diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 8b6383e09d..8ebfb05ade 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7072,7 +7072,7 @@ }, { "source_path": "windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", "redirect_document_id": false }, { @@ -8014,6 +8014,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md", "redirect_url": "/windows/security/operating-system-security/network-security/configure", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/identity-protection/toc.yml b/windows/security/identity-protection/toc.yml index 5762bfaf81..26eafa1368 100644 --- a/windows/security/identity-protection/toc.yml +++ b/windows/security/identity-protection/toc.yml @@ -24,7 +24,7 @@ items: href: enterprise-certificate-pinning.md - name: Web sign-in href: web-sign-in/index.md - - name: Federated sign-in 🔗 + - name: Federated sign-in (EDU) 🔗 href: /education/windows/federated-sign-in - name: Advanced credential protection items: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index 296b2c7a63..a809e05f18 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -38,52 +38,71 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the [!INCLUDE [gpo-settings-1](../../../../../includes/configure/gpo-settings-1.md)] -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. -1. For each network location type (Domain, Private, Public), perform the following steps. - 1. Click the tab that corresponds to the network location type - 1. Under **Logging**, click **Customize** - 1. The default path for the log is **%windir%\system32\logfiles\firewall\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location +1. Expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** +1. In the details pane, in the **Overview** section, select **Windows Defender Firewall Properties** +1. For each network location type (Domain, Private, Public), perform the following steps + 1. Select the tab that corresponds to the network location type + 1. Under **Logging**, select **Customize** + 1. The default path for the log is `%windir%\system32\logfiles\firewall\pfirewall.log`. If you want to change this path, clear the **Not configured** check box and enter the path to the new location, or select **Browse** to select a file location > [!IMPORTANT] > The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file. -1. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a ize. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. +1. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and enter the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. 1. No logging occurs until you set one of following two options: - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** -1. Click **OK** twice - - -| Group policy path | Group policy setting | Value | -| - | - | - | -| **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** |Turn On Virtualization Based Security | **Enabled** and select one of the options listed under the **Credential Guard Configuration** dropdown:
 - **Enabled with UEFI lock**
 - **Enabled without lock**| +1. Select **OK** twice [!INCLUDE [gpo-settings-2](../../../../../includes/configure/gpo-settings-2.md)] --- -### Troubleshoot Slow Log Ingestion +## Recommendations -If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. +Here are some recommendations for configuring Windows Firewall logging: -### Troubleshoot if the log file is not created or modified +- Change the logging size to at least 20,480 KB(20 MB) to ensure that the log file doesn't fill up too quickly. The maximum log size is 32,768 KB(32 MB) +- For each profile (Domain, Private, and Public) change the name from `%windir%\system32\logfiles\firewall\pfirewall.log` to: + - `%windir%\system32\logfiles\firewall\pfirewall_Domain.log` + - `%windir%\system32\logfiles\firewall\pfirewall_Private.log` + - `%windir%\system32\logfiles\firewall\pfirewall_Public.log` +- Log dropped packets to **Yes** +- Log successful connections to **Yes** + +On a single system, you can use the following commands to configure logging: + +```cmd +netsh advfirewall>set allprofiles logging allowedconnections enable +netsh advfirewall>set allprofiles logging droppedconnections enable +``` + +## Parsing methods + +There are several methods to parse the Windows Firewall log files. For example: + +- Enable *Windows Event Forwarding* (WEF) to a *Windows Event Collector* (WEC). To learn more, see [Use Windows Event Forwarding to help with intrusion detection](/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection) +- Forward the logs to your SIEM product such as our Azure Sentinel. To learn more, see [Windows Firewall connector for Microsoft Sentinel](/azure/sentinel/data-connectors/windows-firewall) +- Forward the logs to Azure Monitor and use KQL to parse the data. To learn more, see [Azure Monitor agent on Windows client devices](/azure/azure-monitor/agents/azure-monitor-agent-windows-client) + +> [!TIP] +> If logs are slow to appear in your SIEM solution, you can decrease the log file size. Just beware that the downsizing results in more resource usage due to the increased log rotation. + +## Troubleshoot if the log file is not created or modified Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition might occur include: -- missing permissions for the *Windows Defender Firewall Service* (MpsSvc) on the folder or on the log files -- you want to store the log files in a different folder and the permissions were removed, or haven't been set automatically +- Missing permissions for the *Windows Defender Firewall Service* (`mpssvc`) on the folder or on the log files +- You want to store the log files in a different folder and the permissions are missing, or aren't set automatically - if firewall logging is configured via policy settings, it can happen that - the log folder in the default location `%windir%\System32\LogFiles\firewall` doesn't exist - the log folder in a custom path doesn't exist - In both cases, you must create the folder manually or via script, and add the permissions for MpsSvc -If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existent folder is configured via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. +In both cases, you must create the folder manually or via script, and add the permissions for `mpssvc`. ```PowerShell New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall ``` -Verify if MpsSvc has *FullControl* on the folder and the files. -From an elevated PowerShell session, use the following commands, ensuring to use the correct path: +Verify if `mpssvc` has *FullControl* on the folder and the files. From an elevated PowerShell session, use the following commands, ensuring to use the correct path: ```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" @@ -100,7 +119,7 @@ BUILTIN\Administrators FullControl Allow False ObjectI NT SERVICE\mpssvc FullControl Allow False ObjectInherit ``` -If not, add *FullControl* permissions for mpssvc to the folder, subfolders and files. Make sure to use the correct path. +If not, add *FullControl* permissions for `mpssvc` to the folder, subfolders and files. Make sure to use the correct path. ```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index ec61af70c6..27b0a9b510 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -17,10 +17,8 @@ Windows offers different tools to view the status and configure Windows Firewall - [Configuration Service Provider (CSP)](#configuration-service-provider-csp) - [Command line tools](#command-line-tools) -#### Configuration Service Provider (CSP) - > [!NOTE] -> To change the configuration of Windows Firewall, you must have administative rights on the device. +> To change the configuration of Windows Firewall on a device, you must have administative rights. :::row::: :::column span="4"::: @@ -71,7 +69,7 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="4"::: - The [Firewall CSP](/windows/client-management/mdm/firewall-csp) provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune + The [Firewall CSP](/windows/client-management/mdm/firewall-csp) provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. :::column-end::: :::row-end::: :::row::: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md deleted file mode 100644 index 8c5fb738b8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: Isolating Microsoft Store Apps on Your Network -description: Learn how to customize your firewall configuration to isolate the network access of the new Microsoft Store apps that run on devices added to your network. -ms.topic: conceptual -ms.date: 11/14/2023 ---- - -# Isolating Microsoft Store Apps on Your Network - -When you add new devices to your network, you may want to customize your Windows Firewall configuration to isolate the network access of the new Microsoft Store apps that run on them. Developers who build Microsoft Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. - -For example, a developer can decide that their app should only connect to trusted local networks (such as at home or work), and not to the Internet. In this way, developers can define the scope of network access for their app. This network isolation prevents an app from accessing a network and a connection type (inbound or outbound) if the connection has not been configured for the app. Then the network administrator can customize the firewall to further restrict the resources that the app can access. - -The ability to set and enforce these network boundaries ensures that apps that get compromised can only access networks where they have been explicitly granted access. This significantly reduces the scope of their impact on other apps, the device, and the network. In addition, apps can be isolated and protected from malicious access from the network. - -When creating new Microsoft Store apps, a developer can define the following network capabilities for their app: - -## Home\Work Networking - -Provides inbound and outbound access to intranet networks that the user has designated as a home or a work network, or if the network has an authenticated domain controller. - -## Internet (Client) - -Provides outbound access to the Internet and untrusted networks, such as airports and coffee shops (for example, intranet networks where the user has designated the network as Public). Most apps that require Internet access should use this capability. - -## Internet (Client and Server) - -Provides inbound and outbound access to the Internet and untrusted networks, such as airports and coffee shops. This capability is a superset of the **Internet (Client)** capability, and **Internet (Client)** does not need to be enabled if this capability is enabled. - -## Proximity - -Provides near-field communication (NFC) with devices that are in close proximity to the device. Proximity may be used to send files or connect with an application on a proximate device. - -## In this topic - -To isolate Microsoft Store apps on your network, you need to use Group Policy to define your network isolation settings and create custom Microsoft Store app firewall rules. - -- [Prerequisites](#prerequisites) -- [Step 1: Define your network](#step-1-define-your-network) -- [Step 2: Create custom firewall rules](#step-2-create-custom-firewall-rules) - -## Prerequisites - -- A domain controller is installed on your network, and your devices are joined to the Windows domain. -- Your Microsoft Store app is installed on the client device. -- The Remote Server Administration Tools (RSAT) are installed on your client device. When you perform the following steps from your client device, you can select your Microsoft Store app when you create Windows Defender Firewall rules. - -> [!NOTE] -> You can install the RSAT on your device running Windows from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). - -## Step 1: Define your network - -The **Home\Work Networking** capability enables access to intranet resources. Administrators can use Group Policy settings to define the scope of the intranet. This ensures that Microsoft Store apps can access intranet resources appropriately. - -A network endpoint is considered part of the **Home\\Work Network** if: - -- It is part of the local subnet of a trusted network. - For example, home users generally flag their network as Trusted. Local devices will be designated as such. -- A device is on a network, and it is authenticated to a domain controller. - - Endpoints within the intranet address space are considered private. - - Endpoints within the local subnet are considered private. -- The device is configured for DirectAccess, and the endpoint is part of the intranet address space. - -The intranet address space is composed of configured Active Directory sites and subnets, and it is configured for Windows network isolation specifically by using Group Policy. You can disable the usage of Active Directory sites and subnets by using Group Policy by declaring that your subnet definitions are authoritative. - -Any proxies that you configure or that are automatically configured with proxy autoconfiguration (by using Web Proxy Auto-Discovery (WPAD) protocol) are exempt from the intranet zone. You can add proxy addresses by using Group Policy. - -All other endpoints that do not meet the previously stated criteria are considered endpoints on the Internet. - -### To configure a GPO that defines your intranet address space - -1. Open the Group Policy Management snap-in (gpmc.msc), right click on the Group Policy you want to use to define your address space, and select **Edit**. -1. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**. -1. In the right pane, double-click **Private network ranges for apps**. -1. In the **Private network ranges for apps** dialog box, click **Enabled**. In the **Private subnets** text box, type the private subnets for your intranet, separated by commas if necessary. - For example, if the Contoso intranet is defined as 10.0.0.0 with a subnet mask of 255.255.255.0, you would type 10.0.0.0/24 in the **Private subnets** text box. -1. Double-click **Subnet definitions are authoritative**. - - If you want the subnet definitions that you previously created to be the single source for your subnet definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional subnets by using local settings or network isolation heuristics. - -### To configure the proxy addresses for the intranet and Internet - -1. Double-click **Internet proxy servers for apps**. Click **Enabled**, and then in the **Domain Proxies** text box, type the IP addresses of your Internet proxy servers, separated by semicolons. -2. Double-click **Intranet proxy servers for apps**. Click **Enabled**, and then in the IP address text box, type the IP addresses of your intranet proxy servers, separated by semicolons. -3. Double-click **Proxy definitions are authoritative**. - - If you want the proxy definitions that you previously created to be the single source for your proxy definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional proxies by using local settings or network isolation heuristics. - -## Step 2: Create custom firewall rules - -Microsoft Store apps can declare many capabilities in addition to the network capabilities discussed previously. For example, apps can declare capabilities to access user identity, the local file system, and certain hardware devices. - -The following table provides a complete list of the possible app capabilities. - -| Capability | Name | Description | -| - | - | - | -| **Internet (Client)** | internetClient | Your outgoing Internet connection.| -| **Internet (Client & Server)** | internetClientServer| Your Internet connection, including incoming unsolicited connections from the Internet The app can send information to or from your device through a firewall. You do not need to declare **internetClient** if this capability is declared.| -| **Home\Work Networking** |privateNetworkClientServer| A home or work network. The app can send information to or from your device and other devices on the same network.| -| **Document Library Access**| documentsLibrary| Your Documents library, including the capability to add, change, or delete files. The package can only access file types that are declared in the manifest.| -| **Picture Library Access**| picturesLibrary| Your Pictures library, including the capability to add, change, or delete files.| -| **Video Library Access**| videosLibrary| Your Videos library, including the capability to add, change, or delete files.| -| **Music Library Access**| musicLibrary|Your Music library, including the capability to add, change, or delete files.| -| **Default Windows Credentials**| defaultWindowsCredentials| Your Windows credentials for access to a corporate intranet. This application can impersonate you on the network.| -| **Removable Storage** | removableStorage| A removable storage device, such as an external hard disk, USB flash drive, or MTP portable device, including the capability to add, change, or delete specific files. This package can only access file types that are declared in the manifest.| -| **Shared User Certificates**| sharedUserCertificates| Software and hardware certificates or a smart card, which the app uses to identify you. This capability can be used by an employer, a bank, or government services to identify you.| -| **Location**| location| Provides access to the user's current location.| -| **Microphone** | microphone| Provides access to the microphone's audio feed.| -| **Near-field Proximity** | proximity| Required for near-field communication (NFC) between devices in close proximity. NFC can be used to send files or connect with an app on a proximate device.| -| **Text Messaging** | sms| Provides access to text messaging functionality.| -| **Webcam** | webcam| Provides access to the webcam's video feed.| -| **Other devices (represented by GUIDs)** | <GUID>| Includes specialized devices and Windows Portable Devices.| - -You can create a Windows Defender Firewall policy that is scoped to a set of apps that use a specified capability or scoped to a specific Microsoft Store app. - -For example, you could create a Windows Defender Firewall policy to block Internet access for any apps on your network that have the Documents Library capability. - -### To block Internet access for any apps on your network that have the Documents Library capability - -1. Open the Group Policy Management snap-in (gpmc.msc). -1. In the left pane, right-click your domain name and click **Create a GPO in this domain, and link it here**. -1. Type a name for the GPO in the **Name** text box, and then click **OK**. -1. Right-click the new GPO, and then click **Edit**. -1. In the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall with Advanced Security**, and click **Windows Defender Firewall - LDAP://…** -1. Right-click **Outbound Rules**, and then click **New Rule**. -1. Click **Custom**, and then click **Next**. -1. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. -1. On the **Action** page, ensure that **Block the Connection** is selected, and then click **Next**. -1. On the **Profile** page, click **Next**. -1. On the **Name** page, type a name for your rule, and then click **Finish**. -1. In the right pane, right-click your new rule and click **Properties**. -1. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. -1. Click **Application Package Properties**, and then click **OK**. -1. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\Your documents library**, and then click **OK**. -1. Click the **Scope** tab under **Remote IP addresses**, and then click **Add**. -1. Click **Predefined set of computers**, select **Internet**, and click **OK**. - - This scopes the rule to block traffic to Internet devices. - -1. Click the **Programs and Services** tab, and in the **Application Packages** area, click **Settings**. -1. Click **Apply to application packages only**, and then click **OK**. - - > [!IMPORTANT] - > You must do this to ensure that the rule applies only to Microsoft Store apps and not to other apps. Desktop apps declare all capabilities by default, and this rule would apply to them if you do not configure it this way. - -1. Click **OK** to close the **Properties** dialog box. -1. Close the Group Policy Management Editor. -1. In the Group Policy Management snap-in, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**. Click **Remove**, and then click **OK**. -1. Under **Security Filtering**, click **Add**. -1. Type **domain computers** in the text box, and then click **OK**. -1. Close the Group Policy Management snap-in. - -Use the following procedure if you want to block intranet access for a specific media sharing app on your network. - -### To block intranet access for a specific media sharing app on your network - -1. Open the Group Policy Management snap-in (gpmc.msc). -1. In the left pane, right-click your domain name, and then click **Create a GPO in this domain, and link it here**. -1. Type a name for your GPO in the **Name** text box, and then click **OK**. -1. Right-click your new GPO, and then click **Edit**. -1. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall**, and then click **Windows Defender Firewall – LDAP://**… -1. Right-click **Outbound Rules**, and then click **New Rule**. -1. Click **Custom**, and then click **Next**. -1. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. -1. On the **Action** page, ensure **Block the Connection** is selected, and then click **Next**. -1. On the **Profile** page, click **Next**. -1. On the **Name** page, type a name for your rule, and then click **Finish**. -1. In the right pane, right-click your new rule, and then click **Properties**. -1. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. -1. Click **Application Package Properties**, and then click **OK**. -1. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\A home or work network**, and then click **OK**. -1. Click the **Programs and Services** tab under **Application Packages**, and then click **Settings**. -1. Click **Apply to this application package**, select the app in the text box, and then click **OK**. -1. Click **OK** to close the **Properties** dialog box. -1. Close the Group Policy Management Editor. -1. In Group Policy Management, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**, click **Remove**, and then click **OK**. -1. Under **Security Filtering**, click **Add**. -1. Type **domain computers** in the text box and click **OK**. -1. Close Group Policy Management. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 7e3878d4ea..c20be0d3c1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -15,8 +15,6 @@ items: href: configure-logging.md - name: Hyper-V firewall href: hyper-v-firewall.md - - name: Isolate Microsoft Store apps on your network - href: isolating-apps-on-your-network.md - name: Troubleshoot items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall