate Propagation | +| Registry key | **EnableRootCertificate Propagation** | | Default values | No changes per operating system versions
Enabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: For this policy setting to work, the [Turn on certificate propagation from smart card](#turn-on-certificate-propagation-from-smart-card) policy setting must also be enabled. | | Notes and resources | | ### Turn on Smart Card Plug and Play service -This policy setting allows you to control whether Smart Card Plug and Play is enabled. This means that your users can use smart cards from vendors who have published their drivers through Windows Update without needing special middleware. These drivers will be downloaded in the same way as drivers for other devices in Windows. If an appropriate driver is not available from Windows Update, a PIV-compliant minidriver that is included with any of the supported versions of Windows is used for these cards. +You can use this policy setting to control whether Smart Card Plug and Play is enabled. -When the Smart Card Plug and Play policy setting is enabled or not configured, and the system attempts to install a smart card device driver the first time a smart card is inserted in a smart card reader. If this policy setting is disabled a device driver is not installed when a smart card is inserted in a smart card reader. +> [!NOTE] +> Your users can use smart cards from vendors who have published their drivers through Windows Update without needing special middleware. These drivers will be downloaded in the same way as drivers for other devices in Windows. If an appropriate driver isn't available from Windows Update, a PIV-compliant mini driver that's included with any of the supported versions of Windows is used for these cards. + +When this policy setting is turned on, the system attempts to install a smart card device driver the first time a smart card is inserted in a smart card reader. + +When this policy setting isn't turned on, a device driver isn't installed when a smart card is inserted in a smart card reader. | **Item** | **Description** | |--------------------------------------|------------------------------------------------| -| Registry key | EnableScPnP | +| Registry key | **EnableScPnP** | | Default values | No changes per operating system versions
Enabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | | Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | @@ -309,9 +377,9 @@ When the Smart Card Plug and Play policy setting is enabled or not configured, a The following registry keys can be configured for the base cryptography service provider (CSP) and the smart card key storage provider (KSP). The following tables list the keys. All keys use the DWORD type. -The registry keys for the Base CSP are located in the registry in HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Base Smart Card Crypto Provider. +The registry keys for the Base CSP are in the registry in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Base Smart Card Crypto Provider**. -The registry keys for the smart card KSP are located in HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Cryptography\\Providers\\Microsoft Smart Card Key Storage Provider. +The registry keys for the smart card KSP are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Cryptography\\Providers\\Microsoft Smart Card Key Storage Provider**. **Registry keys for the base CSP and smart card KSP** @@ -320,7 +388,7 @@ The registry keys for the smart card KSP are located in HKEY\_LOCAL\_MACHINE\\SY | **AllowPrivateExchangeKeyImport** | A non-zero value allows RSA exchange (for example, encryption) private keys to be imported for use in key archival scenarios.
Default value: 00000000 | | **AllowPrivateSignatureKeyImport** | A non-zero value allows RSA signature private keys to be imported for use in key archival scenarios.
Default value: 00000000 | | **DefaultPrivateKeyLenBits** | Defines the default length for private keys, if desired.
Default value: 00000400
Default key generation parameter: 1024-bit keys | -| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that do not support on-card key generation or where key escrow is required.
Default value: 00000000 | +| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that don't support on-card key generation or where key escrow is required.
Default value: 00000000 | | **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.
Default value: 000005dc1500
The default timeout for holding transactions to the smart card is 1.5 seconds. | **Additional registry keys for the smart card KSP** @@ -332,14 +400,14 @@ The registry keys for the smart card KSP are located in HKEY\_LOCAL\_MACHINE\\SY ## CRL checking registry keys -The following table lists the keys and the corresponding values to turn off certificate revocation list (CRL) checking at the Key Distribution Center (KDC) or client. To manage CRL checking, you need to configure settings for both the KDC and the client. +The following table lists the keys and the corresponding values to turn off certificate revocation list (CRL) checking at the Key Distribution Center (KDC) or client. To manage CRL checking, you must configure settings for both the KDC and the client. **CRL checking registry keys** | **Registry Key** | **Details** | |------------|-----------------------------| -| HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Services\\Kdc\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors | Type = DWORD
Value = 1 | -| HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Control\\LSA\\Kerberos\\Parameters\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors | Type = DWORD
Value = 1 | +| **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Services\\Kdc\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors**| Type = DWORD
Value = 1 | +| **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Control\\LSA\\Kerberos\\Parameters\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors**| Type = DWORD
Value = 1 | ## Additional smart card Group Policy settings and registry keys @@ -349,40 +417,41 @@ In a smart card deployment, additional Group Policy settings can be used to enha - Interactive logon: Do not require CTRL+ALT+DEL (not recommended) -The following smart card-related Group Policy settings are located in Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options. +The following smart card-related Group Policy settings are in Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options. **Local security policy settings** -| Group Policy Setting and Registry Key | Default | Description | +| Group Policy setting and registry key | Default | Description | |------------------------------------------|------------|---------------| -| Interactive logon: Require smart card

scforceoption | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

**Enabled** Users can only sign in to the computer by using a smart card.
**Disabled** Users can sign in to the computer by using any method. | -| Interactive logon: Smart card removal behavior

scremoveoption | This policy setting is not defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
**No Action**
**Lock Workstation**: The workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
**Force Logoff**: The user is automatically signed out when the smart card is removed.
**Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. This allows the user to reinsert the smart card and resume the session later, or at another computer that is equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

**Note**  Remote Desktop Services was called Terminal Services in previous versions of Windows Server. | +| Interactive logon: Require smart card

**scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

**Enabled** Users can sign in to the computer only by using a smart card.
**Disabled** Users can sign in to the computer by using any method. | +| Interactive logon: Smart card removal behavior

**scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
**No Action**
**Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
**Force Logoff**: The user is automatically signed out when the smart card is removed.
**Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

**Note**: In earlier versions of Windows Server, Remote Desktop Services was called Terminal Services. | From the Local Security Policy Editor (secpol.msc), you can edit and apply system policies to manage credential delegation for local or domain computers. -The following smart card-related Group Policy settings are located in Computer Configuration\\Administrative Templates\\System\\Credentials Delegation. +The following smart card-related Group Policy settings are in Computer Configuration\\Administrative Templates\\System\\Credentials Delegation. -Registry keys are located in HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults. +Registry keys are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults**. -> **Note**  In the following table, fresh credentials are those that you are prompted for when running an application. +> [!NOTE] +> In the following table, fresh credentials are those that you are prompted for when running an application. **Credential delegation policy settings** -| Group Policy Setting and Registry Key | Default | Description | +| Group Policy setting and registry key | Default | Description | |----------------------------------------------------------------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Allow Delegating Fresh Credentials**

AllowFreshCredentials | Not Configured | This policy setting applies:
When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
To applications that use the CredSSP component (for example, Remote Desktop Services).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
**Disabled**: Delegation of fresh credentials to any computer is not permitted.

**Note**  This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | -| **Allow Delegating Fresh Credentials with NTLM-only Server Authentication**

AllowFreshCredentialsWhenNTLMOnly | Not Configured | This policy setting applies:
When server authentication was achieved by using NTLM.
To applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
**Disabled**: Delegation of fresh credentials is not permitted to any computer.

**Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
See the **Allow Delegating Fresh Credentials** policy setting description for examples. | -| **Deny Delegating Fresh Credentials**

DenyFreshCredentials | Not Configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials cannot be delegated.
**Disabled** or **Not Configured**: A server is not specified.

**Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials cannot be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
See the **Allow Delegating Fresh Credentials** policy setting description for examples. | +| Allow Delegating Fresh Credentials

**AllowFreshCredentials** | Not configured | This policy setting applies:
When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
To applications that use the CredSSP component (for example, Remote Desktop Services).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
**Disabled**: Delegation of fresh credentials to any computer isn't permitted.

**Note**: This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | +| Allow Delegating Fresh Credentials with NTLM-only Server Authentication

**AllowFreshCredentialsWhenNTLMOnly** | Not configured | This policy setting applies:
When server authentication was achieved by using NTLM.
To applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
**Disabled**: Delegation of fresh credentials isn't permitted to any computer.

**Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
See the **Allow Delegating Fresh Credentials** policy setting description for examples. | +| Deny Delegating Fresh Credentials

**DenyFreshCredentials** | Not configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can't be delegated.
**Disabled** or **Not configured**: A server is not specified.

**Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can't be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
For examples, see the "Allow delegating fresh credentials" policy setting. | -If you are using Remote Desktop Services with smart card logon, you cannot delegate default and saved credentials. The registry keys in the following table, which are located at HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults, and the corresponding Group Policy settings are ignored. +If you're using Remote Desktop Services with smart card logon, you can't delegate default and saved credentials. The registry keys in the following table, which are at **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults**, and the corresponding Group Policy settings are ignored. | **Registry key** | **Corresponding Group Policy setting** | |-------------------------------------|---------------------------------------------------------------------------| -| AllowDefaultCredentials | Allow Delegating Default Credentials | -| AllowDefaultCredentialsWhenNTLMOnly | Allow Delegating Default Credentials with NTLM-only Server Authentication | -| AllowSavedCredentials | Allow Delegating Saved Credentials | -| AllowSavedCredentialsWhenNTLMOnly | Allow Delegating Saved Credentials with NTLM-only Server Authentication | +| **AllowDefaultCredentials** | Allow Delegating Default Credentials | +| **AllowDefaultCredentialsWhenNTLMOnly** | Allow Delegating Default Credentials with NTLM-only Server Authentication | +| **AllowSavedCredentials** | Allow Delegating Saved Credentials | +| **AllowSavedCredentialsWhenNTLMOnly** | Allow Delegating Saved Credentials with NTLM-only Server Authentication | ## See also diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index f15fee7c4d..14179cf7bc 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -23,25 +23,26 @@ ms.date: 07/25/2018 - Windows 10 You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. -To complete this procedure, you must be logged on as a member of the built-in Administrators group or you must have been granted the **Manage auditing and security log** right. + +To complete this procedure, you must be signed in as a member of the built-in Administrators group or have **Manage auditing and security log** rights. **To apply or modify auditing policy settings for a local file or folder** -1. Right-click the file or folder that you want to audit, click **Properties**, and then click the **Security** tab. -2. Click **Advanced**. -3. In the **Advanced Security Settings** dialog box, click the **Auditing** tab, and then click **Continue**. +1. Select and hold (or right-click) the file or folder that you want to audit, select **Properties**, and then select the **Security** tab. +2. Select **Advanced**. +3. In the **Advanced Security Settings** dialog box, select the **Auditing** tab, and then select **Continue**. 4. Do one of the following: - - To set up auditing for a new user or group, click **Add**. Click **Select a principal**, type the name of the user or group that you want, and then click **OK**. - - To remove auditing for an existing group or user, click the group or user name, click **Remove**, click **OK**, and then skip the rest of this procedure. - - To view or change auditing for an existing group or user, click its name, and then click **Edit.** + - To set up auditing for a new user or group, select **Add**. Select **Select a principal**, type the name of the user or group that you want, and then select **OK**. + - To remove auditing for an existing group or user, select the group or user name, select **Remove**, select **OK**, and then skip the rest of this procedure. + - To view or change auditing for an existing group or user, select its name, and then select **Edit.** 5. In the **Type** box, indicate what actions you want to audit by selecting the appropriate check boxes: - - To audit successful events, click **Success.** - - To audit failure events, click **Fail.** - - To audit all events, click **All.** + - To audit successful events, select **Success.** + - To audit failure events, select **Fail.** + - To audit all events, select **All.** -6. In the **Applies to** box, select the object(s) that the audit of events will apply to. These include: +6. In the **Applies to** box, select the object(s) to which the audit of events will apply. These include: - **This folder only** - **This folder, subfolders and files** @@ -55,16 +56,20 @@ To complete this procedure, you must be logged on as a member of the built-in Ad - **Read and execute** - **List folder contents** - **Read** - - Additionally, you can choose **Full control**, **Modify**, and/or **Write** permissions with your selected audit combination. + - Additionally, with your selected audit combination, you can select any combination of the following permissions: + - **Full control** + - **Modify** + - **Write** -> **Important:**  Before setting up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md) by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited. +> [!IMPORTANT]   +> Before you set up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md). To do this, define auditing policy settings for the object access event category. If you don't enable object access auditing, you'll receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## Additional considerations -- After object access auditing is enabled, view the security log in Event Viewer to review the results of your changes. +- After you turn on object access auditing, view the security log in Event Viewer to review the results of your changes. - You can set up file and folder auditing only on NTFS drives. -- Because the security log is limited in size, select the files and folders to be audited carefully. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer. +- Because the security log is limited in size, carefully select the files and folders to be audited. Also, consider the amount of disk space that you want to devote to the security log. The maximum size for the security log is defined in Event Viewer.     diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md index 94499439b0..e6131584e5 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -22,38 +22,39 @@ ms.date: 04/19/2017 **Applies to** - Windows 10 -This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. +This article for IT professionals describes how to monitor changes to the central access policies that are associated with files and folders when you're using advanced security auditing options to monitor dynamic access control objects. -This security audit policy and the event that it records are generated when the central access policy that is associated with a file or folder is changed. This security audit policy is useful when an administrator wants to monitor potential changes on some, but not all, files and folders on a file server. +This security audit policy and the event that it records are generated when the central access policy that's associated with a file or folder is changed. This security audit policy is useful when an administrator wants to monitor potential changes on some, but not all, files and folders on a file server. -For info about monitoring potential central access policy changes for an entire file server, see [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md). +For information about monitoring potential central access policy changes for an entire file server, see [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md). Use the following procedures to configure settings to monitor central access policies that are associated with files. These procedures assume that you have configured and deployed Dynamic Access Control in your network. For more information about how to configure and deploy Dynamic Access Control, see [Dynamic Access Control: Scenario Overview](https://technet.microsoft.com/library/hh831717.aspx). ->**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. +> [!NOTE] +> Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. **To configure settings to monitor central access policies associated with files or folders** 1. Sign in to your domain controller by using domain administrator credentials. -2. In Server Manager, point to **Tools**, and then click **Group Policy Management**. -3. In the console tree, right-click the flexible access Group Policy Object, and then click **Edit**. +2. In Server Manager, point to **Tools**, and then select **Group Policy Management**. +3. In the console tree, right-click the flexible access Group Policy Object, and then select **Edit**. 4. Double-click **Computer Configuration**, double-click **Security Settings**, double-click **Advanced Audit Policy Configuration**, double-click **Policy Change**, and then double-click **Audit Authorization Policy Change**. -5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then click **OK**. -6. Enable auditing for a file or folder as described in the following procedure. +5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then select **OK**. +6. Turn on auditing for a file or folder as described in the following procedure. -**To enable auditing for a file or folder** +**To turn on auditing for a file or folder** -1. Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit. -2. Right-click the file or folder, click **Properties**, and then click the **Security** tab. -3. Click **Advanced**, click the **Auditing** tab, and then click **Continue**. +1. Sign in as a member of the local administrator's group on the computer that contains the files or folders that you want to audit. +2. Right-click the file or folder, select **Properties**, and then select the **Security** tab. +3. Select **Advanced**, select the **Auditing** tab, and then select **Continue**. - If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. -4. Click **Add**, click **Select a principal**, type a user name or group name in the format **contoso\\user1**, and then click **OK**. +4. Select **Add**, select **Select a principal**, type a user name or group name in the format **contoso\\user1**, and then select **OK**. 5. In the **Auditing Entry for** dialog box, select the permissions that you want to audit, such as **Full Control** or **Delete**. -6. Click **OK** four times to complete the configuration of the object SACL. -7. Open a File Explorer window and select or create a file or folder to audit. -8. Open an elevated command prompt, and run the following command: +6. To complete the configuration of the object SACL, select **OK** four times. +7. Open a File Explorer window, and then select or create a file or folder to audit. +8. Open an elevated command prompt, and then run the following command: `gpupdate /force` @@ -61,15 +62,16 @@ After you configure settings to monitor changes to the central access policies t **To verify that changes to central access policies associated with files and folders are monitored** -1. Sign in as a member of the local administrators group on the computer that contains the files or folders that you want to audit. -2. Open a File Explorer window and select the file or folder that you configured for auditing in the previous procedure. -3. Right-click the file or folder, click **Properties**, click the **Security** tab, and then click **Advanced**. -4. Click the **Central Policy** tab, click **Change**, and select a different central access policy (if one is available) or select **No Central Access Policy**, and then click **OK** twice. - >**Note:**  You must select a setting that is different than your original setting to generate the audit event. +1. Sign in as a member of the local administrator's group on the computer that contains the files or folders that you want to audit. +2. Open a File Explorer window, and then select the file or folder that you configured for auditing in the previous procedure. +3. Right-click the file or folder, select **Properties**, select the **Security** tab, and then select **Advanced**. +4. Select the **Central Policy** tab, select **Change**, select a different central access policy (if one is available) or select **No Central Access Policy**, and then select **OK** twice. + > [!NOTE] + > You must select a setting that is different than your original setting to generate the audit event. -5. In Server Manager, click **Tools**, and then click **Event Viewer**. -6. Expand **Windows Logs**, and then click **Security**. -7. Look for event 4913, which is generated when the central access policy that is associated with a file or folder is changed. This event includes the security identifiers (SIDs) of the old and new central access policies. +5. In Server Manager, select **Tools**, and then select **Event Viewer**. +6. Expand **Windows Logs**, and then select **Security**. +7. Look for event 4913, which is generated when the central access policy that's associated with a file or folder changes. This event includes the security identifiers (SIDs) of the old and new central access policies. ### Related resource diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md index 4a75974332..fb06a1c928 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -22,7 +22,7 @@ ms.date: 04/19/2017 **Applies to** - Windows 10 -Describes the best practices, location, values, policy management and security considerations for the **User Account Control: Run all administrators in Admin Approval Mode** security policy setting. +This article describes the best practices, location, values, policy management and security considerations for the **User Account Control: Run all administrators in Admin Approval Mode** security policy setting. ## Reference @@ -38,11 +38,12 @@ This policy setting determines the behavior of all User Account Control (UAC) po Admin Approval Mode and all related UAC policies are disabled. - >**Note:**  If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced. + > [!NOTE] + > If this security setting is configured to **Disabled**, the Security Center notifies the user that the overall security of the operating system has been reduced. ### Best practices -- Enable this policy to allow all other UAC features and policies to function. +- Turn on this policy to allow all other UAC features and policies to function. ### Location @@ -67,11 +68,11 @@ This section describes features and tools that are available to help you manage ### Restart requirement -A restart of the computer is required before this policy will be effective when changes to this policy are saved locally or distributed through Group Policy. +The computer must be restarted before this policy is effective when changes to this policy are saved locally or distributed through Group Policy. ### Group Policy -All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console (GPMC) or Local Security Policy snap-in for a domain, site, or organizational unit (OU). +All auditing capabilities are integrated in Group Policy. You can configure, deploy, and manage these settings in the Group Policy Management Console or Local Security Policy snap-in for a domain, site, or organizational unit. ## Security considerations @@ -79,11 +80,11 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -This is the setting that turns UAC on or off. If this setting is disabled, UAC is not used, and any security benefits and risk mitigations that are dependent on UAC are not present on the computer. +This setting turns on or turns off UAC. If this setting isn't turned on, UAC isn't used, and any security benefits and risk mitigations that are dependent on UAC aren't present on the computer. ### Countermeasure -Enable the **User Account Control: Run all users, including administrators, as standard users** setting. +Turn on the **User Account Control: Run all users, including administrators, as standard users** setting. ### Potential impact From 69c1584504373f4c340796b9de4644f1add9779d Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Tue, 17 Mar 2020 16:46:12 -0700 Subject: [PATCH 02/41] pencil edit --- .../smart-card-group-policy-and-registry-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index a93f2fb987..04e43174e8 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -80,7 +80,7 @@ The registry keys are in the following locations: > Smart card reader registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\Readers**.
Smart card registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\SmartCards**. -The following table lists the default values for these GPO settings. Variations are documented under the policy descriptions in this topic. +The following table lists the default values for these GPO settings. Variations are documented under the policy descriptions in this article. | **Server type or GPO** | **Default value** | |----------------------------------------------|-------------------| From e8a6b2c386998e0ddd228dccf8fa9a440d70fbee Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Tue, 17 Mar 2020 16:48:50 -0700 Subject: [PATCH 03/41] pencil edit --- .../auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index 14179cf7bc..8999e420aa 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -62,7 +62,6 @@ To complete this procedure, you must be signed in as a member of the built-in Ad - **Write** - > [!IMPORTANT]   > Before you set up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md). To do this, define auditing policy settings for the object access event category. If you don't enable object access auditing, you'll receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   From 8fef1868fd38cfebf37bc06875553e64f9eea5a1 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Mar 2020 10:20:30 -0700 Subject: [PATCH 04/41] Updated the example --- .../mdm/policy-csp-restrictedgroups.md | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index ceef7004b4..37921c714c 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -122,24 +122,26 @@ Starting in Windows 10, version 1809, you can use this schema for retrieval and -Here is an example: +Here's an example: ``` - - - - + + + - - + + + ``` +where: +- `` contains the local group SID or group name to configure. If an SID is specified here, the policy uses [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. +- `` contains the members to add to the group in ``. If a Name is specified here, the policy will try to get the corresponding SID using [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (Note: This doesn't query Azure AD). For best results, use SID for ``. Groups can be renamed and account name lookups are limited to AD/local machine, so SID is the best and most deterministic way to configure. +The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. +- `Group1` and `Group2` are group locals on the device being configured. -> [!Note] -> * You should include the local administrator while modifying the administrators group to prevent accidental loss of access -> * Include the entire UPN after AzureAD From b970f8dc2db128f7593a3ccf14774410ba1a8614 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Mar 2020 11:45:31 -0700 Subject: [PATCH 05/41] minor updates --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 37921c714c..45f5805676 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -138,7 +138,7 @@ Here's an example: ``` where: - `` contains the local group SID or group name to configure. If an SID is specified here, the policy uses [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. -- `` contains the members to add to the group in ``. If a Name is specified here, the policy will try to get the corresponding SID using [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (Note: This doesn't query Azure AD). For best results, use SID for ``. Groups can be renamed and account name lookups are limited to AD/local machine, so SID is the best and most deterministic way to configure. +- `` contains the members to add to the group in ``. If a name is specified here, the policy will try to get the corresponding SID using [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (**Note:** This doesn't query Azure AD). For best results, use SID for ``. As groups can be renamed and account name lookups are limited to AD/local machine, hence SID is the best and most deterministic way to configure. The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. - `Group1` and `Group2` are group locals on the device being configured. From 93aa06ca24f68fc7e558191c72f06e9a44f3da9a Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Mar 2020 12:05:34 -0700 Subject: [PATCH 06/41] minor update --- .../client-management/mdm/policy-csp-restrictedgroups.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 45f5805676..aba7ce2672 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -137,9 +137,9 @@ Here's an example: ``` where: -- `` contains the local group SID or group name to configure. If an SID is specified here, the policy uses [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. -- `` contains the members to add to the group in ``. If a name is specified here, the policy will try to get the corresponding SID using [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (**Note:** This doesn't query Azure AD). For best results, use SID for ``. As groups can be renamed and account name lookups are limited to AD/local machine, hence SID is the best and most deterministic way to configure. -The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. +- `` contains the local group SID or group name to configure. If an SID is specified here, the policy uses the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. +- `` contains the members to add to the group in ``. If a name is specified here, the policy will try to get the corresponding SID using the [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (**Note:** This doesn't query Azure AD). For best results, use SID for ``. As groups can be renamed and account name lookups are limited to AD/local machine, hence SID is the best and most deterministic way to configure. +The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using the [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. - `Group1` and `Group2` are group locals on the device being configured. From b4b0efd354dc4a26c5698659f00e8ce608f4295d Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Fri, 20 Mar 2020 11:42:50 -0700 Subject: [PATCH 07/41] Update applocker-overview.md Added Note about control processes --- .../applocker/applocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 320db86050..4777a11a1c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -23,7 +23,7 @@ ms.date: 10/16/2017 - Windows 10 - Windows Server -This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. +This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. **Note:** AppLocker doesn't control processes running under system account on all OS versions. AppLocker can help you: From 33aeb5c7cc5bc172e5a115967639bc0a4a0d4fe8 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 20 Mar 2020 13:18:03 -0700 Subject: [PATCH 08/41] Added review feedback --- .../mdm/policy-csp-restrictedgroups.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index aba7ce2672..bc428c7e27 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -74,10 +74,17 @@ manager: dansimp -This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. +This security setting allows an administrator to define the members that are part of a security-sensitive (restricted) group. When a Restricted Groups policy is enforced, any current member of a restricted group that is not on the Members list is removed, except for the built-in administrator in the built-in Administrators group. Any user on the Members list who is not currently a member of the restricted group is added. An empty Members list means that the restricted group has no members. The membership configuration is based on SIDS, therefore renaming these built-in groups does not affect retention of this special membership. + +For example, you can create a Restricted Groups policy to allow only specified users, Alice and John, to be members of the Administrators group. When this policy is refreshed, only Alice and John will remain as members of the Administrators group. > [!CAUTION] -> If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. +> Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: + +> | Error Code in Hex | Error Code in Dec| Symbolic Name | Error Description | Header | +> |----------|----------|----------|----------|----------| +> |0x55b|1371|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| + Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. @@ -140,7 +147,7 @@ where: - `` contains the local group SID or group name to configure. If an SID is specified here, the policy uses the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. - `` contains the members to add to the group in ``. If a name is specified here, the policy will try to get the corresponding SID using the [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (**Note:** This doesn't query Azure AD). For best results, use SID for ``. As groups can be renamed and account name lookups are limited to AD/local machine, hence SID is the best and most deterministic way to configure. The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using the [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. -- `Group1` and `Group2` are group locals on the device being configured. +- In this example, `Group1` and `Group2` are local groups on the device being configured. From 1eb0e9e14ed635649bc2f255733165103d4b9681 Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Mon, 23 Mar 2020 10:26:22 -0700 Subject: [PATCH 09/41] Update applocker-overview.md Updated copy to Notes --- .../applocker/applocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 4777a11a1c..96bda3d33b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -23,7 +23,7 @@ ms.date: 10/16/2017 - Windows 10 - Windows Server -This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. **Note:** AppLocker doesn't control processes running under system account on all OS versions. +This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. **Note:** AppLocker is unable to control processes running under the system account on any OS. AppLocker can help you: From 189b52f907d34e2b4e859b4f6ffc7c19a55dce8c Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Mon, 23 Mar 2020 11:04:19 -0700 Subject: [PATCH 10/41] updated text --- .../microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 8d2e155a2e..3c17e82061 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -52,9 +52,9 @@ DeviceName=any(DeviceName) by DeviceId, AlertId ## Find and remediate software or software versions which have reached end-of-support (EOS) -End-of-support (otherwise known as end-of-life) for software or software versions means that they will no longer be supported or serviced. When you use software or software versions which have reached end-of-support, you're exposing your organization to security vulnerabilities, legal, and financial risks. +End-of-support (otherwise known as end-of-life) for software or software versions means that they will no longer be supported or serviced, and will not receive security updates. When you use software or software versions which have reached end-of-support, you're exposing your organization to security vulnerabilities, legal, and financial risks. -It is crucial for Security and IT Administrators to work together and ensure that the organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem. +It is crucial for Security and IT Administrators to work together and ensure that the organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem. They should examine the options to remove or replace apps that have reached end of support, and update versions that have reached end of support. It is best to create and implement a plan **before** the end of support dates. To find software or software versions which have reached end-of-support: From ce9870d29438e1d007c049a46c4696baa0dfa1cf Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Mar 2020 15:59:41 -0700 Subject: [PATCH 11/41] Updated example --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index bc428c7e27..b9d942f86e 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -76,7 +76,7 @@ manager: dansimp This security setting allows an administrator to define the members that are part of a security-sensitive (restricted) group. When a Restricted Groups policy is enforced, any current member of a restricted group that is not on the Members list is removed, except for the built-in administrator in the built-in Administrators group. Any user on the Members list who is not currently a member of the restricted group is added. An empty Members list means that the restricted group has no members. The membership configuration is based on SIDS, therefore renaming these built-in groups does not affect retention of this special membership. -For example, you can create a Restricted Groups policy to allow only specified users, Alice and John, to be members of the Administrators group. When this policy is refreshed, only Alice and John will remain as members of the Administrators group. +For example, you can create a Restricted Groups policy to allow only specified users, Alice and John, to be members of the Backup Operators group. When this policy is refreshed, only Alice and John will remain as members of the Backup Operators group and all other members will be removed. > [!CAUTION] > Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: From d2ca10080e55222e7f943874e4fc43c390c7d99e Mon Sep 17 00:00:00 2001 From: Emily Bender <44589070+embender@users.noreply.github.com> Date: Mon, 23 Mar 2020 16:23:19 -0700 Subject: [PATCH 12/41] Remove TSF1/2 Deprecate PM for Text Input team here - The Text Input team is not poised to release the TSF3 IMEs publicly at this time so we would like to remove this update as it's not accurate and can lead to confusion amongst our external customers. thanks! reach out to @embender if you have more questions --- windows/deployment/planning/windows-10-deprecated-features.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 3276da608a..520d6cc598 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -28,7 +28,6 @@ The features described below are no longer being actively developed, and might b | Hyper-V vSwitch on LBFO | In a future release, the Hyper-V vSwitch will no longer have the capability to be bound to an LBFO team. Instead, it can be bound via [Switch Embedded Teaming](https://docs.microsoft.com/windows-server/virtualization/hyper-v-virtual-switch/rdma-and-switch-embedded-teaming#bkmk_sswitchembedded) (SET).| 1909 | | Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 | | My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 | -| TSF1/TSF2 IME | TSF1 and TSF2 IME will be replaced by TSF3 IME in a future release. [Text Services Framework](https://docs.microsoft.com/windows/win32/tsf/what-is-text-services-framework) (TSF) enables language technologies. TSF IME are Windows components that you can add to enable typing text for Japanese, Simplified Chinese, Traditional Chinese, and Korean languages. ​| 1909 | | Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user.
 
The recommended replacement for PSR is [Azure App Service](https://docs.microsoft.com/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. | 1909 | | XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information about implementing a remote indirect display driver, ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | 1903 | | Taskbar settings roaming | Roaming of taskbar settings is no longer being developed and we plan to remove this capability in a future release. | 1903 | From d4bcfdea0c85980db3d9d9ff8fa5ee953e00e72e Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Mar 2020 17:04:42 -0700 Subject: [PATCH 13/41] minor change to trigger publishing --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index b9d942f86e..8109b11730 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -7,7 +7,8 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 03/12/2020 +ms.date: 03/23/2020 + ms.reviewer: manager: dansimp --- From 6e47e6962b93c29c2bb8a1c560873af7632f8955 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 24 Mar 2020 10:53:49 +0200 Subject: [PATCH 14/41] update link https://github.com/MicrosoftDocs/windows-itpro-docs/issues/6053 --- devices/surface-hub/surface-hub-2s-pack-components.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/surface-hub-2s-pack-components.md b/devices/surface-hub/surface-hub-2s-pack-components.md index ff8dbd07ad..2c713a0a21 100644 --- a/devices/surface-hub/surface-hub-2s-pack-components.md +++ b/devices/surface-hub/surface-hub-2s-pack-components.md @@ -36,7 +36,7 @@ Use the following steps to pack your Surface Hub 2S 50" for shipment. | **7.** | Replace the cover and slide the Compute Cartridge back into the unit. | ![Replace the cover and slide the Compute Cartridge back into the unit.](images/surface-hub-2s-repack-9.png)| | **8.** | Re-fasten the locking screw and slide the cover into place. | ![Re-fasten the locking screw and slide the cover into place.](images/surface-hub-2s-repack-10.png)| | **9.** | Remove any base or mounting hardware. Using two people, place the unit in the base of the shipping container. | ![Remove any base or mounting hardware. Using two people, place the unit in the base of the shipping container.](images/surface-hub-2s-repack-11.png)| -| **10.** | Replace the cover of the shipping container, and insert the four clips. | ![Replace the cover of the shipping container, and insert the four clips.](images/surface-hub-2s-repack-12.png| +| **10.** | Replace the cover of the shipping container, and insert the four clips. | ![Replace the cover of the shipping container, and insert the four clips.](images/surface-hub-2s-repack-12.png)| | **11.** | Close the four clips. | ![Close the four clips.](images/surface-hub-2s-repack-13.png)| From 5472dd8324239122d3aaeec29ab4b929436f2dc0 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 24 Mar 2020 16:44:49 +0500 Subject: [PATCH 15/41] Added a link Added link to TPM information so that the user can get more details on this. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/6208 --- .../windows-autopilot/windows-autopilot-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index 0e9d529823..997cca0f1f 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -81,7 +81,7 @@ If the Microsoft Store is not accessible, the AutoPilot process will still conti Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode -Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips(including ones from any other manufacturer) come with these certificates preinstalled. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: +Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips(including ones from any other manufacturer) come with these certificates preinstalled, see TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested:
Intel- https://ekop.intel.com/ekcertservice
Qualcomm- https://ekcert.spserv.microsoft.com/EKCertificate/GetEKCertificate/v1
AMD- https://ftpm.amd.com/pki/aia From eb2428d542506a85f2cab39499623035f77b03d3 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 24 Mar 2020 18:18:09 +0500 Subject: [PATCH 16/41] modification in notes Updated a note and added more information provided by the user regarding white-glove deployment. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/6260 --- windows/deployment/windows-autopilot/white-glove.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md index a0bef4bb0b..bbffd240e3 100644 --- a/windows/deployment/windows-autopilot/white-glove.md +++ b/windows/deployment/windows-autopilot/white-glove.md @@ -61,8 +61,8 @@ To enable white glove deployment, an additional Autopilot profile setting must b The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. Please make sure not to target both win32 and LOB apps to the same device. ->[!NOTE] ->Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. +> [!NOTE] +> The white glove technician phase will install all device-targeted apps as well as any user-targeted, device-context apps that are targeted to the assigned user. If there is no assigned user, then it will only install the device-targeted apps. Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. ## Scenarios From ca2aed342e51159ad4dfb24a16c9a53149f3dcae Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Tue, 24 Mar 2020 10:43:53 -0700 Subject: [PATCH 17/41] pencil edit --- .../applocker/applocker-overview.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 96bda3d33b..8deb7aec05 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -23,7 +23,10 @@ ms.date: 10/16/2017 - Windows 10 - Windows Server -This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. **Note:** AppLocker is unable to control processes running under the system account on any OS. +This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. + +> [!NOTE] +> AppLocker is unable to control processes running under the system account on any OS. AppLocker can help you: From 1d11528f3c7806b2b6a3ad90466b6181049b0dc0 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Tue, 24 Mar 2020 10:44:27 -0700 Subject: [PATCH 18/41] pencil edit --- .../applocker/applocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 8deb7aec05..e153eda8b0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -26,7 +26,7 @@ ms.date: 10/16/2017 This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. > [!NOTE] -> AppLocker is unable to control processes running under the system account on any OS. +> AppLocker is unable to control processes running under the system account on any operating system. AppLocker can help you: From 2980454a7b072dd3d1cc8af45e60970b364d0638 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 24 Mar 2020 22:49:00 +0500 Subject: [PATCH 19/41] Update windows/deployment/windows-autopilot/windows-autopilot-requirements.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../windows-autopilot/windows-autopilot-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index 997cca0f1f..afedf2b235 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -81,7 +81,7 @@ If the Microsoft Store is not accessible, the AutoPilot process will still conti Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode -Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips(including ones from any other manufacturer) come with these certificates preinstalled, see TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: +Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips (including devices from any other manufacturer) come with these certificates preinstalled. See TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested:
Intel- https://ekop.intel.com/ekcertservice
Qualcomm- https://ekcert.spserv.microsoft.com/EKCertificate/GetEKCertificate/v1
AMD- https://ftpm.amd.com/pki/aia From f5a8683ab62dd60fa76cb28d03cc3f2ce1d49029 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 24 Mar 2020 10:59:23 -0700 Subject: [PATCH 20/41] Add known issue on CentOS 7.0 and 7.1 --- .../microsoft-defender-atp/microsoft-defender-atp-linux.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index a9f725d9fc..34bd1f07fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -53,6 +53,7 @@ This topic describes how to install, configure, update, and use Microsoft Defend ### Known issues - Logged on users do not appear in the ATP portal. +- Running the product on CentOS / RHEL / Oracle Linux 7.0 or 7.1 with kernel versions lower than 3.19.8 can result in hanging of the operating system. - In SUSE distributions, if the installation of *libatomic1* fails, you should validate that your OS is registered: ```bash From 76857325a2dfec49bd71d1d6fe1510ed2c8a927f Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Tue, 24 Mar 2020 12:01:03 -0700 Subject: [PATCH 21/41] apis --- .../get-missing-kbs-machine.md | 86 +++++++++++++++++ .../get-missing-kbs-software.md | 93 +++++++++++++++++++ .../microsoft-defender-atp/machine.md | 5 +- .../microsoft-defender-atp/software.md | 16 ++-- .../microsoft-defender-atp/tvm-remediation.md | 8 +- 5 files changed, 195 insertions(+), 13 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md create mode 100644 windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md new file mode 100644 index 0000000000..0a94ffa148 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md @@ -0,0 +1,86 @@ +--- +title: Get missing KBs +description: Retrieves a list of software inventory +keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, mdatp tvm api +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Get missing KBs + +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +Retrieves missing KBs by machine Id + +## HTTP request + +``` +GET /api/machines/{machineId}/getmissingkbs +``` + +## Request header + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + +## Request body + +Empty + +## Response + +If successful, this method returns 200 OK, with the specified machine missing kb data in the body. + +## Example + +### Request + +Here is an example of the request. + +``` +GET https://api.securitycenter.windows.com/api/machines/2339ad14a01bd0299afb93dfa2550136057bff96/getmissingkbs +``` + +### Response + +Here is an example of the response. + + +```json +{ + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicProductFixDto)", + "value": [ + { + "id": "4540673", + "name": "March 2020 Security Updates", + "productsNames": [ + "windows_10", + "edge", + "internet_explorer" + ], + "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4540673", + "machineMissedOn": 1, + "cveAddressed": 97 + }, + ... + ] +} +``` + +## Related topics + +- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) +- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md new file mode 100644 index 0000000000..a42ffaea6b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md @@ -0,0 +1,93 @@ +--- +title: Get missing KBs +description: Retrieves a list of software inventory +keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, mdatp tvm api +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Get missing KBs + +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +Retrieves missing KBs by software Id + +## Permissions + +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details. + +Permission type | Permission | Permission display name +:---|:---|:--- +Application |Software.Read.All | 'Read Threat and Vulnerability Management Software information' +Delegated (work or school account) | Software.Read | 'Read Threat and Vulnerability Management Software information' + +## HTTP request + +``` +GET /api/Software/{Id}/getmissingkbs +``` + +## Request header + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + +## Request body + +Empty + +## Response + +If successful, this method returns 200 OK, with the specified software missing kb data in the body. + +## Example + +### Request + +Here is an example of the request. + +``` +GET https://api.securitycenter.windows.com/api/Software/microsoft-_-edge/getmissingkbs +``` + +### Response + +Here is an example of the response. + + +```json +{ + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(microsoft.windowsDefenderATP.api.PublicProductFixDto)", + "value": [ + { + "id": "4540673", + "name": "March 2020 Security Updates", + "productsNames": [ + "edge" + ], + "url": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4540673", + "machineMissedOn": 240, + "cveAddressed": 14 + }, + ... + ] +} +``` + +## Related topics + +- [Risk-based Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) +- [Threat & Vulnerability software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine.md b/windows/security/threat-protection/microsoft-defender-atp/machine.md index a38094be67..92e5b76fd8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine.md @@ -25,6 +25,7 @@ ms.topic: article [!include[Prerelease information](../../includes/prerelease.md)] ## Methods + Method|Return Type |Description :---|:---|:--- [List machines](get-machines.md) | [machine](machine.md) collection | List set of [machine](machine.md) entities in the org. @@ -36,9 +37,11 @@ Method|Return Type |Description [Get security recommendations](get-security-recommendations.md) | [recommendation](recommendation.md) collection | Retrieves a collection of security recommendations related to a given machine ID. [Add or Remove machine tags](add-or-remove-machine-tags.md) | [machine](machine.md) | Add or Remove tag to a specific machine. [Find machines by IP](find-machines-by-ip.md) | [machine](machine.md) collection | Find machines seen with IP. +[Get missing KBs](get-missing-kbs-machine.md) | KB collection | Get a list of missing KBs associated with the machine ID ## Properties -Property | Type | Description + +Property | Type | Description :---|:---|:--- id | String | [machine](machine.md) identity. computerDnsName | String | [machine](machine.md) fully qualified name. diff --git a/windows/security/threat-protection/microsoft-defender-atp/software.md b/windows/security/threat-protection/microsoft-defender-atp/software.md index 49e8e4c12d..414a3a54fc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/software.md @@ -20,11 +20,12 @@ ms.topic: article **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) [!include[Prerelease information](../../includes/prerelease.md)] ## Methods + Method |Return Type |Description :---|:---|:--- [List software](get-software.md) | Software collection | List the organizational software inventory. @@ -32,16 +33,17 @@ Method |Return Type |Description [List software version distribution](get-software-ver-distribution.md)| Distribution collection | List software version distribution by software ID. [List machines by software](get-machines-by-software.md)| MachineRef collection | Retrieve a list of machines that are associated with the software ID. [List vulnerabilities by software](get-vuln-by-software.md) | [Vulnerability](vulnerability.md) collection | Retrieve a list of vulnerabilities associated with the software ID. +[Get missing KBs](get-missing-kbs-software.md) | KB collection | Get a list of missing KBs associated with the software ID ## Properties -Property | Type | Description + +Property | Type | Description :---|:---|:--- id | String | Software ID -Name | String | Software name -Vendor | String | Software vendor name -Weaknesses | Long | Number of discovered vulnerabilities +Name | String | Software name +Vendor | String | Software vendor name +Weaknesses | Long | Number of discovered vulnerabilities publicExploit | Boolean | Public exploit exists for some of the vulnerabilities activeAlert | Boolean | Active alert is associated with this software exposedMachines | Long | Number of exposed machines -impactScore | Double | Exposure score impact of this software - +impactScore | Double | Exposure score impact of this software diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 255962e9a7..6162539530 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -30,17 +30,15 @@ After your organization's cybersecurity weaknesses are identified and mapped to Lower your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. -## Remediation - ## How remediation requests work When you submit a remediation request from Threat & Vulnerability Management, it kicks-off a remediation activity. A security task is created which will be tracked in the Threat & Vulnerability Management **Remediation** page, and a remediation ticket is created in Microsoft Intune. The dashboard will show the status of your top remediation activities. Select any of the entries to go to the **Remediation** page. You can mark the remediation activity as completed after the IT admin team remediates the task. -## Accessing the Remediation page +## Accessing the remediation page -You can access the Remediation page in a few places in the portal: +You can access the remediation page in a few places in the portal: - Security recommendations flyout panel - Navigation menu @@ -70,7 +68,7 @@ If you want to check how the ticket shows up in Intune, see [Use Intune to remed 2. Select the remediation activity that you want to view. ![Screenshot of the remediation page flyout for a software which reached end-of-support](images/remediation_flyouteolsw.png) -### Top remediation activities card the dashboard +### Top remediation activities in the dashboard 1. Go to the Threat & Vulnerability Management dashboard and scroll down to the **Top remediation activities** card. The list is sorted and prioritized based on what is listed in the **Top security recommendations**. 2. Select the remediation activity that you want to view. From 9ae21fb78b5acd26b9f3756b1e6692eae4c27fa8 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 24 Mar 2020 12:29:57 -0700 Subject: [PATCH 22/41] fix bold text --- .../deploy-windows-10-using-pxe-and-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md index 8e1aead949..19ebb6ea7b 100644 --- a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -79,7 +79,7 @@ Examples are provided below of various stages of deployment: ![pc0001k](../images/pc0001k.png)
![pc0001l](../images/pc0001l.png)
![pc0001m](../images/pc0001m.png)
-![pc0001n](../images/pc0001n.png)
+![pc0001n](../images/pc0001n.png) Next, see [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md). From a33284172ce668e12eec0ce9c0f09dc72d192f58 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Tue, 24 Mar 2020 13:01:18 -0700 Subject: [PATCH 23/41] redirect fix --- .openpublishing.redirection.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index b79b7c666a..0991c425ae 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15850,6 +15850,11 @@ "source_path": "windows/deployment/deploy-windows-sccm/get-started-with-configuraton-manager.md", "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", "redirect_document_id": false +}, +{ +"source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-configuration-manager.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", +"redirect_document_id": false } ] } From dc7f704fb009a79cebf952fee7d6fc764f8f9dc7 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Tue, 24 Mar 2020 14:18:19 -0700 Subject: [PATCH 24/41] TOC --- windows/security/threat-protection/TOC.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 72edc00443..4ad6ee6826 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -464,6 +464,7 @@ ####### [Get security recommendations](microsoft-defender-atp/get-security-recommendations.md) ####### [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md) ####### [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md) +####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-machine.md) ###### [Machine Action]() ####### [Machine Action methods and properties](microsoft-defender-atp/machineaction.md) @@ -525,6 +526,7 @@ ####### [List software version distribution](microsoft-defender-atp/get-software-ver-distribution.md) ####### [List machines by software](microsoft-defender-atp/get-machines-by-software.md) ####### [List vulnerabilities by software](microsoft-defender-atp/get-vuln-by-software.md) +####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-software.md) ###### [Vulnerability]() ####### [Vulnerability methods and properties](microsoft-defender-atp/vulnerability.md) From 1ce7af4a6976e9e4d3224b09525e030c9ea6acd2 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 14:34:04 -0700 Subject: [PATCH 25/41] Incorporated PubOps feedback --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 8109b11730..375410ceae 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -81,7 +81,6 @@ For example, you can create a Restricted Groups policy to allow only specified u > [!CAUTION] > Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: - > | Error Code in Hex | Error Code in Dec| Symbolic Name | Error Description | Header | > |----------|----------|----------|----------|----------| > |0x55b|1371|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| From a15c4f78e87380fb023105d99e6fe614e448ff70 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 14:46:14 -0700 Subject: [PATCH 26/41] Formatting --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 375410ceae..135ea0963e 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -81,6 +81,7 @@ For example, you can create a Restricted Groups policy to allow only specified u > [!CAUTION] > Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: +> > | Error Code in Hex | Error Code in Dec| Symbolic Name | Error Description | Header | > |----------|----------|----------|----------|----------| > |0x55b|1371|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| From dc7701a3792f762875c8e76f38e353a366ea7ca6 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Tue, 24 Mar 2020 14:47:33 -0700 Subject: [PATCH 27/41] new sections --- .../threat-and-vuln-mgt-scenarios.md | 15 ++++++++++----- .../tvm-dashboard-insights.md | 2 +- .../tvm-security-recommendation.md | 8 +++++++- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 3c17e82061..f31d2e82a4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -69,6 +69,16 @@ To find software or software versions which have reached end-of-support: After you have identified which software and software versions are vulnerable due to its end-of-support status, remediate them to lower your organizations exposure to vulnerabilities and advanced persistent threats. See [Remediation and exception](tvm-remediation.md) for details. +## Use APIs + +Threat and vulnerability management supports multiple APIs. See the following topics for related APIs: + +- [Machine APIs](machine.md) +- [Recommendation APIs](vulnerability.md) +- [Score APIs](score.md) +- [Software APIs](software.md) +- [Vulnerability APIs](vulnerability.md) + ## Related topics - [Supported operating systems and platforms](tvm-supported-os.md) @@ -83,8 +93,3 @@ After you have identified which software and software versions are vulnerable du - [Advanced hunting overview](overview-hunting.md) - [All advanced hunting tables](advanced-hunting-reference.md) - [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) -- [Recommendation APIs](vulnerability.md) -- [Machine APIs](machine.md) -- [Score APIs](score.md) -- [Software APIs](software.md) -- [Vulnerability APIs](vulnerability.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index d2c196a62c..839193db64 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -76,7 +76,7 @@ Area | Description [**Exposure score**](tvm-exposure-score.md) | See the current state of your organization's device exposure to threats and vulnerabilities. Several factors affect your organization's exposure score: weaknesses discovered in your devices, likelihood of your devices to be breached, value of the devices to your organization, and relevant alerts discovered with your devices. The goal is to lower the exposure score of your organization to be more secure. To reduce the score, you need to remediate the related security configuration issues listed in the security recommendations. [**Configuration score**](configuration-score.md) | See the security posture of the operating system, applications, network, accounts and security controls of your organization. The goal is to remediate the related security configuration issues to increase your configuration score. Selecting the bars will take you to the **Security recommendation** page. **Machine exposure distribution** | See how many machines are exposed based on their exposure level. Select a section in the doughnut chart to go to the **Machines list** page and view the affected machine names, exposure level, risk level, and other details such as domain, operating system platform, its health state, when it was last seen, and its tags. -**Top security recommendations** | See the collated security recommendations which are sorted and prioritized based on your organization's risk exposure and the urgency that it requires. Useful icons also quickly calls your attention to
  • ![Possible active alert](images/tvm_alert_icon.png) possible active alerts
  • ![Threat insight](images/tvm_bug_icon.png) associated public exploits
  • ![Recommendation insight](images/tvm_insight_icon.png) recommendation insights

Tags also indicates the remediation type required, such as **Configuration change**, **Software uninstall** (if the software has reached its end-of-life), and **Software update** (if the software version has reached end-of-support, or if a vulnerable version requires updating). You can drill down on the security recommendation to see potential risks, list of exposed machines, and insights. You can then request a remediation for the recommendation. Select **Show more** to see the rest of the security recommendations in the list or **Show exceptions** for the list of recommendations that have an exception. +**Top security recommendations** | See the collated security recommendations which are sorted and prioritized based on your organization's risk exposure and the urgency that it requires. Select **Show more** to see the rest of the security recommendations in the list or **Show exceptions** for the list of recommendations that have an exception. **Top vulnerable software** | Get real-time visibility into your organization's software inventory with a stack-ranked list of vulnerable software installed on your network's devices and how they impact your organizational exposure score. Select an item for details or **Show more** to see the rest of the vulnerable software list in the **Software inventory** page. **Top remediation activities** | Track the remediation activities generated from the security recommendations. You can select each item on the list to see the details in the **Remediation** page or select **Show more** to view the rest of the remediation activities, and active exceptions. **Top exposed machines** | View exposed machine names and their exposure level. Select a machine name from the list to go to the machine page where you can view the alerts, risks, incidents, security recommendations, installed software, and discovered vulnerabilities associated with the exposed machines. Select **Show more** to see the rest of the exposed machines list. From the machines list, you can manage tags, initiate automated investigations, initiate a live response session, collect an investigation package, run antivirus scan, restrict app execution, and isolate machine. diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index 09f5eadae8..d28353f90b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -61,10 +61,16 @@ Go to the Threat & Vulnerability Management navigation menu and select **Securit You will be able to view the recommendation, the number of weaknesses found, related components, threat insights, number of exposed machines, status, remediation type, remediation activities, impact to your exposure and configuration scores, and associated tags. -The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the amount of exposed machines, the color of the graph will change into green. This happens when the numbers on the right hand side is greater than what's on the left, which means an increase or decrease at the end of even a single machine will change the graph's color. +The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the amount of exposed machines, the color of the graph will change into green. This happens when the numbers on the right hand side is greater than what's on the left, which means an increase or decrease at the end of even a single machine will change the graph's color. ![Screenshot of security recommendations page](images/tvmsecrec-updated.png) +### Icons + +Useful icons also quickly calls your attention to
  • ![Possible active alert](images/tvm_alert_icon.png) possible active alerts
  • ![Threat insight](images/tvm_bug_icon.png) associated public exploits
  • ![Recommendation insight](images/tvm_insight_icon.png) recommendation insights

+ +### Investigate + Select the security recommendation that you want to investigate or process. ![Screenshot of the security recommendation page flyout for a software which reached its end-of-life](images/secrec-flyouteolsw.png) From 2207aa9c3c25e0d8a4764e2301e667323b5e5743 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Tue, 24 Mar 2020 14:51:16 -0700 Subject: [PATCH 28/41] metadata --- .../get-missing-kbs-machine.md | 12 ++++++------ .../get-missing-kbs-software.md | 14 +++++++------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md index 0a94ffa148..86ce1c9e6a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-machine.md @@ -1,14 +1,14 @@ --- -title: Get missing KBs -description: Retrieves a list of software inventory -keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, mdatp tvm api +title: Get missing KBs by machine ID +description: Retrieves missing KBs by machine Id +keywords: apis, graph api, supported apis, get, list, file, information, machine id, threat & vulnerability management api, mdatp tvm api search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor +ms.author: ellevin +author: levinec ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -16,7 +16,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Get missing KBs +# Get missing KBs by machine ID **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md index a42ffaea6b..e91d137857 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-missing-kbs-software.md @@ -1,14 +1,14 @@ --- -title: Get missing KBs -description: Retrieves a list of software inventory -keywords: apis, graph api, supported apis, get, list, file, information, software inventory, threat & vulnerability management api, mdatp tvm api +title: Get missing KBs by software ID +description: Retrieves missing KBs by software ID +keywords: apis, graph api, supported apis, get, list, file, information, software id, threat & vulnerability management api, mdatp tvm api search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor +ms.author: ellevin +author: levinec ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -16,13 +16,13 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Get missing KBs +# Get missing KBs by software ID **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) -Retrieves missing KBs by software Id +Retrieves missing KBs by software ID ## Permissions From 8b52d1ef46a91a7498d3cfe6ad91281121c50011 Mon Sep 17 00:00:00 2001 From: martyav Date: Tue, 24 Mar 2020 17:51:16 -0400 Subject: [PATCH 29/41] customize exploit protection was missing from TOC --- windows/security/threat-protection/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 72edc00443..090ae52053 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -199,6 +199,7 @@ ##### [Exploit protection]() ###### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) +###### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md) ###### [Import/export configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) ##### [Network protection](microsoft-defender-atp/enable-network-protection.md) From 9f0d66c64bc5e5b9f9c112607f8476c8e7ce4e36 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 14:55:37 -0700 Subject: [PATCH 30/41] Formatting --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 135ea0963e..77dbb8f681 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -80,8 +80,7 @@ This security setting allows an administrator to define the members that are par For example, you can create a Restricted Groups policy to allow only specified users, Alice and John, to be members of the Backup Operators group. When this policy is refreshed, only Alice and John will remain as members of the Backup Operators group and all other members will be removed. > [!CAUTION] -> Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: -> +> Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: > | Error Code in Hex | Error Code in Dec| Symbolic Name | Error Description | Header | > |----------|----------|----------|----------|----------| > |0x55b|1371|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| From b1148fab9b9994ac373b9f8b1e91e9cb67f90ab0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 15:00:42 -0700 Subject: [PATCH 31/41] Formatting --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 77dbb8f681..0c768e2b75 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -81,9 +81,9 @@ For example, you can create a Restricted Groups policy to allow only specified u > [!CAUTION] > Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: -> | Error Code in Hex | Error Code in Dec| Symbolic Name | Error Description | Header | +> | Error Code | Symbolic Name | Error Description | Header | > |----------|----------|----------|----------|----------| -> |0x55b|1371|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| +> |0x55b (Hex)
1371 (Dec)|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. From e646fc36c5a824b6fab56e29e7d1565062f5e3a0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 15:10:28 -0700 Subject: [PATCH 32/41] minor update --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 0c768e2b75..43888ae836 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 03/23/2020 +ms.date: 03/24/2020 ms.reviewer: manager: dansimp From 8ff1fc92f66a9faa18138c75c6e728076ffc01f8 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 15:19:42 -0700 Subject: [PATCH 33/41] Formatting --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 43888ae836..3f27668d11 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -81,6 +81,7 @@ For example, you can create a Restricted Groups policy to allow only specified u > [!CAUTION] > Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: +> > | Error Code | Symbolic Name | Error Description | Header | > |----------|----------|----------|----------|----------| > |0x55b (Hex)
1371 (Dec)|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| From 94a788e1e77248ccf7ec7e0fdf29fba268dedfa4 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 15:27:03 -0700 Subject: [PATCH 34/41] update to trigger build --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 3f27668d11..dc3e4f0f4e 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -86,7 +86,6 @@ For example, you can create a Restricted Groups policy to allow only specified u > |----------|----------|----------|----------|----------| > |0x55b (Hex)
1371 (Dec)|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| - Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. ```xml From d075491f7c1ce3f6d8961e3aea28d3e1fa2c7059 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 15:36:34 -0700 Subject: [PATCH 35/41] Table format update --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index dc3e4f0f4e..69c1cffc16 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -83,7 +83,7 @@ For example, you can create a Restricted Groups policy to allow only specified u > Attempting to remove the built-in administrator from the Administrators group will result in failure with the following error: > > | Error Code | Symbolic Name | Error Description | Header | -> |----------|----------|----------|----------|----------| +> |----------|----------|----------|----------| > |0x55b (Hex)
1371 (Dec)|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. From a22b2731f67ff827a36eda67a8efaa3a979ea78b Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 24 Mar 2020 15:37:00 -0700 Subject: [PATCH 36/41] Fixes --- .../microsoft-defender-atp-linux.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index 34bd1f07fc..38477041ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -38,10 +38,6 @@ This topic describes how to install, configure, update, and use Microsoft Defend > [!CAUTION] > Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to cause performance problems and unpredictable system errors. - - - - ## How to install Microsoft Defender ATP for Linux ### Prerequisites @@ -53,7 +49,7 @@ This topic describes how to install, configure, update, and use Microsoft Defend ### Known issues - Logged on users do not appear in the ATP portal. -- Running the product on CentOS / RHEL / Oracle Linux 7.0 or 7.1 with kernel versions lower than 3.19.8 can result in hanging of the operating system. +- Running the product on CentOS / RHEL / Oracle Linux 7.0 or 7.1 with kernel versions lower than 3.10.0-327 can result in hanging the operating system. We recommend that you upgrade to version 7.2 or newer. - In SUSE distributions, if the installation of *libatomic1* fails, you should validate that your OS is registered: ```bash @@ -78,12 +74,12 @@ In general you need to take the following steps: - Supported Linux server distributions and versions: - - Red Hat Enterprise Linux 7 or higher - - CentOS 7 or higher + - Red Hat Enterprise Linux 7.2 or higher + - CentOS 7.2 or higher - Ubuntu 16.04 LTS or higher LTS - Debian 9 or higher - SUSE Linux Enterprise Server 12 or higher - - Oracle Linux 7 + - Oracle Linux 7.2 or higher - Minimum kernel version 2.6.38 - The `fanotify` kernel option must be enabled From 76f2391de5d1a01ef147785e178fd4318124b6f1 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Mar 2020 15:41:46 -0700 Subject: [PATCH 37/41] Minor update --- windows/client-management/mdm/policy-csp-restrictedgroups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 69c1cffc16..959f35a071 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -84,7 +84,7 @@ For example, you can create a Restricted Groups policy to allow only specified u > > | Error Code | Symbolic Name | Error Description | Header | > |----------|----------|----------|----------| -> |0x55b (Hex)
1371 (Dec)|ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.|winerror.h| +> | 0x55b (Hex)
1371 (Dec) |ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.| winerror.h | Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. From eb07a9b365438dd7d3f50fcc99f5249db6d9af23 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 24 Mar 2020 16:06:49 -0700 Subject: [PATCH 38/41] Removed "/en-us" in a Microsoft URL --- .../windows-autopilot/windows-autopilot-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index afedf2b235..ec42f18fb9 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -81,7 +81,7 @@ If the Microsoft Store is not accessible, the AutoPilot process will still conti Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode -Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips (including devices from any other manufacturer) come with these certificates preinstalled. See TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: +Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips (including devices from any other manufacturer) come with these certificates preinstalled. See TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested:
Intel- https://ekop.intel.com/ekcertservice
Qualcomm- https://ekcert.spserv.microsoft.com/EKCertificate/GetEKCertificate/v1
AMD- https://ftpm.amd.com/pki/aia From 07556f20b3b5e8c00aa3d5f4d45e117da8a4ea1c Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 24 Mar 2020 16:08:30 -0700 Subject: [PATCH 39/41] Capitalized "directory" in "Azure Active directory" --- windows/deployment/windows-autopilot/white-glove.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md index bbffd240e3..88eb4f33e3 100644 --- a/windows/deployment/windows-autopilot/white-glove.md +++ b/windows/deployment/windows-autopilot/white-glove.md @@ -30,7 +30,7 @@ With **Windows Autopilot for white glove deployment**, the provisioning process ![OEM](images/wg02.png) -Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven mode for Azure Active Directory Join, and user-driven mode for Hybrid Azure Active directory join scenarios. +Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven mode for Azure Active Directory Join, and user-driven mode for Hybrid Azure Active Directory join scenarios. ## Prerequisites From f76b1d94326b522ab7a4ad29bc7c9817e751b70e Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 24 Mar 2020 16:10:02 -0700 Subject: [PATCH 40/41] Capitalized "semi-annual channel" --- .../windows-autopilot/windows-autopilot-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index ec42f18fb9..e1b8727f43 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -27,7 +27,7 @@ Windows Autopilot depends on specific capabilities available in Windows 10, Azur ## Software requirements -- A [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 semi-annual channel is required. Windows 10 Enterprise 2019 long-term servicing channel (LTSC) is also supported. +- A [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 Semi-Annual Channel is required. Windows 10 Enterprise 2019 long-term servicing channel (LTSC) is also supported. - The following editions are supported: - Windows 10 Pro - Windows 10 Pro Education From 8735a5fd49a2b8e271d8624ec528b19a85ceea07 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 25 Mar 2020 08:56:43 -0700 Subject: [PATCH 41/41] pencil edit --- .../auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index 8999e420aa..a18783d92c 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -61,8 +61,7 @@ To complete this procedure, you must be signed in as a member of the built-in Ad - **Modify** - **Write** - -> [!IMPORTANT]   +> [!IMPORTANT] > Before you set up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md). To do this, define auditing policy settings for the object access event category. If you don't enable object access auditing, you'll receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## Additional considerations