From 1378b7f77ee2d39595b7996207bf02b2e917242f Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Wed, 4 Nov 2020 13:50:21 -0800 Subject: [PATCH 1/2] Acro boost edits --- ...cations-deployed-to-each-business-group.md | 10 +++---- ...ine-your-application-control-objectives.md | 28 +++++++++---------- .../wdsc-customize-contact-information.md | 16 +++++------ .../wdsc-firewall-network-protection.md | 2 +- .../wdsc-virus-threat-protection.md | 6 ++-- .../windows-firewall/encryption-zone.md | 4 +-- .../windows-firewall/firewall-gpos.md | 4 +-- .../gathering-the-information-you-need.md | 4 +-- .../windows-firewall/gpo-domiso-encryption.md | 6 ++-- ...-firewall-with-advanced-security-design.md | 4 +-- .../windows-sandbox-architecture.md | 6 ++-- 11 files changed, 44 insertions(+), 46 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md index 1c46616481..24ab242eb1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md @@ -1,6 +1,6 @@ --- title: Create a list of apps deployed to each business group (Windows 10) -description: This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. +description: This topic describes the process of gathering app usage requirements from each business group to implement application control policies by using AppLocker. ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 ms.reviewer: ms.author: dansimp @@ -27,7 +27,7 @@ This topic describes the process of gathering app usage requirements from each b ## Determining app usage -For each business group, determine the following: +For each business group, determine the following information: - The complete list of apps used, including different versions of an app - The full installation path of the app @@ -37,12 +37,12 @@ For each business group, determine the following: ### How to perform the app usage assessment -Although you might already have a method in place to understand app usage for each business group, you will need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate +You might already have a method in place to understand app usage for each business group. You'll need to use this information to help create your AppLocker rule collection. AppLocker includes the Automatically Generate Rules wizard and the **Audit only** enforcement configuration to assist you with planning and creating your rule collection. **Application inventory methods** -Using the Automatically Generate Rules wizard quickly creates rules for the applications you specify. The wizard is designed specifically to build a rule collection. You can use the Local Security Policy snap-in to view and edit the rules. This method is very useful when creating rules from a reference computer, and when creating and evaluating AppLocker policies in a testing environment. However, it does require that the files be accessible on the reference computer or through a network drive. This might mean additional work in setting up the reference computer and determining a maintenance policy for that computer. +Using the Automatically Generate Rules wizard quickly creates rules for the applications you specify. The wizard is designed specifically to build a rule collection. You can use the Local Security Policy snap-in to view and edit the rules. This method is useful when creating rules from a reference computer and when creating and evaluating AppLocker policies in a testing environment. However, it does require that the files be accessible on the reference computer or through a network drive. This might mean additional work in setting up the reference computer and determining a maintenance policy for that computer. Using the **Audit only** enforcement method permits you to view the logs because it collects information about every process on the computers receiving the Group Policy Object (GPO). Therefore, you can see what the enforcement will be on the computers in a business group. AppLocker includes Windows PowerShell cmdlets that you can use to analyze the events from the event log and cmdlets to create rules. However, when you use Group Policy to deploy to several computers, a means to collect events in a central location is very important for manageability. Because AppLocker logs information about files that users or other processes start on a computer, you could miss creating some rules initially. Therefore, you should continue your evaluation until you can verify that all required applications that are allowed to run are accessed successfully. @@ -72,7 +72,7 @@ After you have created the list of apps, the next step is to identify the rule c - Allow or deny - GPO name -To do this, see the following topics: +For guidance, see the following topics: - [Select the types of rules to create](select-types-of-rules-to-create.md) - [Determine the Group Policy structure and rule enforcement](determine-group-policy-structure-and-rule-enforcement.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index adcfdab2e0..b5083772dd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -23,9 +23,9 @@ ms.date: 09/21/2017 - Windows 10 - Windows Server -This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. +This article helps with decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. -AppLocker is very effective for organizations with app restriction requirements whose environments have a simple topography and the application control policy goals are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is to achieve a detailed level of control on the PCs that they manage for a relatively small number of apps. +AppLocker is effective for organizations with app restriction requirements whose environments have a simple topography and whose application control policy goals are straightforward. For example, AppLocker can benefit an environment where non-employees have access to computers connected to the organizational network, such as a school or library. Large organizations also benefit from AppLocker policy deployment when the goal is a detailed level of control on the PCs they manage for a relatively small number of apps. There are management and maintenance costs associated with a list of allowed apps. In addition, the purpose of application control policies is to allow or prevent employees from using apps that might actually be productivity tools. Keeping employees or users productive while implementing the policies can cost time and effort. Lastly, creating user support processes and network support processes to keep the organization productive are also concerns. @@ -59,7 +59,7 @@ Use the following table to develop your own objectives and determine which appli

Policy maintenance

SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).

-

AppLocker policies can be updated by using the Local Security Policy snap-in (if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.

+

AppLocker policies can be updated by using the Local Security Policy snap-in, if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.

Policy application

@@ -68,9 +68,9 @@ Use the following table to develop your own objectives and determine which appli

Enforcement mode

-

SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file are allowed to run by default.

-

SRP can also be configured in the “allow list mode” such that the by default all files are blocked and administrators need to create allow rules for files that they want to allow.

-

AppLocker by default works in the “allow list mode” where only those files are allowed to run for which there is a matching allow rule.

+

SRP works in the “deny list mode” where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the file is allowed to run by default.

+

SRP can also be configured in the “allow list mode” such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.

+

By default, AppLocker works in allow list mode. Only those files are allowed to run for which there's a matching allow rule.

File types that can be controlled

@@ -95,7 +95,7 @@ Use the following table to develop your own objectives and determine which appli

Designated file types

SRP supports an extensible list of file types that are considered executable. You can add extensions for files that should be considered executable.

-

AppLocker does not support this. AppLocker currently supports the following file extensions:

+

AppLocker doesn't support this. AppLocker currently supports the following file extensions: